DIU seeks tech to help fight GPS spoofing

The Defense Innovation Unit is searching for commercial tech that could help the military locate disruptions in satellite-based systems like the Global Positioning System (GPS).

Global navigation satellite system (GNSS) manipulation or “spoofing” has become increasingly low-cost with high-stakes impacts on both defense and commercial interests. DIU wants a solution that uses analytics to search through commercially available data to find spoofed and disrupted signals, it wrote in a recent solicitation.

“The entire world is dependent on GNSS or GNSS-based systems, yet the GPS architecture and its users are vulnerable to denial and manipulation by adversarial actors,” DIU wrote.

Spoofing is an interference to the signal or data transmission in GPS. Devices used to disrupt that signal can be as cheap as $250 and as small as a cellphone.

Threats to satellite-based communications systems like GPS include operations that have enabled narcotics trafficking, unapproved operation of autonomous vehicles, illegal fishing and piracy, according to DIU. Signal jamming by nation-states also poses a threat to military communications in battle. This is of great importance as the Department of Defense has been creating new concepts of operations that more heavily rely on communications and data links.

DIU, the DOD’s Silicon Valley outpost, was established to find commercial solutions to thorny defense challenges such as GPS spoofing. In this specific case, it seeks solutions that can ingest a mix of data, including terrestrial, space-based and others, that could help ferret out false signals. DIU wrote it has no preference on what data the system uses, just that it be able to use multiple types.

Cybersecurity in a shrinking world

On the very first day that former FBI agent Eric O’Neill was assigned to go undercover to investigate the most notorious cyber spy in U.S. history, the target of that investigation looked at O’Neill and said something remarkable.

“So, O’Neill, have you ever heard of something called Hanssen’s law?” the man asked. O’Neill responded that he did not recall studying such a law at the FBI Academy in Quantico.

The man sitting across the table looked back at O’Neill and began to explain Hanssen’s law. “The spy,” he said, “is always in the worst possible place.”

O’Neill could neither believe what he was hearing nor where the conversation was taking place. He was sitting across from Robert Philip Hanssen, one of the most damaging FBI cyber insiders in history, and they were talking as colleagues in the information assurance division within FBI headquarters. O’Neill maintained his poker face and asked Hanssen what he meant.

“That spy is that person with the access to information and the wherewithal to use that information to sell it to those who will do the most damage with it. And that Eric,” Hanssen said to O’Neill, “is what we in the FBI as counterintelligence agents, are tasked to do. Find that spy. Hunt them wherever they are.”

Speaking at the 2021 Public Sector Innovation Summit sponsored by VMware, O’Neill — now National Security Strategist at VMware and author of Gray Day: My Undercover Mission to Expose America’s First Cyber Spy — acknowledged that Hanssen’s words were very prescient. 

(Watch O’Neill’s full presentation here.) 

The FBI’s most sobering discovery had to do with Hanssen’s use of the Bureau’s own IT infrastructure. To their dismay, the FBI found that Hanssen had used his authorized access to the Bureau’s Automated Case Support system and his knowledge of computers to monitor the FBI investigation that was trying to find him.

At the heart of the ACS system, which first came online in 1995, is the Electronic Case File (ECF). The ECF contains all of the Bureau’s internal communications relating to ongoing investigations and programs. Subsequent investigation of Hanssen’s use of the ECF system showed that he routinely searched the system using search terms directly related to the investigation that was aimed at uncovering his identity.

Hanssen compromised thousands of pages of classified documents detailing the most sensitive intelligence collection programs in the U.S. intelligence community. Among the most damaging disclosures concerned the details of a tunnel that had been dug beneath the Soviet embassy in Washington and outfitted with high-tech listening devices that were monitored by the FBI and the National Security Agency. 

It was the exchange with Hanssen and the lessons learned from the investigation that would begin the evolution of O’Neill’s own thinking about cybersecurity and insider threats, which he now shares with government agencies and companies on behalf of VMware.

“As I thought about whether the spy is always in the worst possible place, I realized that the spy is always in the worst possible place for anyone who is breached,” O’Neill said. 

Cyberspies are changing the world, according to O’Neill. “There are no hackers, there are only spies,” he said. “The true cyberattackers, cyberspies, and cybercriminals are well-resourced, are very knowledgeable and they’re using sophisticated computer equipment…to get at the data that is the currency of our lives. And as the world gets smaller, cyberattacks are simply growing.”

Pandemic 3.0 – Reopening Our World

O’Neill refers to the massive shift in how people work — from pre-pandemic to pandemic-era remote work and now the post-pandemic reopening — as Pandemic 3.0. Cyberspace has become more hostile, said O’Neill. Destructive attacks have increased 118%, he said.

