Defense Department Doorway Through Industry

Signal, Aug 2008 by Ackerman, Robert K

There is no question that foreign intelligence services are trying to penetrate Defense Department networks through the private sector-either human or technical, states Dr. Joel F. Brenner, national counterintelligence executive in the Office of the Director of National Intelligence, adding that it is a significant issue. Some other government officials have gone so far as to describe those penetration attempts as extensive, and they are looking at limiting the number of computers with access to the Internet.

Brenner observes that government and private industry working in the same line of work must follow the same security protocols and practices, and they must use compatible safe technology. While the United States "does a pretty good job of this," the biggest threat comes up because of human behavior. People frustrated by strict security regimens may turn to their own hardware or software, which in turn can open the door to security leaks. When a person hooks up an unauthorized system to a network, that network must detect it and react immediately by informing managers and isolating that leak.

The problem is that practices in the private sector are uneven, he continues. While some companies work hard on sophisticated protective measures, others do not seem to understand the threat Still others understand the threat but seem to be in denial about it.

One drawback is that current laws open companies up to liability about sharing information among other companies, Brenner notes. "We don't find significant sharing of information about threat vectors, let alone vulnerabilities, among companies in the private sector or between the private sector and the government," he charges. Brenner is an advocate of creating legal safe harbors where companies could share threat information as opposed to vulnerability information. This would permit firms to share information on best practices and threat vectors without airing vulnerabilities.

For example, it can be hard to spot viruses that have not been identified in advance. If many people are exchanging that type of information, then companies can benefit from information on viral signatures that help gear network defenses. However, this is not happening in any systematic way, Brenner warns. "We need much more creativity in both the government and the private sectors to deal with this," he states. -RKA