On Cyber Warfare Command and Control Systems

On Cyber Warfare Command and Control Systems Norman R. Howes Institute for Defense Analyses 4850 Mark Center Drive Alexandria, VA 22311 ([email protected]) Michael Mezzino University of Houston - Clear Lake 2700 Bay Area Blvd. Houston, TX 77058 ([email protected]) John Sarkesain Missile Defense Agency 7100 Defense Pentagon Washington, DC 20301-7100 ([email protected]) Abstract As Defense agencies and services expand their reliance on computer networks, risk to information availability and integrity increases. It is no longer adequate to rely solely on the now traditional defense-in-depth strategy. We must recognize that we are engaged in a form of warfare, cyber warfare, and deploy our resources using the strategy and tactics of warfare. Most Defense organizations have not yet developed strategies or tactics for cyber warfare. This causes security devices to be used ineffectively and responses to be untimely. Cyber warfare then becomes a one-sided battle where the attacker makes all the strikes and the target of the attack responds so slowly that the attacker usually gets away without being identified. Employing cyber warfare strategy and tactics requires a cyber warfare command and control system. Responses to cyber attacks do not require offensive measures outside our own network boundaries to be effective, but they do require timely responses. Timely offensive action taken within our own network boundaries can lead to an identification of the attacker. During the past two years we have developed a prototype cyber warfare command and control system to demonstrate that defense-in-depth can be taken to a new level that is active and anticipatory rather than passive and reactive. 1. Introduction Names like cyber command and control system or network defense management system are sometimes used to describe systems that are used for the remote management of firewalls, intrusion detection systems, and other network components and subsystems. The term cyber warfare command and control system, as used in this paper, means something quite different. Certainly, the remote management of firewalls and intrusion detection systems, etc. should be part of a cyber warfare command and control system, but what we have in mind is something far more extensive. To help the reader understand exactly what we mean by a cyber warfare command and control system, we begin by defining the term. As with any definition of an unfamiliar term, we precede our definition with some motivation. Intuitively, what we mean by cyber warfare command and control is the analogue of the term command and control (C2) as applied to conventional (kinetic) warfare. In order to motivate our definition, we need to explain the analogy and also explain why the analogy is important. Thereafter, we will be able to define what we mean by a cyber warfare command and control system by telling the reader what our analogy is for each component of a kinetic warfare command and control system. It is assumed that the reader already understands what a kinetic warfare command and control system is, whether at the tactical, operational, or strategic level. Finally, in order that the reader may not think this is merely an intellectual pursuit, we conclude with a description of a prototype cyber warfare C2 system that the authors, and others, have been developing during the past two years. 2. The Analogy We start our discussion of the analogy of cyber warfare C2 systems to kinetic warfare C2 systems with some observations about (1) why the kinetic warfare C2 model cannot be applied directly to cyber warfare, and (2) what concepts of kinetic warfare C2 are missing from current cyber defense philosophies that inhibit the defenders from being as effective as the attackers. 2 Within defense communities, cyber defense is currently organized along the same lines as kinetic warfare C2 systems as shown in Figure 1. Suspected attacks are assessed locally and an attempt is made to contain them. Often, containment options are limited due to requirements for obtaining permission before taking action, from a higher-level organization. Thereafter, a reporting sequence begins that is similar to the reporting of events up the chain of command in a kinetic warfare C2 system. Figure 1. Kinetic C2 model of cyber defense Assessment by IAVA Publish Repair /Reconfiguration IA Experts Process Actions Service & GNOSC JTF/CND Reporting CERT Warning to GIG Users Regional CERT Install IAVA Fix Reporting Local Assessment/ Untimely IAVA Containment Installation Averted Suspected Successful Attack Attack Attack Attack Propagation Path As the report of the attack reaches higher levels, as shown in Figure 1, other organizations and commands are alerted to the possibility of a similar attack, and Information Assurance (IA) experts analyze the attack as part of the IAVA process. As higher-level commands receive information about an attack, they pass orders down the chain of command regarding how to response to the attack. Eventually, Information Assurance Vulnerability Assessments (IAVAs) are produced that detail fixes that may eliminate the vulnerability or reduce its seriousness. If the IAVA is not installed in a timely manner, which is often the case, the risk of attack remains at locations that have not complied with the IAVA. Figure 1 shows the attack propagating as we move to the right of the figure. Also, it shows the IAVA process (which involves time) moving to the right. The upward propagation of reports is shown staggered to the right to indicate the passage of time in the figure. The time between the original discovery of a suspected attack and the JTF/CNO CERT warnings can take hours to days. In addition to this delay, many defensive measures (like the segmentation of a network or the shutting down of certain services) often have to await an order from a higher level of command. Eventually, IAVA fixes are published that reduce the risk of this type of attack. This can take several more days. 3 This type of hierarchical organization that relies on situation reports going up the chain of command for decision making and orders coming back down the chain of command that implement these decisions, does not work well for cyber defense. Cyber battles usually take place in the seconds to minutes range whereas kinetic warfare battles occur in the hours to days range. Consequently, we cannot hope to use the kinetic warfare organizational model of command and control effectively for cyber warfare. On the other hand, we do not want to lose the kinetic warfare command structure when we integrate cyber warfare C2 into the overall kinetic warfare command and control. Kinetic warfare command and control is based on the concept of cells at each level of command. For instance there is an operations cell (OPS cell), an intelligence cell (INT cell), and a logistics cell (LOG cell), etc. These are physical cells in the sense that they are located in different places, and you cannot be in multiple cells at the same time because you cannot be in multiple places at the same time. While there is interaction among these physical cells, there is detailed information in them that is not in the other cells. What the other cells get is summarizations of this information usually referred to as a situational pictures, e.g. the intelligence picture or the operational picture. In what follows, we propose a cyber warfare organizational model based on virtual cells (also referred to as logical cells) as opposed to physical cells. Virtual cells exist in cyberspace rather than in the physical space of a command center. It is possible for a cyber warrior to be in multiple virtual cells simultaneously. The ability to be in multiple virtual cells at the same time is a powerful C2 abstraction. It avoids much of the need for hierarchical reporting of situational information. Cyber warfare commanders can be members of multiple lower level virtual cells, multiple peer cells (virtual cells at their own level of command at other locations) and, if permitted, they can be members of higher-level virtual cells. Physical command and control cells only permit a single organizational structure that we refer to as the chain of command. This structure is determined by the reports to relationship. The reports to relationship generates hierarchical relations. It is an example of a many-to-one relationship. In contrast, virtual cells are organized by the membership relationship that will be explained in the next section. The membership relationship is an example of a many-to-many relationship. Many-to-many relationships are more general than one-to-many relationships. They generate network relations. Hierarchical relations are sub-relations of network relations. As a result, we can have an organizational structure for cyber warfare in which the chain-of-command relation is embedded. This fact allows us to integrate the cyber warfare organizational structure with the kinetic warfare organizational structure in a natural way that allows us to maintain the conventional chain of command for command purposes while providing a more general cyber warfare organizational structure for conducting cyber warfare. How this is done will be explained in the next section. As important as organizational models are for command and control, C2 systems are used for more than just providing an organizational structure for communicating in a formal way within the organization. For instance, C2 systems are used for developing strategy, executing tactics, maintaining a common operational picture, developing courses of action, and maintaining intelligence information. Classical kinetic warfare has a tradition of studying the motives, tactics, and weapons of potential enemies in order to develop strategies and tactics in advance. Such strategies include a 4 mature understanding of operational art to include, organizing for warfare, the means of communicating within the organization, likely events during warfare, courses of action (COAs) to respond to them, how battlespace intelligence will be gained, how situational awareness will be presented, and so forth.

Load more