“Cyberattacks have quadrupled during the pandemic and foreign spies have been targeting everything, in particular COVID-19 research in the healthcare sector,” O’Neill said. 

These trends pose a significant challenge for the Pandemic 3.0 world, in which we must find a way for employees to work from any place, on any device, and through any cloud. “Zero trust and endpoint [detection] is critical for remote work,” O’Neill said. “Zero trust is the only way to ensure that everyone accessing your data is authorized.”

The pandemic also forced a massive expansion in cloud investments but when you move to a public cloud “you’re moving to a tough neighborhood,” according to O’Neill. “You may be able to secure your own resources, but you have no control over who’s sharing that environment with you. So you have to prioritize security cloud workloads at every point in the security lifecycle,” he said. “That means security that extends across workloads, containers, and Kubernetes.”

Learn more about “Zero Trust” strategies and how VMware is helping to accelerate public sector innovation.

CACI hires former leader of Army tactical network modernization team

Peter Gallagher, the retired two-star general who previously led the Network Cross-Functional Team at Army Futures Command, is joining defense contractor CACI.

Gallagher will take on the role of senior vice president for national security technology solutions. He retired from the Army in May after a career in military tech, including stints as commander of Network Enterprise Technology Command and the CIO/J6 of Central Command. CACI announced his appointment Monday.

“Pete’s depth of defense mission expertise, including a recent focus on convergence and modernization, and years of special operations experience, will accelerate our success in bringing software enabled technology to enhance, connect, and secure critical systems for our customers,” Todd Probert, CACI president of national security and innovative solutions, said in a statement.

The cross-functional team Gallagher led was charged with improving the Army’s future tactical network. The goal was to modernize how the Army communicates in the field to enable new concepts like multi-domain operations, where data can be shared across different operations. The team consists of a range of experts, including researchers and operators.

The team was involved in some of the Army’s experiments for its Project Convergence, a series of tests on new network configurations and software-enabled weapons. The project is Army’s contribution to the new framework of Joint All Domain Command and Control (JADC2), a military internet-of-things.

CACI is one of the largest military contractors, and its notable recent contract wins include deals on automated testing for Air Force networks and Army talent management systems.

Agencies face hurdles meeting OMB’s deadline to go paperless

Some agencies are having a more challenging time than others investing in the electronic records management (ERM) systems they need to go paperless by the Office of Management and Budget’s deadline of December 31, 2022.

The U.S. Department of Agriculture, for instance, has 29 agencies to contend with and found that, even though one went paperless, the customers it deals with continue to submit paper records.

OMB issued a memo in July 2019 directing the National Archives and Records Administration to stop accepting paper records by the end of 2022, but agencies’ business processes could hinder the transition, even after scanning initial records, if the systems they invest in aren’t long-term solutions.

“We’re using this as an opportunity to not just get paper into a digital form,” said Catherine Cole, with the Directives, Forms and Records Management Branch within USDA, during an ACT-IAC event Thursday. “This is an opportunity to also look at our business processes that will allow us to sustain this moving forward.”

NARA aims to help agencies on that front through a number of different efforts, namely the Federal Electronic Records Modernization Initiative (FERMI), which makes it easier for agencies to acquire electronic records management services and solutions.

Under FERMI, NARA identified high-level business needs for managing electronic records before setting baseline Universal ERM Requirements for agencies and setting specifications for vendors.

NARA is also working with the General Services Administration to improve the ERM system procurement process and help agencies find vendors that meet their needs. Together they created an ERM solutions category, a consolidated GSA schedule where vendors self-certify they meet the Universal ERM Requirements. NARA and GSA also established a special item number (SIN) for physical records under the Multiple Award Schedule.

NARA recently released draft regulations for digitizing permanent records that agencies will eventually transfer over, but their progress toward meeting the December 2022 deadline for going paperless remains unclear.

Agencies perform a Records Management Self-Assessment (RMSA) annually, which contains data on where they see themselves with respect to meeting OMB’s deadline.

But things get murkier when it comes to how that data is being monitored and used to ensure agencies transition to ERM systems on time.

“I’m not aware of any kind of centralized tracking that we’re doing as far as where agencies are,” said Markus Most, electronic records policy analyst with NARA. “That responsibility does sit with the agencies.”

Infrastructure bill amendment includes $2.5B for 5G wireless rollout at military bases

Republican lawmakers have put forward an amendment to the bipartisan infrastructure bill that includes $2.5 billion in funding for the installation of 5G wireless technology at Department of Defense facilities.

