|
Lieutenant General William J. Donahue, USAF Director,
Communications and Information United
States Air Force Mr. Chairman,
distinguished members of the committee, I want to thank you for your
continued interest in this nationally important issue.
This is my third opportunity to provide testimony on this important
subject. Three years ago, the
Air Force had only begun its journey in establishing a strong network
protection posture. The Air Force was also in a transformation stage 3 years
ago--becoming an aerospace force--and Information Superiority was a
critical piece to making that vision a reality.
At the time of my appearance before you in 1997, every Air Force
base had an intrusion detection system; firewalls were new but they were
the exception; we were prototyping base network control centers; we
crafted our defense in depth security concept, known as the Barrier Reef;
and our Air Force Computer Emergency Response Team
(AFCERT) was a reality.
In 1998 with funding support from Congress, we undertook an
aggressive program to install network management systems and base
information protection (NMS/BIP) tools at 109 bases.
We installed firewalls, scanning tools, and network management
tools at our main bases. Our
concept of Operationalizing and Professionalizing the Networks was in full
swing--we were treating networks like the weapons systems they had become.
By the time of my 1999 appearance, we had established the AFCERT as
the Air Force component to the Joint Task Force for Computer Network
Defense and the Air Force had published its Information Operations
Doctrine. Every Air Force
base had a network control center with an initial network protection tool
set and we had begun establishing Network Operations and Security Centers
at our Major Commands. We
were wrapping up Operation DESERT FOX; and we were shoring up our defenses
as intrusion attempts into our base networks continued to grow.
Today, every Air Force base is protected by intrusion detection
systems and we scan our networks for malicious activity and
vulnerabilities. We have
upgraded our information protection tool sets with new technology and we
operationally task our Network Control Centers and report their readiness
through the Status of Resources and Training System.
We think we are running world class networks but the threats to
them are real and dangerous.
In my testimony today, I will focus my remarks on our operational
successes, the considerable threats we face daily, and the way ahead for
the Air Force. Operational Successes
Last year, US involvement in the Kosovo conflict illustrated
clearly the Air Force's ability to leverage information superiority for
combat success. Additionally, Operation ALLIED FORCE has been called the
first "Cyber War." Let
me illustrate with a few examples: - Although our communications
networks were repeatedly subjected to probing, barrages of E-mail, and the
"virus of the week" program, our mission operations continued
unaffected. -
Communications bandwidth requirements were not a significant limiting
factor for accomplishing mission objectives--we supported 40 contingency
sites in 15 countries with twice the capacity of that used during
Operation DESERT SHIELD/DESERT STORM. - Reachback worked. Our information systems, consisting of both commercial
off-the-shelf and military communications equipment, enabled reliable,
timely reachback to the continental United States for intelligence,
logistics, and personnel support that otherwise would have had to deploy
forward. - Predator unmanned aerial vehicle
images were transmitted to Beale Air Force Base in California, analyzed
and sent back to theater in finished form in less than 10 minutes. It also contributed to an extremely effective logistics
system where 93 percent of replacement parts were shipped to forward bases
in less than four days. This
allowed forces directly engaged in combat to average a 92 percent
mission-capable rate -- a rate higher than peacetime averages.
Despite our overwhelming success, we can’t underestimate the
dangers in the information age. Just
because we had little trouble defending ourselves last time does not mean
we are safe from cyber attack. Recall
that Serbian air defense systems knocked out two of our airplanes, they
were real, they were dangerous but in the final analysis they were not a
big player in combat operations. The
cyber attacks we experienced were also real and dangerous. But in the
final analysis, our information assurance posture caused the cyber attacks
to be nothing more than a nuisance and had little impact on combat
operations.
Similarly, we achieved a stunning victory in the Information
Assurance test of our lifetime--Y2K.
