Cloud Hosting

U.S. Marines with the Special Purpose Marine Air Ground Task Force 19.2 Crisis Response Command Element prepare field condition crisis response center networks in Kuwait. (U.S. Marine Corps photo by Sgt. Robert Gavaldon)

As data proliferates and attack surfaces expand, the Defense Department continues to have a fundamental need to discover, understand, track, and manage its data and intellectual property that is exposed on the internet.

The House Armed Services Committee noted the need to manage this process in an integrated end-to-end fashion in its markup of the National Defense Authorization Act for Fiscal Year 2021.

The Department of Defense (DoD) lacks a similar comprehensive understanding of the internet-connected assets and attack surface across the DoD enterprise; the committee notes in this regard that the DoD only recently discovered that it has twice as many managed connections to the internet as it thought it didconnections established and maintained by components that were not protected like the other sanctioned Internet Access Points managed by the Defense Information Systems Agency.

Despite strides made by Joint Force Headquarters-Departments of Defense Information Network (JFHQ-DODIN) in improving its enterprise-wide visibility of DoD networks, DoD networks are controlled by individual components, with JFHQ-DODIN deriving most of its situational awareness from component reporting. The committee believes that it is critical that JFHQ-DODIN achieve real-time visibility over all DoD networks.

This complexity makes DoD networks particularly ripe for the application of whats known as Internet Operations management (IOM). IOM capabilities enable organizations to:

When we kind of look at Internet Operations Management from the perspective of military networks, its easy to see the applicability of IOM, not just for the military but also for federal agencies, large government networks, and commercial customers, said Joseph Lin, vice president of product management for Cortex, Palo Alto Networks. All of them have these fundamental problems.

An IOM platform aggregates all of this data into a single, secure data lake, using machine learning algorithms and data analytics to discover anomalies and derive insights. Decisionmakers can then use this information to make, enforce, and verify IT and security policies and orders in an actionable, scalable, and automated way across the entire enterprise.

What is a data lake? Lin explains.

At a very basic level, a data lake is an environment holding an enormous amount of data, as well as highly heterogeneous data, that is brought together, integrated, and made mutually interpretable so that the data is able to relate to one another. At the end of the day, youre not just collecting data for datas sake, but are collecting it so that you can run analytics on top of that data. You can use machine learning in order to derive insights from the multitude of data that youre able to collect from your entire system.

IOM Is Well Suited to Military Networks

Military networks are, generally speaking, very large. They can be highly federated in nature, which makes managing all of their internet-facing assets that much more difficult.

Because of the large, distributed, highly federated nature, and sometimes expeditionary nature of military networks, management/command and control of their internet-facing assets is difficult and complex.

They are inefficient and insecure in other ways, as wellspecifically in six areas.

IOM Addresses Those Issues

It is those inefficiencies that lead to insecurities that are driving the need for enterprise-wide security enforcement among militaries around the world.

Cybersecurity and IT operations are most effective when there is centralized visibility and operational control over the entire network. The DoD owns some of the worlds largest and most complex networks, with millions of IP addresses and endpoints in multi-tiered enclaves. Yet, they continue to lack enterprise-wide network visibility and rely on late-20th century technologies for tasks as straightforward as developing, disseminating, and enforcing new IT policies.

DoD organizations and service members deserve best-in-breed technologies and processes such as those found with IOM to centralize and manage their security and network- operations. The good news is that these technologies already exist commercially and are widely deployed across legacy networks, especially in the private sector and a handful of government agencies.

A major part of managing legacy network systems is that they are properly secured behind firewalls and not exposed on the public internet because of vulnerabilities associated with their software that are simply unpatched, or are no longer supported by their original manufacturer, said Lin. Because these vulnerabilities can be easily exploitable by adversaries, its that much more important to ensure that theyre properly secured.

What IOM enables owners of legacy systems to do is, first and foremost, ensure that theyre not exposed on the public internet, that theyre not discoverable by adversaries, and that theyre properly configured and secured.

Conclusion

DoD and wider U.S. government cyber defense, detection, response, and recovery capabilities are inadequate. This problem is most fundamentally due to the lack of centralized visibility and operational control over federal information technology.

In addition, there is a huge gap between the mandate to secure, defend, and monitor government-wide networks and the highly disparate technologies and processes in place. Solving this problem is not only possible, it is happening now with existing technologies and processes in the private sector and within some individual federal agencies.

IOM products like Palo Alto Networks Cortex suite of systems, including Cortex Xpanse and XSOAR, enable JFHQ-DODIN to meet the requirements detailed by the FY21 NDAA through the development of IOM procedures that provide JFHQ-DODIN real-time visibility over all DOD networks.

Situational awareness is a basic requirement in all forms of conflict, and with Cortex IOM Defense Department organization can continuously discover, manage, and monitor all globally deployed DoD internet assets through daily attack surface scanning and regular mapping.

Comprehensive awareness and visibility across all of its networks will let DoD network managers confidently answer questions as straightforward as, What are all of my IPs?, How many endpoints or servers do I have? and What is the software running on them? Without IOM, they would be hard pressed to do so.

See the rest here:
Internet Operations Management Is Well Suited To Military Networks - Breaking Defense