 |
 |
 |
 |
| |
|||||
|
|
|
Home > News & Events > MITRE Publications > The MITRE Digest > | |||||||||||||||||||
MARIAAN Helps the Air Force "Fight Through" Cyber Attacks November 2009
For the Air Force, "fighting through" an attack doesn't always involve jets or missiles. Often, "attacks" take the form of virtual strikes on all-important computer networks. Fighting through in such cases means ensuring that operations can continue in spite of threats that jeopardize critical missions. With the uptick in online communications such as live chat between ground-based commanders and aircraft, the Air Force faces an increased risk of cyber-warfare attacks and related data security breaches. These additional communications channels offer more opportunities for hackers to break into and siphon important information from vital computer systems. The issue was highlighted this year, when widespread cyber attacks adversely affected some daily missions of several government agencies, including the Treasury Department, the Secret Service, the Federal Trade Commission, and the Department of Transportation. Breaches such as these could imperil critical operations and even put lives at risk. To reduce that risk, MITRE researchers are developing security solutions that will enable the Air Force to fuse important mission information with details about security breaches as they occur. One prototype solution enhances Air Force information assurance capabilities by delivering critical security alerts to warfighters in the field. Armed with that information, they can more easily respond to data security threats in real time. The solution—a software and sensor toolset known as "Mission Aware Reporting of Information Assurance for Airborne Networks," or MARIAAN—can be customized to work on a variety of Air Force communications network enclaves, including on bandwidth-constrained, forward-deployed, ground-based networks known as "enclaves," and on airborne communications platforms. Such networks sometimes operate in geographically remote locations and are challenging to secure and monitor due to both physical and technological constraints. MARIAAN will help warfighters to continue operations through cyber attacks, explains Rosalie McQuaid, the MITRE principal information security engineer who leads the project. Strengthening Defenses for the Global Information Grid
"The extension of Internet protocol-based communications to the tactical edge—airborne and enclave networks—introduces new cyber-threat entry points into the Global Information Grid," she explains. (The Global Information Grid, or GIG, is the Department of Defense's globally interconnected set of capabilities for sharing information on demand among warfighters, policy-makers, and support personnel.) One challenge in protecting military networks is that existing information assurance techniques do not take into account specific details about ongoing, real-world missions. "Connecting the actual missions to likely cyber threats is critical for mission success and improved situational awareness for warfighters," McQuaid explains. That's where MARIAAN comes in. The prototype works by correlating "information assurance events"—data about potential security breaches—with mission details such as asset dependency, criticality and location. The information about these events is then distributed within and among selected users on Air Force enclave and airborne networks. MARIAAN assesses mission impact and suggests simple actions to help ensure that critical mission functions can continue. Ensuring Security Within a Broad Mission Context "Enclaves don't operate in a vacuum," McQuaid says. "While warfighters using a particular enclave have a specific mission, they also work in a broader mission context that involves other enclaves, resources, and capabilities," she says. "This means that sharing security information between enclaves is necessary to provide overall situational awareness and has a direct connection to mission assurance in terms of managing risks from cyber attacks." MARIAAN takes advantage of another capability developed with help from MITRE, called Common Event Expression (CEE). CEE helps to provide a bandwidth-efficient means of communication between enclave networks and central, ground-based Air Force monitoring facilities. It also provides a standard means of conveying security event data (providing a standard format for notification) within Air Force networks. CEE, now in development by MITRE along with software vendors, researchers, and end users, aims to standardize the representation and exchange of logs from electronic systems. Such consistency will allow for improved security monitoring of those systems. Putting the Prototype Through Its Paces To test the prototype, MITRE engineers are participating in collaborative experiments at Hanscom Air Force Base in Bedford, Mass., and at other Air Force test sites. Plans are also underway to apply MARIAAN to non-airborne domains such as small mobile networks and small forward-deployed networks. Earlier this year, the prototype was put through its paces in a "live-fly" experiment at the Joint Expeditionary Force Experiment (JEFX) 2009 event, sponsored by the Air Force and held several times each year as a proving ground for emerging command and control technologies. During the JEFX event in March, MARIAAN was deployed as part of a test of a toolset known as Sensor Event Analysis Visualization Response (SEAVR). SEAVR will allow Air Force personnel working in air operations centers to monitor the security status of all Internet protocol-based communications activities undertaken by commanders and aircraft in the field. (For more information on the JEFX test, see sidebar.) As the research continues, McQuaid and her team are focused on the big picture: the potential for the prototype to deliver capabilities to warfighters that could protect mission goals, she says. "We're encouraged by our progress," she says. "This could be part of the solution that allows mission commanders to access information about the consequences of cyber attacks and gives them options for responding when such attacks threaten mission success."
—by Maria S. Lee Related Information Articles and News
Technical Papers and Presentations
Websites |
||||||||||||||||||||
Page last updated: November 20, 2009 | Top of page |
Solutions That Make a Difference.® |
|
|
