CYBER

Thad Allen on cybersecurity's growing complexity

Hybird threats emerge as 'cyber touches everything'

The most byzantine problem facing government and the private sector today in the area of disaster preparedness and response is “the interface between cybersecurity and critical infrastructure,” Admiral Thad Allen, former commandant of the Coast Guard, said at a briefing Sept. 10 in Washington.

“The far more challenging issue right now is cybersecurity because the internet is everywhere and cyber touches everything,” said Allen, now an executive vice president at Booz Allen Hamilton. “Even if you don’t own a computer it touches you because it may be running the street lights and everything.”

Compounding the problem is the increasing complexity of the threat environment. “As we look to the future, we’re probably not going to be dealing with singular events anymore,” he said. “We’re going to be dealing with complex, hybrid events.”

The growing interaction between the natural environment and what Allen called “the human-built side of our environment,” which continues to expand, is “producing consequences that we didn’t see a couple of hundred years ago,” he said.

One type of hybrid event is where a natural disaster precipitates an extended man-made disaster, such as catastrophic damage to the critical infrastructure, he said.

But a more worrisome disaster scenario is man-made, one triggered by a cyber attack. “You can a have a man-made disaster precipitated by a cyber attack on a set of industrial control systems that produces an impact on the population, kinetic events and physical damage,” Allen said. “The level of complexity that we’re dealing with is that a combination of events can create negative synergy in ways we’ve never anticipated before.”

Adding to the problem of cybersecurity is the fact critical infrastructure, such as the electrical grid, resides mostly in the private sector, he said.

As a result, preparation for a cyber attack is hampered by the paucity of information-exchange mechanisms between the government and the private sector.

“How do you get warnings to the private sector when [the government has] intercepted them in a classified environment and can’t attribute the source for national security reasons?” Allen said. “If the private sector is being attacked, the real issue is how do you create the secret sauce that gets you to some metaphorical demilitarized zone [where information can be traded]? Right now, there aren’t enough legal safeguards for the private sector to feel comfortable in a complete- disclosure setting. They have issues related to liability and antitrust.”

At the same time, a variety of government agencies have different roles and responsibilities in responding to a cyber disaster, leading to governance issues. In a hypothetical example, the Federal Emergency Management Agency is trying to support local communities in recovery while the FBI is treating the disaster as a cyber crime, managing the area as a crime scene and preserving evidence, Allen said.

“In the absence of a single point of contact that is empowered politically to act on the behalf of the president, there is nothing that’s institutionalized to make that easy,” he said. “The more complicated these events get, the harder it is to deal with them.”

Ultimately, he said, it’s going to require legislation to sort out the governance hurdles and create lines of communication between government agencies and the private sector to exchange crucial data about cyber threats and events.

“That’s going to prompt a very complex discussion about what the inherent role of government is versus the private sector,” he said. “Where’s the dividing line and who should do what? In almost everything related to government’s involvement with either natural or manmade disasters really involves [the question of ] the inherent role of government.”

Some small-scale progress in creating a framework where government and the private sector can exchange information is being made by the National Cyber-Forensics and Training Alliance in Pittsburgh, a public-private partnership designed to identify, mitigate and neutralize cyber crime threats. The alliance began as a collaboration between the Software Engineering Institute at Carnegie Mellon University and local Federal Bureau of Investigation, Allen said.

“It’s an organization where you can co-locate industry representatives and federal government representatives,” Allen said. “They created an independent malware lab where they can analyze stuff and then go to the coffee pot and talk to each other.”

Since joining Booz Allen Hamilton in December 2011, Allen has been the leader of the company’s departments of Justice and Homeland Security business in the civil market. He has led the development of the notion of “resilience” in dealing with natural and man-made disasters—a holistic approach to understanding risk and risk mitigation across a unified coalition federal, state and local governments, businesses, community organizations and individuals.

“The argument for mitigation and looking at these things in advance is that we’re dealing with a level of complexity we haven’t seen before and we can envision all the combinations of events that could come about in a hybrid event,” he said.

Reader Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

What is your e-mail address?

My e-mail address is:

Do you have a password?

Forgot your password? Click here
close
SEARCH
contracts DB

Trending

  • Dive into our Contract Award database

    In an exclusive for WT Insider members, we are collecting all of the contract awards we cover into a database that you can sort by contractor, agency, value and other parameters. You can also download it into a spreadsheet. Read More

  • Is SBA MIA on contractor fraud? Nick Wakeman

    Editor Nick Wakeman explores the puzzle of why SBA has been so silent on the latest contractor fraud scandal when it has been so quick to act in other cases. Read More

Webcasts

  • How Do You Support the Project Lifecycle?

    How do best-in-class project-based companies create and actively mature successful organizations? They find the right mix of people, processes and tools that enable them to effectively manage the project lifecycle. REGISTER for this webinar to hear how properly managing the cycle of capture, bid, accounting, execution, IPM and analysis will allow you to better manage your programs to stay on scope, schedule and budget. Learn More!

  • Sequestration, LPTA and the Top 100

    Join Washington Technology’s Editor-in-Chief Nick Wakeman as he analyzes the annual Top 100 list and reveals critical insights into how market trends have impacted its composition. You'll learn what movements of individual companies means and how the market overall is being impacted by the current budget environment, how the Top 100 rankings reflect the major trends in the market today and how the biggest companies in the market are adapting to today’s competitive environment. Learn More!