Senate Appropriations committee ranking member Richard Shelby, R-Ala., proposed the amendment, which is focused broadly on boosting defense funding. It is supported also by fellow Republican Sens. Jim Inhofe, Okla., Roger Wicker, Miss., Mike Rounds, S.D., and Thom Tillis, N.C.

The amendment was not adopted prior to a vote by Senate lawmakers Sunday evening to end debate over the infrastructure bill. The bill text theoretically could still be altered, however, this is unlikely because it would require cooperation from all 100 senators.

Rolling out secure 5G technology across military installations is a core element of the Department of Defense’s plan to create a joined-up battlefield, in which soldiers and military vehicles have access to real-time data.

The revision would also allocate $3.8 billion for construction at the Department of Energy’s national labs. This includes projects at the National Nuclear Security Administration, the Los Alamos National Laboratory, the Savannah River nuclear facility, and additional projects.

If enacted, it would also add $4 billion across military services and the Pentagon for infrastructure maintenance projects, and set aside another $2 billion for high priority military construction projects.

Lawmakers are expected to take a final vote on the passage of the $1 trillion infrastructure bill this weekend, after the Senate moved through a series of amendments to the legislation on Wednesday.

Negotiators are working on a final iteration of the bill, and Senate majority leader Chuck Schumer, D-N.Y., has called for the chamber to move quickly, as it passes through the final stages of the legislative process.

Speaking at an industry association event last year, the Air Force’s chief of staff, Gen. Charles Q. Brown said the services would “most definitely” need to rework its networks in order to facilitate the rollout of 5G.

Following a Senate cloture vote on Sunday evening, the infrastructure bill is expected to clear the upper chamber either late Monday or early Tuesday.

Unisys ‘doubling down’ on public sector cloud business, CEO says

Unisys is “doubling down” on public sector cloud business and is focused on growing its digital workplace services division, according to CEO Peter Altabef.

Speaking on the company’s second-quarter earnings call, Altabef said the company would compete hard to outgrow market peers and to take market share.

As part of a restructure earlier this year, the company sold its U.S. federal services arm to SAIC and launched two new business segments: Digital Workplace Services and Infrastructure and Cloud services. Its digital workplace arm is focused on consultancy and the sale of communications-as-a-service systems.

Unisys expects the $17 billion public sector cloud services market to grow by about 15% to 18% each year, according to an investor presentation published in January.

During the second quarter of 2021, Unisys swung to an operating profit of $49.3 million compared with a $8.5 million loss in the second quarter of 2020. Within its cloud and infrastructure business segment, revenue grew 9.9% year-over-year to $124.4 million

CISA issues cyber training guide for federal employees

The Cybersecurity and Infrastructure Security Agency on Thursday published a new training guide to help federal employees improve their cybersecurity skills and create a cyber-focused career plan.

The new document includes clear career pathways for staff within agencies such as CISA to follow. It is intended also to codify new points of entry into government cybersecurity, including through internships.

Commenting on the launch of the guidance at the Black Hat conference in Las Vegas, CISA Director Jen Easterly said it would help with identifying “no-cost opportunities that fit [employees’] professional development schedule.”

The publication of the guide comes amid a push to fast-track new cyber talent into government and follows calls for greater flexibility over hiring rules to allow new staff to be brought into agencies more quicky.

In particular, the White House is focused on bringing in new talent through more direct authority hiring and by establishing partnerships with colleges and universities.

CISA is also providing grants for nonprofits focused on identifying and developing unrealized cybersecurity talent within underserved communities, in a bid to increase workforce diversity.

It follows an executive order signed last month by the Biden administration that mandates agencies to adopt new measures to increase equity and diversity within the workforce.

“I believe we need to do everything we can to ensure our cyber workforce reflects the diversity of America because diversity of gender, ethnicity, education, sexual orientation, neurodiversity – all of that translates into diversity of thought and enables better problem-solving,” said Easterly.

DOD CIO to implement new electromagnetic spectrum strategy

The job of implementing a strategy to modernize how the Department of Defense uses electromagnetic spectrum (EMS) will now fall to the office of the Chief Information Officer, the DOD announced Thursday.

Implementation and creation of the current strategy has been overseen by the vice chairman of the Joint Chiefs of Staff who leads an EMSs cross-functional team, but that authority will transfer to the CIO in the fall. The change was triggered by a new implementation plan for the EMS Superiority Strategy signed by the secretary of defense in July but announced Thursday.

