5 Key Questions CISOs Must Ask Themselves About Their Cybersecurity Strategy

Sur le même sujet

• 

  30 septembre 2020 | International, C4ISR, Sécurité

  The DoD needs data-centric security, and here’s why

  Drew Schnabel The U.S. Department of Defense is set to adopt an initial zero-trust architecture by the end of the calendar year, transitioning from a network-centric to a data-centric modern security model. Zero trust means an organization does not inherently trust any user. Trust must be continually assessed and granted in a granular fashion. This allows defense agencies to create policies that provide secure access for users connecting from any device, in any location. “This paradigm shift from a network-centric to a data-centric security model will affect every arena of our cyber domain, focusing first on how to protect our data and critical resources and then secondarily on our networks,” Vice Adm. Nancy Norton, director of the Defense Information Systems Agency and commander of the Joint Force Headquarters-Department of Defense Information Network, said at a virtual conference in July. How does the Pentagon's AI center plan to give the military a battlefield advantage? The Pentagon's artificial intelligence hub is working on tools to help in joint, all-domain operations as department leaders seek to use data to gain an advantage on the battlefield. Andrew Eversden To understand how the DoD will benefit from this new zero-trust security model, it's important to understand the department's current Joint Information Environment, or JIE, architecture; the initial intent of this model; and why the JIE can't fully protect modern networks, mobile users and advanced threats. Evolving DoD information security The JIE framework was developed to address inefficiencies of siloed architectures. The goal of developing a single security architecture, or SSA, with JIE was to collapse network security boundaries, reduce the department's external attack surface and standardize management operations. This framework helped ensure that defense agencies and mission partners could share information securely while reducing required maintenance and continued infrastructure expenditures. Previously, there were more than 190 agency security stacks located at the base/post/camp/station around the globe. Now, with the JIE architecture, there are just 22 security stacks centrally managed by the Defense Information Systems Agency to provide consistent security for users, regardless of location. “This paradigm shift from a network-centric to a data-centric security model will affect every arena of our cyber domain, focusing first on how to protect our data and critical resources and then secondarily on our networks,” Vice Adm. Nancy Norton, director of the Defense Information Systems Agency and commander of the Joint Force Headquarters-Department of Defense Information Network, said at a virtual conference in July. To understand how the DoD will benefit from this new zero-trust security model, it's important to understand the department's current Joint Information Environment, or JIE, architecture; the initial intent of this model; and why the JIE can't fully protect modern networks, mobile users and advanced threats. Evolving DoD information security The JIE framework was developed to address inefficiencies of siloed architectures. The goal of developing a single security architecture, or SSA, with JIE was to collapse network security boundaries, reduce the department's external attack surface and standardize management operations. This framework helped ensure that defense agencies and mission partners could share information securely while reducing required maintenance and continued infrastructure expenditures. Previously, there were more than 190 agency security stacks located at the base/post/camp/station around the globe. Now, with the JIE architecture, there are just 22 security stacks centrally managed by the Defense Information Systems Agency to provide consistent security for users, regardless of location. Initially, the JIE was an innovative concept that took the DoD from a highly fragmented architecture, in which each agency managed its own cybersecurity strategy, to an architecture in which there is a unified SSA. However, one of the early challenges identified for the JIE was managing cloud cybersecurity as part of the SSA. The components in the JIE — the Joint Regional Security Stacks family's internet access points and cloud access points — have traditionally focused on securing the network, rather than the data or user. As more DoD employees and contractors work remotely and data volumes increase, hardware cannot scale to support them. This has created ongoing concerns with performance, reliability, latency and cost. A cloud-first approach In response, the DoD leverages authorized solutions from the Federal Risk and Authorization Management Program, and it references the Secure Cloud Computing Architecture guidance for a standard approach for boundary and application-level security for impact Level 4 and 5 data hosted in commercial cloud environments. The purpose of the SCCA is to provide a barrier of protection between the DoD Information Services Network and the commercial cloud services that the DoD uses while optimizing the cost-performance trade in cybersecurity. Defense agencies are now exploring enterprise-IT-as-a-service options to move to cloud, and reduce the need for constant updates and management of hardware. Through enterprise-IT-as-a-service models, defense agencies will be able to scale easily, reduce management costs and achieve a more competitive edge over their adversaries. Before the pandemic hit, defense agencies were already moving to support a more mobile workforce, where employees can access data from anywhere on any device. However, a cyber-centric military requires security to be more deeply ingrained into employee culture rather than physical protection of the perimeter. The next evolution to secure DISA and DoD networks is to embrace a secure access edge model with zero-trust capabilities. The SASE model moves essential security functions — such as web gateway firewalls, zero-trust capabilities, data loss prevention and secure network connectivity — all to the cloud. Then, federal employees have direct access to the cloud, while security is pushed as close to the user/data/device as possible. SP 800-27, zero-trust guidance from the National Institute of Standards and Technology, provides a road map to migrate and deploy zero trust across the enterprise environment. This guidance outlines the necessary tenants of zero trust, including securing all communication regardless of network location, and granting access on a per-session basis. This creates a least-privilege-access model to ensure the right person, device and service have access to the data they need while protecting high-value assets. As the DoD transforms the JIE architecture to an as-a-service model with zero-trust capabilities, defense agencies will experience cost savings, greater scalability, better performance for the end user and war fighter, improved visibility, and control across DoD networks — and ultimately a stronger and more holistic cybersecurity capability moving forward. https://www.c4isrnet.com/opinion/2020/09/29/the-dod-needs-data-centric-security-and-heres-why/

