Pentagon cites largest-ever loss of defence data in cyberattack; reveals new def

[Guest guest]

http://ca.news.yahoo.com/pentagon-cites-largest-ever-loss-defence-data-cyberatta\

ck-185038159.html

Pentagon cites largest-ever loss of defence data in cyberattack; reveals new

defence strategy

By Lolita C. Baldor, Burns, The Associated Press | The Canadian Press – 1

hour 1 minute ago

WASHINGTON - The Pentagon on Thursday revealed that in the spring it suffered

one of its largest losses ever of sensitive data in a cyberattack by a foreign

government. It's a dramatic example of why the military is pursuing a new

strategy emphasizing deeper defences of its computer networks, collaboration

with private industry and new steps to stop " malicious insiders. "

Lynn, the deputy secretary of defence, said in a speech outlining the

strategy that 24,000 files containing Pentagon data were stolen from a defence

industry computer network in a single intrusion in March. He offered no details

about what was taken but said the Pentagon believes the attacker was a foreign

government. He didn't say which nation.

" We have a pretty good idea " who did it, Lynn said in an interview before the

speech. He would not elaborate.

Many cyberattacks in the past have been blamed on China or Russia. One of the

Pentagon's fears is that eventually a terrorist group, with less at stake than a

foreign government, will acquire the ability to not only penetrate U.S. computer

networks to steal data but to attack them in ways that damage U.S. defences or

even cause deaths.

In his speech at the National Defence University, Lynn said that sophisticated

computer capabilities reside almost exclusively in nation-states, and that U.S.

military power is a strong deterrent against overtly destructive cyberattacks.

Terrorist groups and rogue states, he said, are a different problem and harder

to deter.

" If a terrorist group gains disruptive or destructive cybertools, we have to

assume they will strike with little hesitation, " he said.

The Pentagon has long worried about the vulnerability of its computer systems.

The concern has grown as the military becomes more dependent not only on its own

computers but also on those of its defence contractors, including providers of

the fuel, electricity and other resources that keep the military operating

globally.

At his Senate confirmation hearing last month, new Defence Secretary Leon

Panetta cited " a strong likelihood that the next Pearl Harbor " could well be a

cyberattack that cripples the U.S. power grid and financial and government

systems. He said last weekend that cybersecurity will be one of the main focuses

of his tenure at the Pentagon.

" For the Department of Defence, our networks are really our lifeblood, " Marine

Gen. Cartwright, vice chairman of the Joint Chiefs of Staff, told

reporters in an interview prior to Lynn's release of the new strategy.

As shown by the March attack on a defence industry computer network that

contained sensitive defence data, the military's vulnerability extends beyond

its own computers. In a new pilot program, the Pentagon is sharing classified

threat intelligence with a handful of companies to help them identify and block

malicious activity.

Lynn said intrusions in the last few years have compromised some of the

Pentagon's most sensitive systems, including surveillance technologies and

satellite communications systems. Penetrations of defence industry networks have

targeted a wide swath of military hardware, including missile tracking systems

and drone aircraft, he said.

In Cartwright's view, a largely defensive approach to the problem is inadequate.

He said the Pentagon currently is focused 90 per cent on defensive measures and

10 per cent on offence; the balance should be the reverse, he said. For the

federal government as a whole, a 50-50 split would be about right, Cartwright

argued.

" If it's OK to attack me and I'm not going to do anything other than improve my

defences every time you attack me, it's difficult " to stop that cycle,

Cartwright said. He added that a number of complex legal and cultural issues

need to be sorted out before the Pentagon can devise a comprehensive offensive

strategy.

Earlier this year, President Barack Obama signed executive orders that lay out

how far military commanders around the globe can go in using cyberattacks and

other computer-based operations against enemies and as part of routine

espionage. The orders detail when the military must seek presidential approval

for a specific cyberattack on an enemy, defence officials and cybersecurity

experts told the AP.

The strategy unveiled by Lynn is oriented toward defensive rather than offensive

measures. It calls for developing more resilient computer networks so the

military can continue to operate if critical systems are breached or taken down.

It also says the Pentagon must improve its workers' cyber " hygiene " to keep

viruses and other intrusions at bay. And it calls for fuller collaboration with

other federal agencies, companies and foreign allies.

The strategy also is focused on insider threats. Without citing specifics, it

says it will try to deter " malicious insiders " by " shaping behaviours and

attitudes through the imposition of higher costs for malicious activity. "

Baker, a former assistant secretary at the Department of Homeland

Security, called the plan thoughtful but lacking in some aspects.

" It's an incomplete description of a defensive strategy, " he said. " If the

Pentagon announced that our nuclear warfare strategy centred on fallout

shelters, we'd all hope that they had a real strategy that was better than

that. "