Our success in defeating the potential Y2K problem was a direct
result of senior leadership involvement and the hard work of all Air Force
members. Because of our
preparations, we came out of Y2K a better Air Force for the new
millennium. We tightened up
and tested continuity of operations plans, we eliminated over 390
non-mission essential systems and migrated others to less costly, more
efficient, common-use systems, upgraded our base-level computer and
telephone systems--the bottom line is we linked information assurance to
mission assurance in working Y2K and do so in our daily operations.
Threats and What We've Done
to Mitigate Them
Threats to Air Force information systems and our capabilities to
detect, prevent and defeat these threats are significant targets on my
scope. We are not only
implementing good information assurance tools, but we're emphasizing good
security policy and good business rules that ensure we deliver accurate
information to the warfighter anytime, anyplace.
We're facing a considerable challenge on the personnel front to
recruit, train, and retain qualified network technicians able to build,
run, and sustain the information technologies that enable us to be so
effective. The challenge is
compounded by the fact that this is a national problem--the shortage of
information technology talent is significant and impacts every
organization that is an information enabled, high performing enterprise.
While there are no simple and quick solutions to the people
challenge we must continue to operate.
Our program involves operationalizing and professionalizing the
network--organizing, training, and equipping Air Force network
professionals to do their jobs. From
the professionals who operate and maintain them to the users who depend on
them every day to accomplish their mission, we are holding everyone
responsible for information assurance.
Let me give you some examples: - Over the past year, we developed a
standardized set of network Tactics, Techniques and Procedures designed to
incorporate rigor and discipline into operating, maintaining, and
reporting status of our networks. We
have established crew positions and identified the requisite training
requirements for those positions. Establishment
of "checklist"
procedures instills even greater confidence in our operators' ability to
provide timely, reliable information to our warfighters. - We have totally revamped initial
skills courses for our computer operators.
Today, we produce troops with good training on network operations
fundamentals who can dive into "on the job training" and rapidly
acquire a solid set of “journeyman” skills. - We’ve funded Information
Assurance Computer-Based Training and Internet -Based Training courses
tailored to both users and system administrators. Our first line of defense, our
network professionals and users, are well trained and poised to respond to
network threats.
These efforts focus inward on what we’re doing to enhance our
personnel strengths. We must
also maintain our focus on mitigating the external threats to our
networks. Though the recent
highly publicized Distributed Denial of Service attacks did not affect any
Air Force systems, we are
just as susceptible to this kind of crippling attack as the commercial
sector. Individual hackers
and hacker groups have proliferated over the last year and we must remain
vigilant against the potential of these attacks every day.
Good networks, good procedures, good training, and good protection
tools are the bedrock of our defense.
Viruses also remain a potential threat.
Although we were able to stave off the "Melissa" virus
and sustained little damage, there are variants and new viruses that are
cropping up all the time. Again,
these examples provide a stark reminder that we CANNOT ever let our guard
down.
We not only need to prepare for and protect ourselves from network
vandalism, but we must also treat our networks as the weapons systems
they’ve become. Whether
viewed offensively or defensively they are weapons systems.
I’d like to quote a recent news article that describes the target
environment:
“It is essential to have an
all-conquering offensive technology and to develop software and technology
for Net offensives so as to be able to launch attacks and countermeasures
on the Net, including information-paralyzing software,
information-blocking software, and information-deception software…
Modern high-tech warfare cannot win without the Net, nor can it be won
just on the Net. In the future there must be a coordinated land, sea, air,
space, electronic and Net warfare, and the state's determination will be
fully expressed in this mysterious theater space.” This quote,
reported in the 1 Nov 99 Washington Times, is from an article in China’s
Liberation Army Daily, the official daily newspaper of the People's
Liberation Army General Political Department.
Additionally, members of the PLA have laid out plans for Internet
insurgency in the People’s Daily. PLA
colonels wrote in Unrestricted Warfare, “A planned stock market crash, a computer
virus attack, making erratic the exchange rate of the enemy’s currency
and spreading rumors on the Internet about enemy leaders can all be
considered new concept weapons.” My
point--information warfare is not hyperbole--its real.
