On Cyber Warfare Command and Control Systems

As Defense agencies and services expand their reliance on computer networks, risk to information availability and integrity increases. It is no longer adequate to rely solely on the now traditional defense-in-depth strategy. We must recognize that we are engaged in a form of warfare, cyber warfare, and deploy our resources using the strategy and tactics of warfare. Most Defense organizations have not yet developed strategies or tactics for cyber warfare. This causes security devices to be used ineffectively and responses to be untimely. Cyber warfare then becomes a one-sided battle where the attacker makes all the strikes and the target of the attack responds so slowly that the attacker usually gets away without being identified. Employing cyber warfare strategy and tactics requires a cyber warfare command and control system. Responses to cyber attacks do not require offensive measures outside our own network boundaries to be effective, but they do require timely responses. Timely offensive action taken within our own network boundaries can lead to an identification of the attacker. During the past two years we have developed a prototype cyber warfare command and control system to demonstrate that defense-in-depth can be taken to a new level that is active and anticipatory rather than passive and reactive.