“The enterprise approach in the [implementation plan] reaches beyond the traditional ‘silos’ and drives the Department to act in a more integrated fashion, mirroring the shared nature of the EMS,” Acting DOD CIO John Sherman said in a statement.

The change was ordered as the CIO already oversees EMS activities, which include a range of operations from radio communications and anti jamming. The implementation plan calls on the CIO’s office to oversee creating and managing an EMS workforce and ensuring the bureaucratic processes properly resource EMS tasks.

The strategy was born out of a Government Accountability Office report that found insufficient leadership on how the DOD handles EMS. For the past two decades the military had little need to focus on EMS as it has been fighting insurgencies with limited tech capabilities, but as it prepares for a possible war with high-tech nations like Russia or China, the services have increased their spectrum activities. The Air Force recently stood up its first EMS wing, and other services have established similar groups to focus on activities.

The military plans to rely even more heavily on spectrum communications systems to facilitate new strategies like Joint All Domain Command and Control (JADC2). That is the new framework where the military wants to be able to transmit data between all platforms in battle, creating a military internet-of-things. Transmitting data will require ample access to the spectrum, including the use of new tech like 5G that use lower frequencies to communicate more data.

“The success of JADC2 relies on our ability to have control of the electromagnetic spectrum,” Brig. Gen. AnnMarie Anthony, deputy director for operations for Joint Electromagnetic Spectrum Operations and Mobilization at Strategic Command, told reporters.

NIST revises flagship cyber resiliency guidance

The National Institute of Standards and Technology released the first-ever revision to its flagship cyber resiliency guidance with updated controls and a single threat taxonomy Thursday.

NIST updated Special Publication (SP) 800-160 Vol. 2 to align cyber resilience controls with SP 800-53 Rev. 5 security and privacy controls for agencies’ and industry’s IT systems, as well as map it to MITRE’s ATT&CK threat framework.

A product of the NIST Systems Security Engineering initiative, the guidance reflects the latest cyber resiliency implementation approaches for engineers to address known hacker tactics laid out in the ATT&CK framework.

“The goal of the NIST Systems Security Engineering initiative is to address security, safety and resiliency issues from the perspective of stakeholder requirements and protection needs, using established engineering processes to ensure that those requirements and needs are addressed across the entire system life cycle to develop more trustworthy systems,” reads the revised guidance.

Cyber resiliency engineers design and maintain systems that anticipate, withstand, recover from and adapt to stresses, attacks and compromises — thereby reducing risk to agencies.

The guidance provides a cyber resiliency engineering framework complete with a tailorable analysis agencies can use to determine whether a system of theirs, no matter how old, is at risk of being compromised by advanced persistent threats.

Technical appendices supplement that framework with:

• background and contextual information on cyber resiliency;
• detailed descriptions of goals, objectives, techniques, implementation approaches, and design principles;
• mutually beneficial controls in corresponding the SP 800-53; and
• language used to describe the effects of current threat mitigations.

CISA chief: Risk management agencies key to addressing sector-specific cyberthreats

Cybersecurity and Infrastructure Security Agency Director Jen Easterly has said her agency will work closely with federal risk management agencies to enhance cybersecurity practices within their own sectors such as energy and transportation.

Speaking Thursday at the Black Hat conference in Las Vegas, Easterly underscored the importance of using federal departments’ sector knowledge to help improve cybersecurity standards across every area of society in the U.S. To do so, CISA will step up its close work with departments responsible for managing risks in key areas of U.S. infrastructure, including the Department of Energy, the Environmental Protection Agency, and the Department of Transportation, she said.

“Critical infrastructure owners and operations, as well as state and local governments will play a similar role – bringing expertise to the discussion and a unique ability to drive cyber defense activities in their jurisdictions,” said Easterly.

CISA today announced its new Joint Cyber Defense Collaborative strategy for enhanced information sharing between industry, government and academia. It is hoped the scheme will allow federal agencies, lawmakers and the private sector to react faster and more effectively to ransomware attacks and other digital threats.

The agency has obtained buy-in for the new center from technology giants including CrowdStrike, Palo Alto, FireEye, Amazon Web Services, Google, Microsoft, AT&T, Verizon and Lumen, she said. Through JCDC, the member organizations will take part in two cyber sprints: one to combat ransomware, and the second to develop a planning framework for coordinating incidents that affect cloud providers.

In her keynote speech at the conference, Easterly also called on industry to support the federal government’s focus on rapidly growing the U.S.’s cybersecurity workforce, including through new relationships with universities and colleges and at the K-12 level.

The CISA director also issued a wider call for companies and technology experts to join CISA’s community of information sharing and to become evangelists for cybersecurity within their own organizations.