Cyber theft illustrates Pentagon security challenge

By David Alexander

July 14, 2011 9:21 PM EDT

A foreign intelligence service stole 24,000 files from a U.S. defense contractor earlier this year, a dramatic illustration of the threat confronting the Pentagon as it works to bolster military computer security, a top defense official said on Thursday.

Deputy Defense Secretary William Lynn revealed the theft as he unveiled a new Pentagon cybersecurity strategy that designates cyberspace as an "operational domain" like sea, air and land where U.S. forces will practice, train and prepare to defend against attacks.

Lynn said the theft occurred in March and was believed to have been carried out by a foreign intelligence service and targeted files at a defense contractor developing weapons systems and defense equipment. He declined to specify the country behind the attack, what company was hit or what the files contained.

"It was 24,000 files, which is a lot," Lynn said. "But I don't think it's the largest we've seen."

The theft was a dramatic illustration of the rising difficulties the Pentagon faces in protecting military and defense-related networks critical to U.S. security.

Must Read

Sponsorship Link

Follow us

Defense Department employees operate more than 15,000 computer networks and 7 million computers at hundreds of installations around the world. The department's networks are probed millions of times a day and penetrations have compromised huge amounts of data.

Lynn said a recent estimate pegged economic losses from theft of intellectual property and information from government and commercial computers at over $1 trillion.

NEW CYBERSTRATEGY

In addition to calling for the Pentagon to treat cyberspace as an "operational domain," Lynn said the new strategy includes four initiatives aimed at bolstering network security by layering defenses and improving cooperation with other network operators.

Lynn said as part of its active defenses, the Pentagon would introduce new operating concepts and capabilities on its networks, such as sensors, software and signatures to detect and stop malicious code before it affects U.S. operations.

"Our strategy's overriding emphasis is on denying the benefit of an attack," he said in a speech at the National Defense University. "If an attack will not have its intended effect, those who wish us harm will have less reason to target us through cyberspace in the first place."

The strategy also calls for greater U.S. military cooperation on cybersecurity with other government agencies, defense contractors and U.S. military allies abroad in order to take advantage of the open, interwoven nature of the Internet.

Former Homeland Security Secretary Michael Chertoff, who now heads the Chertoff Group risk management firm, praised the strategy as a "good first step" but said the challenge would be filling in the details.

"It's not put your pencil down, work is done," he said. "It really just sets the table for a lot of hard work thinking through the details of what the plans are going to be, what the capabilities have to be and how we're going to build the various layers of defense."

1 | 2 Next page | View all