Creating Cyber ‘Surgeons’: Thinking Like the Adversary

‘Cyber Warriors’ are unique, highly-trained individuals, who’s skill set is honed on how cyber adversaries operate. Like surgeons, it takes an immense amount of work and training to master the cyber profession. The following interview with Bob Stasio, Former Chief of Operations at the NSA Network Operations Center, explores the development of American ‘Cyber Soldiers’, personal experiences in ‘Ethical Hacking’, and a discussion on the need for drastic action and increased cyber security in light of ever-present and destructive threats (including April’s ‘Spamhaus’ attack), read on… Tell us about the development of American ‘Cyber Soldiers’ – what are the goals, the aims, and the reality? It is an interesting term thrown out there, usually Cyber Warrior or Cyber Soldier. A Cyber Warrior is not your standard IT admin person within the military or private sector. These are highly trained individuals who hone their skill set in how cyber adversaries operate. The mission of these new cyber fighters would be drastically different from "normal" information assurance operations conducted by the military. Cyber operations are far more advanced, incorporating various technical and analytical skill sets. Such individuals cannot be trained in the same way the military approaches most skill development. Under normal circumstances, a military service sends a new recruit through a 90-120 day "trade school" and they transition into their first assignment ready to do their job. Advanced cyber operations are not like that. While at my last assignment in the U.S. Army, I had the challenge of recruiting, training, and placing these high end cyber soldiers. It quickly became apparent to me that the initial training for these soldiers was measured in years, not weeks or months. In my four years assigned to this mission, we grew our elite force by only a few percent. High-end cyber security analysts are grown through intense professional development, much like a physician. Both fields require a significant amount of formalized education - but when your education is finished you must still work under a master, (e.g. "attending doctor") for on-the-job training. True cyber skill development means actually doing the job and acquiring experience. Cyber and medicine both have general certifications, but there are also specialties within the field (think Windows, UNIX, Routers vs. ENT, general surgery, cardiac). In both professions, people are encouraged to share their knowledge or craft, continue their education, publish papers, and attend conferences. Because of the specialized skill set and importance of the mission, our cyber soldiers must be trained with a similar level of intensity. In the commercial sphere, cyber professionals who do vulnerability assessments and penetration testing attain billing rates similar to other high-value professions. Because of the immense amount of work it takes to master the cyber profession, it is tremendously difficult to raise a new force. It would be akin to trying to increase the number of brain surgeons from about 35 to 2,000 in two years. The only way to accomplish either feat is to cut corners. In no other field does the military deploy specially trained professionals in such mass. In an infantry brigade of 4,000 soldiers there is only one field surgeon and one lawyer. Just having one specially trained individual can efficiently provide expertise for the entire unit. What USCYBERCOMMAND is trying to do with this personnel surge is essentially quintupling the number of surgeons in the military within 2 years. Remember it takes four years of medical school and 6 years of residency to get a surgeon who can operate unsupervised. Creating cyber operators that can stand toe-to-toe with state actors in cyber space requires a similar amount of training. Tell us about your work as a ‘Ethical Hacker’. What does this mean, how is the intelligence applied for cyber advantage? An Ethical Hacker or someone with that skill set has studied the offensive side of cyber. They understand the operations, programmatics, and skills needed to get onto communication networks without a user's permission. These people understand exactly how the threat operates along a spectrum of capability. We understand that compliance is not enough to defend networks, and can recognize anomies in data that are indicative of an intrusion. How easy it for hackers to bypass ‘secured networks’ in order to extract critical and confidential information? In your opinion, do enough organizations have well equipped cyber security measures in place? It’s really not a matter of how easy, only a matter of time. Any security measure is only a deterrent. Think about protecting your house: you may have an alarm system, lock a strong door, and have a guard dog. But if someone really wanted to get in your house they would. I think of cyber in the same way - there are plenty of smart people out there who will eventually find a way in. The way to combat this is not easy; it’s having situational awareness of what is happening in real-time. Most organizations (that are not DOD) truly don't invest in this. Most want an easy compliance solution that the threat will eventually bypass. With Cyber so heavily on the agenda of the federal government, we are seeing daily news alerts of cyber attacks (including the ‘Spamhaus’ Dutch attack this week) – what do cases like this highlight about the ever present and evolving nature of cyber attacks, and the need for drastic action and increased cyber security? It’s actually the cases we don't hear about that concern me (the unknown, unknowns). For every headliner event like this that impacts the availability of networks, I am sure there are multiple events impacting the confidentiality of information. Those threats can lie low and be undetected for years! Constantly stealing information will likely never be discovered. I believe everyone knows some action needs to happen, but it is occurring in a spastic way. People and organizations want the easy solution: hook this magic box up to my network and it will solve everything. Things are just more complicated than that and we cyber folks need to convince leadership of that fact. It may take a fundamentally different way to solve the problem than the methods used in the past. Software vs. human intelligence – what is your take on the value and role of each for cyber security? The point of this concept is that cyber is a data problem. The best way to solve complicated data problems are by using really smart analysts using the best tool. Each one alone has its disadvantages - but the software can help tip an analyst to a potential issue in order to draw an analytical conclusion. Check out this link: http://blog.ted.com/2012/06/26/human-machine-synergy-shyam-sankar-at-tedglobal-2012/ [eventPDF]

Creating Cyber ‘Surgeons’: Thinking Like the Adversary

To continue reading this story get free access

Cyber Events

Next Generation Missiles and Hypersonics Summit

Other Upcoming Events

Port Security & Trade

Future Fires & Munitions Summit

Homeland Security Week

Future Ground Maneuver Summit

Wildfire Technology Summit

Follow Us

Latest Webinars

Responsible and Transparent Approaches to AI in Biometric Algorithm

Securing the Defence Industrial Base: Mitigating Risk and Delivering Resiliency in Physical and Digital Supply Chains

Treatment Option for Two Subsets of Challenging to Treat Major Depressive Disorder in Adults

Recommended

Facial Recognition: Art or Science?

OBIM's View On Biometrics

Trump and Tricare: How will the new administration affect Military Healthcare?

Trump and Tricare: How will the new administration affect Military Healthcare?

How Will the New Administration Affect Military Healthcare?

CERDEC On Energy Storage Solutions

Unmanned Solutions for Ground Combat Systems: with Johns Hopkins University

The Future of Biometric Technology With U.S. Citizenship & Immigration Services...

Military Healthcare: Presentation Case Study

The Future of Biometric Technology: With U.S. Citizenship & Immigration Services...

Breakthroughs in Energy-Storage Technology

Tapping Into The FY17 Budget

FIND CONTENT BY TYPE

IDGA COMMUNITY

ADVERTISE WITH US

JOIN THE IDGA COMMUNITY

Creating Cyber ‘Surgeons’: Thinking Like the Adversary

To continue reading this story get free access

Cyber Events

Other Upcoming Events

Follow Us

Subscribe to our Free Newsletter

Latest Webinars

Recommended

FIND CONTENT BY TYPE

IDGA COMMUNITY

ADVERTISE WITH US

JOIN THE IDGA COMMUNITY