S 1197 Introduced – FY 2014 DOD Authorization

As I noted earlier Sen. Levin (D,MI) introduced S 1197, the National Defense Authorization Act for Fiscal Year 2014, and the bill has been reported favorably by the Senate Armed Services Committee. As expected the bill has some significant cybersecurity provisions including support for the development of tools for checking software code vulnerability, looking at the use of National Guard troops for homeland cyber-response tasks and controls on the trade in ‘cyber-weapons’.

Cyberspace Subtitle

Subtitle D of Title IX (DOD Organization and Management) deals with ‘Cyberspace-Related Matters’. Most of the provisions relate to cyber-warfare but some deal with cybersecurity related matters. The eight sections within the Subtitle are:

• Section 941: Authorities, capabilities, and oversight of the United States Cyber Command.

• Section 942: Joint software assurance center for the Department of Defense.

• Section 943: Supervision of the acquisition of cloud computing capabilities for intelligence analysis.

• Section 944: Cyber vulnerabilities of Department of Defense weapon systems and tactical communications systems.

• Section 945: Strategy on use of the reserve components of the Armed Forces to support Department of Defense cyber missions.

• Section 946: Control of the proliferation of cyber weapons.

• Section 947: Integrated policy to deter adversaries in cyberspace.

• Section 948: Centers of Academic Excellence for Information

Probably the most significant of the DOD provisions in this Subtitle can be found in §941. It provides for the separation of the DOD cyber-warfare (offensive and defensive) organizations from the cyber intelligence program and the information security program in DOD. This specifically includes providing separate hardware and internet access capabilities for US Cyber Command (USCC) separate from the National Security Agency. It does not, however, address the current fact that the commander of both the NSA and the USCC are the same person.

Software Assurance Tools

Section 942 requires DOD to establish a Joint Software Assurance Center separate from the one established by the National Security Agency (more separation of USCC from NSA). The new JSAC would work with the NSA agency to establish a “program of research and development to improve automated software code vulnerability analysis and testing tools” {§942(c)(3)}.

The Committee report further emphasizes this the importance of this program in the Committee report (pg 46, Adobe 69) by providing an additional $10 million for the Air Force version of this proposed organization, Application Software Assurance Center of Excellence (ASACOE).

The Committee report also notes that this proposed JSAC would help the military comply with the §933 requirements of the FY 2103 National Defense Authorization Act.

There is nothing in §942 that would address the availability of such tools for work in the civilian sector, but it is reasonable to suppose that it might be made available to DHS in support of cybersecurity activities in the critical infrastructure sectors.

Homeland Cyber Response

It is apparent that the use of National Guard cyber-warriors is the ‘cybersecurity’ idea of the year. We have seen it proposed in two identical bills (HR 1640 and S 658) and a version was included in the House DOD spending bill, HR 2397, Committee Report. This bill provides yet a third version of the idea as part of §945 examination of the use of the Reserve Components in DOD cyber missions.

DOD and DHS would be required to take a coordinated look at the use of National Guard in a cyber homeland defense role. The bill specifically tasks the two departments to get input from the Governors on “State cyber capabilities, and State cyber needs that cannot be fulfilled through the private sector” {§945(b)(2)}. This is part of the requirement to determine if the National Guard, operating under State status “can operate under unique and useful authorities to support domestic cyber missions and requirements of the Department or the United States Cyber Command” {§945(b)(4)}.

The bill even goes so far as to suggest that DOD looks into if it would be appropriate to hire part-time National Guard Technicians with appropriate cybersecurity expertise to assist “the National Guard in protecting critical infrastructure [emphasis added] and carrying out cyber security missions in defense of the United States homeland” {§945(b)(5)}.

Operation of the National Guard units under State status is an important legal distinction. Because of restrictions on the domestic use of military forces under the Posse Comitatus Act (18 USC 1385) it would be necessary to use National Guard units under the command of Governors to participate in many cyber related homeland defense missions.

Control of Cyber Weapons

Section 946 addresses attempt to control the international trade in cyber weapons. It requires the President to establish yet another “interagency process to provide for the establishment of an integrated policy to control the proliferation of cyber weapons” {§946(a)}.