These articles indicate the Chinese are aware of the capabilities
of computer networks in warfare. Let
me point out what we are doing to mitigate threats to our information
systems: - we are locking down our networks - closing known vulnerabilities - standardizing our base information
protection and firewall configurations - installing automated anti-virus
software and alerting all units when a new virus appears - using intrusion detection systems - standardizing Internet scanning
tools We also developed and fielded a suite
of defensive tools for our deployed Network Control Centers and Network
Operations and Security Centers. Way Ahead--The Next Step
We've accomplished a lot over the past year, but we must continue
to raise the bar. The future
looks bright and we have a number of initiatives under way that I'd like
to highlight. - Information
Assurance Awareness. Three
years ago we began an initiative called Information Assurance Awareness
Month. During the month of
February, we emphasize awareness of Information Assurance issues.
Our point is that Information Assurance is everybody's business.
Our users must all realize their obligation to “fly the
network” securely, get the necessary training, and practice good network
security. - Training.
We established a Network Center of Excellence at Keesler AFB for
training our network professionals and just recently graduated our first
class of skilled professionals. Training
is critical and in the information age it involves a continuous life of
learning. - Equipment.
We are working to complete our Phase II upgrades to our bases by
improving base information protection tools--installing additional
firewalls, upgrading software, and providing added training.
We have begun fielding an improved Intrusion Detection system that
will fill in the gaps of our current system. - Public
Key Infrastructure (PKI). We
recently awarded an Air Force-wide PKI contract and have already begun the
first phase of issuing certificates to our members. This is just the beginning of increased security measures
across the board, using technology to enhance our security. -
C4ISP.
Information systems are more and more integrated into our command
and control and weapons systems. The
acquisition process must include planning for information assurance as a
fundamental step. Our
proposal for C4I support planning will ensure that information assurance
planning is embedded in the total system acquisition and sustainment
cycle. - Presidential
Decision Directive 63 - Critical Infrastructure Protection.
The Air Force is marching lockstep with the broad federal efforts
to protect our critical infrastructures.
We have functional community representatives for each critical
sector developing their Defense Infrastructure Sector Assurance Plans.
Additionally, the Air Force has taken on the task of protecting not
only the Global Positioning System (GPS) but also the whole national space
launch and range infrastructure vital to our nation.
I believe the Air Force is focused on the right issues and building
the programs that provide the best service and protection possible. Our
Air Force Posture Statement highlights the importance of Information
Superiority and Information Assurance; our programs demonstrate our
commitment. You can help us by supporting our Information Assurance and
base infrastructure programs. Our
Information Technology Exhibit (Exhibit 53) supports the Air Force effort
to leverage networked information systems that guarantee our Information
Superiority. Information
assurance is a high priority, and the Air Force is committing resources to
provide it, but we could still do more. Information infrastructure is number three on the Air Force
unfunded priority list. If
you have more top line resources, we’re ready to put the money to work.
The second thing you can do is strengthen the laws that relate to
computer intrusion, computer vandalism, and computer crime. The foundation of our Information Technology laws owes
its legacy to telecommunications law and specifically links back to the
Communications Act of 1934. It
was good and appropriate for its time.
However, the cyber world is moving at light speed and we need laws
that deal with this reality. The
ability to track down or search for hackers who vandalize web pages or
organized hacking groups who infiltrate information systems and extract
sensitive information CANNOT hinge upon outdated criminal or civil legal
processes. The law needs to catch up with the realities of cyber crime
and investigative needs by “out of box thinking” such as use of verbal
search requests and dedicated IT-trained approval magistrates.
It is our understanding that the Department of Justice is
considering legislation to address these issues, and any such effort
warrants your fullest attention. We
also need to send a clear and hard-hitting message--you violate the
computer network laws and we will hunt you down and hold you accountable.
In closing, let me say that this Nation has every reason to be
proud of its military. Throughout
the spectrum of conflict and in the competency of Information Superiority,
the US military has no peer. The
United States Air Force is organized to win, prepared for the future, and
committed to supporting our nation's security needs--anytime and anywhere. |