• 

  24 mars 2020 | International, Aérospatial, Naval, Terrestre, C4ISR, Sécurité

  Post-Brexit Defense Review Challenged By Costs And Coronavirus

  Tony Osborne Post-Brexit Britain is taking its first steps toward understanding its place in the world and the military capabilities it may need to ensure it can hold onto that status. A review, described by Prime Minister Boris Johnson as the most extensive of its kind since the end of the Cold War, is examining the UK's foreign, defense, security and development policies. And it is proceeding despite the challenges and costs surrounding the COVID-19 pandemic. Although it will examine the work of several government departments—notably the Foreign Office, the Defense Ministry and the Department for International Development—considerable focus is likely to be on defense. It has the largest budget of those under the microscope and an oft-criticized procurement process that some in government are eager to overhaul. The process will run in parallel with the government's comprehensive spending review. That assessment decides UK government spending for the next three years and will deliver its findings potentially as early as this summer. Some critics argue that is simply too soon for a thorough analysis of Britain's future defense needs. “If you are to have a strategy that is worth the name, you must address ends, ways and means together. . . . If you do not do the whole package, including the money, together, then you do not have a strategic review,” Jock Stirrup, a former chief of the Royal Air Force (RAF) and UK Defense Staff, told parliamentary defense committee hearings on March 17. The 2020 review represents a break from the traditional defense-led Strategic Defense and Security Review (SDSR) usually held every five years. Some analysts contend the 2020 edition could shape defense capabilities for decades to come. Jack Watling, Land Warfare research fellow at the London-based Royal United Services Institute (RUSI) says the review would have to make “hard choices” but that these would “determine the trajectory of the UK's defense capabilities for a generation.” He notes that for a post-Brexit Britain looking to expand its trading and security partners, future conflicts may be difficult to avoid. “Security and trade partnerships are closely intertwined. . . . If ‘Global Britain' means diversifying our economic partnerships, it will be necessary to build meaningful security ties as well,” Watling says. The UK must look at its role in the Euro-Atlantic alliance and in the Great Power competition, in addition to other global issues and homeland security, Defense Minister Ben Wallace told Parliament. The review will also “place prosperity and manufacturing at its heart,” he added. The assessment comes at a challenging time for Britain's defense and its equipment-procurement plans. The National Audit Office recently warned that for a third consecutive year there will be shortfalls in the budget. The ministry's plans call for the spending of £183.6 billion ($214 billion) over the next 10 years, equivalent to 42% of the ministry budget during that period. Auditors say the Defense Ministry has a shortfall of at least £2.9 billion over that period, but this could be as high as £13 billion. Although the UK is expanding its intelligence, surveillance and reconnaissance (ISR) capabilities with the upcoming arrival of the General Atomics Protector unmanned aircraft system and deliveries of the Boeing P-8 Poseidon maritime patroller—two of which have already arrived—capability gaps in the ISR mission are imminent. The planned retirement of the RAF's long-suffering Boeing E-3D Sentry fleet has been pushed to December 2022. But the Boeing E-7 Wedgetail, the 737-based platform planned as its replacement, is not due to enter service until the end of 2023, potentially leaving a yearlong capability gap. The RAF also plans to retire its Raytheon Sentinel radar-reconnaissance platform in March 2021. It got several reprieves after its Afghanistan duties ended, but its departure would leave the UK without a standoff ground-moving-target-indicator and synthetic aperture radar platform. Several commitments made in the 2015 SDSR, such as the UK's decision to commit all 138 Lockheed Martin F-35 Joint Strike Fighters across the lifetime of the program, have also not been budgeted, auditors note. Current plans forecast only the costs of the first 48 aircraft. The government says that “decisions on future numbers and aircraft variants will be taken at the relevant time,” but it is unclear whether this will be considered in the review. The British government is aiming to maintain the target of 2% of GDP set by NATO for all allies. Defense ministers have said they will fight to meet that share, and more if needed, although the UK has a history of not fully funding post-review defense portfolios. “It is not a ​review designed to cut costs,” says Jeremy Quin, minister for defense procurement. “It is a review designed to ensure we know what we are doing in the world and that [this is achieved] through really effective equipment.” Along with defining capabilities required for land, sea and air, the review is also likely to conclude that the UK should make additional investment in both the cyber and space domains. https://aviationweek.com/defense-space/post-brexit-defense-review-challenged-costs-coronavirus

• 

  8 avril 2024 | International, Sécurité

  The Drop in Ransomware Attacks in 2024 and What it Means

  Q1 2024 had 22% less ransomware attacks than Q4 2023. Why is that and is it a trend that will continue?