It is estimated that there will be 75 billion connected devices by 2025 in what is being called “Internet of Things”. With advancements in microprocessors and sensing devices, as well as software, almost anything that can connect will soon be possible.
The Pentagon’s Defense Against Cyber Attacks
Here’s what you need to remember: Seven years ago, DoD createdComply to Connect (C2C), as a way of protecting its growing network endpoints.
The Internet is experiencing a rapid increase in the number of devices. The Internet connects everything with electronics and sensors. This includes your phone, computer and video game console. It is expected that by 2025 there will be at most 75 billion connected devices in the “Internet of Things”. The advancements in microprocessors and sensing devices, as well as software, will allow almost anything to be connected.
It is not surprising that the IoT has expanded to government networks, especially those managed by the Department of Defense. Everything at DoD, from motors to battlefield sensors and door access readers, may have a network connection necessary for it to complete its task. DoD has a variety of consumer devices that run on its networks. These include printers, video monitors, cameras, and refrigerators. These devices communicate constantly with each other, as well with higher headquarters and the Pentagon. This is known as the “Internet of Battlefield Things” or IoBT by some observers. Experts agree that the military that creates the IoBT first will have a significant advantage over its competitors.
>”>
Although the evolution of the Internet into IoT/IoBT is generally a positive development, it also brings with it a significant cybersecurity challenge. Simply put, adversaries will have a greater chance of gaining penetration if there are more devices on a network. There have been many news stories about our adversaries trying to penetrate the U.S. critical infrastructure. This includes our power grid, government networks and elections systems. Hackers often seek out easy ways to access our networks via connected devices. Hackers were able to access implantable cardiac devices at St. Jude’s Hospital in 2016. Hacking has been a problem with baby monitors.
The adversaries of this Nation are aggressively trying penetration into the networks, systems and individual weapons of DoD. The network’s large number of devices generates more classified, critical information. The military discovered recently that it was possible to track the movements of troops by looking at the fitness trackers worn by many personnel. The risk of intrusion and compromise of classified information increases as more devices are added and removed from the IoBT.
Cyber-attacks are increasing at an alarming pace due to the exponential growth of IoT/IoBT devices. Attackers are finding it increasingly easy to gain access to an organization’s network through compromised IoT/IoBT devices. A device is “whitelisted” onto a network, which means that it is identified as trusted. However, the trusted device can be used to execute commands within your firewall. This can allow hackers to perform reconnaissance and possibly gain access to higher-value parts of a system. Unrecorded or unauthorized devices are also being added to networks, increasing the likelihood of penetration. Adversaries can hack vulnerable devices to not only get sensitive information but also to physically compromise your system, such as in a time when you are at war. Device vulnerability is a growing problem as the IoT/IOBT expands.
What is the DoD doing to address this growing vulnerability? What is the DoD doing about this growing vulnerability?
1) Identifying and validating devices that are connected to a network.
2) Assessing their compliance with DoD security policy;
3) Continuous monitoring of these devices is essential.
4) Automatically address device issues, thereby reducing cybersecurity administrators’ need to maintain cyber hygiene.
C2C combines existing cybersecurity technologies with more modern technologies to address the changing nature DoD’s network architecture. C2C’s core principle is to understand what devices and people connect to DoD networks, and what their security postures are. This information allows commanders to make informed decisions about the security of these connections and then automatically manage them according to security policies. C2C provides DoD with a means to continuously monitor the status of networks and devices, both computing and non-computing, with a high degree fidelity. C2C data will be fed into a central console, which will give these leaders complete situational awareness of the major areas of risk. This will help with policy making and resource allocation.
The DoD will not know how many industrial controllers, printers, or refrigerators are connected to its networks without C2C. It won’t be able to identify where its Windows patch management tools stopped working. It won’t be able to tell if Kaspersky- and Huawei-made equipment has been removed from its systems, as required by Congress. It won’t be able to channel network information to decision makers. These fundamenta are not available.