Since there is not currently a legal definition of ‘cyber weapons’ the same interagency process is also required to identify “the types of dangerous software that can and should be controlled through export controls” {§946(b)(1)}. The Committee Report notes:

“This process will require developing definitions and categories for controlled cyber technologies and determining how to address dual use, lawful intercept, and penetration testing technologies.” (pg 159, Adobe 181)

It is clear that someone on the Senate Armed Forces Committee staff realizes that many of these ‘cyber weapons’ might have legitimate uses in the cybersecurity field. The Committee Report states:

“However, the approaches developed must also take into account the needs of legitimate cybersecurity professionals to mitigate vulnerabilities, and not stifle innovation in tools and technology that are necessary for national security and the cybersecurity of the Nation.” (pg 160, Adobe 182)

The section requires the identification of methods that should be used to “suppress the trade in cyber tools and infrastructure that are or can be used for criminal, terrorist, or military activities while preserving the ability of governments and the private sector to use such tools for legitimate purposes of self-defense” {§946(b)(2)}.

Moving Forward

I expect that the Senate will move forward with its consideration of S 1197 in the few weeks remaining before the Summer Recess. The bill will pass after some significant amendments are offered and wrangled over. The Senate will then vote to substitute the wording from this bill for the House wording of HR 1960. The bill will then go to conference to work out the differences between the two bills. That won’t happen until sometime later this year, probably after the start of FY 2014.

Offensive Cyber Weapons – Construction, Development, and Employment

Thanks to a TWEET® from Thomas Rid yesterday I had a chance to read an article by Dale Peterson in the Journal of Strategic Studies about offensive cyber-weapons. Now if you have been reading Dale’s blog at DigitalBond for the last couple of years like I have, there really isn’t much new information here; but he has brought a great deal of information together here in a way that hasn’t been done before. More importantly, he has brought the information to a completely new audience; an audience that really needs to understand just how easy it is to construct a cyber-weapon to attack industrial control systems.

Insecure By Design

People in the control system security community are certainly aware of Dale’s almost patented phrase ‘insecure by design’. Not surprisingly Dale opens his article with a discussion of this concept. Using the Stuxnet example he explains:

“The purpose of Stuxnet was to load a program onto the Programmable Logic Controller (PLC) that controlled the centrifuges at the Natanz fuel enrichment plant. The attackers developed various Windows exploits in order to gain access to the network that the PLCs were on. But once access was gained, no attack code was required to load the cyber weapon onto the PLCs. The Siemens S7 PLC has no source or data identification so any attacker with access to it can load his own program, tell the process to stop, reboot the PLC, or whatever else is desired.”

Three Weapon Types

Dale addresses the issue of the complexity of industrial control systems being a sort of cyber-defense, by noting that there are three different types of attacks that can be initiated depending on the knowledge the attacker has about the control system. Basically they can be described as:

• Simple Weapon – The “attacker uses the lack of authentication to cause the system to crash or operate incorrectly”;

• Moderately Complex Weapon – The “attacker learns about the process and determines how to destroy a physical component or subsystem that will take time to replace”; and

• Complex Weapon – The “attacker modifies the process in a stealthy manner so a cyber attack is not suspected”.

He goes on to give a brief example of how complex a ‘simple weapon’ can be made using a worm to reprogram firmware in a ControlLogix PLC that produces intermittent process failures. As a process chemist this is my most feared type of attack because random failures will be almost impossible to detect as an attack. Unless the facility engineering team has reason to suspect a cyber-attack they will waste untold man-hours trying to track down the root cause of their apparently unrelated process problems while the facility becomes an economic wreck.

Weapon Deployment

Dale notes that cyber-weapon deployment is actually more difficult in most cases than is the development of the actual attack code. This is because most critical cyber-targets are going to be electronically isolated from the easiest attack vector, the internet. Dale briefly describes a variety of common methods of getting the electronic weapon payload into the targeted system. Unfortunately, to my mind, he only mentions in passing the most likely method to be employed against most Western nations; spear phishing.

Because of the difficulties in gaining electronic access to the most important targets the most effective method of deployment is advanced deployment of the electronic payload and then subsequently activating the weapon at the most opportune time. This requires some sort of ‘command and control’ communications link. Dale spends some time describing some of the techniques that are available to achieve these communications.

The Audience

As I noted earlier, Dale is focusing this paper on a different audience than he normally attracts to his blog or his business. Given the publication, it is obvious that he is targeting the planners and politicians that will be either deploying cyber-weapons or defending against them. With that audience in mind, I think he has achieved a reasonable level of technical detail in his presentation. I think he has successfully avoided the pitfalls frequently encountered when a technical expert describes a problem for a non-technical audience.

Most readers of this blog are not going to find anything new here, but I do recommend that anyone in the control system business; including owners, vendors, and integrators, should send a copy of this article to their legislative representatives in Washington. With cybersecurity being an important political topic in the coming months, this article might help to favorably inform the lawmakers about the real cybersecurity problems facing this country.