Retired General: U.S. 'Hugely Vulnerable' To Cyber Attacks

COLORADO SPRINGS, Colo. -- The United States is still "hugely vulnerable" to cyber attacks, but so are most other nations, a former chairman of the Joint Chiefs of Staff said Monday.

"We're way late" in preparing to defend critical computer systems from hackers, enemies and others, retired Marine Gen. Peter Pace said.

Pace was chairman of the Joint Chiefs, the nation's highest military post, under then-President George W. Bush from 2005 until 2007. He spoke at the Space Foundation's Cyber 1.1 conference in Colorado Springs.

Pace said the U.S. probably has the strongest offensive cyber capabilities of any nation, and it has employed cyber attacks in the past. After his remarks, he declined to say how many times that has happened, or to describe the circumstances.

Pace said the federal government should set security requirements for critical computer networks in the private sector, such as banking and finance.

Uniform requirements would prevent one corporation from gaining a competitive advantage by ignoring expensive upgrades. He also said it would encourage innovation by creating demand for security measures.

"We need to help prime that pump," said Pace, now president and CEO of SM&A, a management consulting firm.

Roger Cressey, an adviser on cyber security and counterterrorism under Presidents Bill Clinton and George W. Bush, told the conference that data manipulation – surreptitiously altering critical information on computer networks – is an underrated threat to cyber security

"The government makes decisions based on the assumption of accuracy of the data it's using," Cressey said in an interview later. "If a creative adversary doesn't steal, but just manipulates, that throws our decision-making process into disarray."

He said the banking and financial system, with trillions of dollars of international transactions at stake, could also suffer.

Cressey, now a senior vice president for defense contractor Booz Allen Hamilton, said he's not aware of any large-scale data manipulation attacks to date.

Gen. William Shelton, head of the Air Force Space Command, told the conference the U.S. military still faces challenges in cyberspace, especially in "situational awareness" – a military term for knowing not only where an enemy is, but where it has been, where it's going and what its intentions are.

Shelton said computer-enabled weapons such as remotely piloted aircraft represent the future of warfare.

Comments

[blogisti]

05:22 PM on 04/12/2011

General Pace speaks like the "bought and paid for" corporate shill that he has become. I am sure he believes what he says. It's always far easier to cash the check when you don't have to lie. However, objective is not the operative word in the Generals case.

[jsarets]

08:56 AM on 04/12/2011

In the reasonably near future, everybody is going to have a public key certificate digitally signed by their ISP according to federal government standards which verifies their identity, and most Internet connections will be authenticated end-to-end with IPsec. The imminent transition to IPv6 (the IPv4 address space will be exhausted by the end of this year) will be the technical driver for pushing everybody into compatibility with the new fully-authenticated Internet protocol.

Despite the Big Brother overtones, I think that most people will feel much more comfortable using the Internet when the individuals and businesses to which they connect are authenticated with government-compliant identification and when data transmissions are encrypted by default.

Of course, you don't have to connect with your official certificate, but then again, the service or peer on the other end doesn't have to accept your connection if they don't trust the signature on your certificate, and many applications will display strong warnings about untrusted certificates. There will undoubtedly also be massive volumes of traffic, for example bittorrent, which are authenticated with anonymous self-signed certificates which everybody customarily accepts.

Firewalls protecting government servers would summarily block any connections or packets which aren't authenticated with a trusted signature. Nobody gets in unless the government is confident that they could positively identify the sender and track them down if they see fit.

Most of the telcos already have the infrastructure in place, because all of the cellular broadband networks designed to evolve toward the 4G standard are effectively running IPsec. Your certificate is on your SIM card or hardwired into your device, and that is how the network authenticates and encrypts your transmissions over the air to the cell towers.

The freedom to maintain some degree of anonymity on the Internet is definitely worth preserving, but only to the extent that all parties to those connections are content with that uncertainty. Anonymity is not an inalienable law of the Internet, and in many contexts it is unquestionably dangerous and irresponsible. Networks are predicated on trust, and there are many things we do on the Internet that should not be done without positive identification.

[haystakt]

11:03 PM on 04/11/2011

This message will never change, why don't they just say that and save themselves some time?

[drauz]

10:57 PM on 04/11/2011

at this rate, we're going to end up like E Germany...
VERY secure... & doing nothing.