DoD could defend critical private sector infrastructure from cyber attack

The Defense Department is contemplating creation of a government-sponsored cybersecurity regime for operators of critical private sector infrastructure, a top Pentagon official said May 26.

"This type of secure.com approach could build on the collaboration between DoD and the defense industry. It could offer an important gateway to ensure our nation's critical infrastructure is protected from cyber attacks," said Defense Deputy Secretary William Lynn, in a speech before an industry conference in Omaha, Neb.

Critical private sector infrastructure "will certainly be targeted in a military conflict," Lynn said. Although the Homeland Security Department has primary responsibility for protecting .gov and .com domains, the Defense Department has direct responsibility for securing defense industry networks, Lynn said. The cybersecurity regime would be voluntary, he also said.

The best cyber defense is offense, Lynn said during his speech. "In cyber, offense is dominant...In this way cyber is much like maneuver warfare, in which speed and counterattack matter most."

The National Security Agency is key to developing agile, active defense, Lynn said. The Pentagon officially stood up on May 21 a new four-star command to oversee Defense cybersecurity efforts. It's first commander, Army Gen. Keith Alexander, is also head of the NSA. As a matter of doctrine, the DoD recognizes cyberspace a domain of warfare just as land, sea, air and space, Lynn said during a ceremony to mark Cyber Command's opening, and again in his May 26 speech.

The department must also speed up its acquisition of information technology, Lynn said. On average, it takes the military 81 months from when an IT program is first funded to when it becomes operational, he said.

"This means that systems are being delivered four to five generations behind the state of the art," Lynn added. A recently established task force reporting to Lynn is studying how to refashion IT acquisition. Among the principles a new acquisition process must take into account is that different types of applications require different levels of software and integration, Lynn said.

After all, IT needs in the DoD "range from modernizing nuclear command and control systems to updating word processing software on our office computers," Lynn said.

For more:
- the text of Lynn's prepared remarks

Related Articles:
Lynn: Cyberspace same as land, sea, air and space
U.S. electrical grid probed but not yet attacked, says paper
Congressional cybersecurity bill roundup UPDATED