Major General Edward Bolton Director, Cyber and Space Operations Air Force Headquarters. Cybersecurity: Emerging Threats

Transcription

1 Major General Edward Bolton Director, Cyber and Space Operations Air Force Headquarters Cybersecurity: Emerging Threats CyberFutures Conference National Harbor, Maryland 1 April 2011 Maj. Gen. Bolton: Thank you. Sir, thank you very much. My mentor, General Basla, thank you very much. I d like to thank General Lord not only for using our slides but also giving my presentation. [Laughter]. Actually, let s put it in context. I think it s good that we re sharing slides and sharing ideas, working together on the Air Staff. Think of it like the Godfather and Godfather II. The Godfather came out and kind of told the story, and then Godfather II talked a little bit about how you got there and then what happened next. So it s like Godfather I, Godfather II. I m not saying General Basla is Godfather III because that wasn t a particularly good product. I m not saying that, sir. I m not saying that. [Laughter]. Sandy, 11 seconds ago said, What are you going to talk about? I said, I m going to talk about cyber. But if I were to give you a theme -- Well, let s start with a quote. Yogi Berra said that, It is very difficult to make predictions, particularly about the future. [Laughter]. My slant on that is that as long as I talk about a future that s far enough away, you can t prove me wrong. [Laughter]. So let me kind of give you the fundamental theme, and it s about -- for you math wizards, don t answer this question. If I were to give you a choice, and hopefully you all know the answer to this one, a choice between a million dollars today or a magic penny that doubled every day for 30 days, who would take the million dollars? Right, because of exponential growth, because of compounding. I put this on paper yesterday just to make sure that I knew that this was right. After about ten days you only have a few dollars, but after about 23 or 24 days you have well over a million dollars, you have close to ten million dollars in 30 days. If you want to know one thing about cyber future, think about that principle -- compounding interest, exponential growth. Let s go to the first slide, please. I just came from supporting the Chief s Future Capabilities Game. That game does a comparison and contrast. It takes a scenario about 10 to 20 years out, takes a base force, the force that we think we re going to get to on current projections, and fights -- that s a Blue Force one, it fight a Red opponent. It can be anyone. And it does an alternative force. And some smart

2 Cybersecurity: Emerging Threats 2 folks did some work to analyze what the future would look like across the board in these areas, and this is a summary of that. Globalization. Anyone read Tom Friedman in this crowd? All you bright folks have read Tom Friedman, The Lexus and the Olive Tree, The World is Flat. Let s start off with globalization. We re expecting significant change in the direction of globalization. Fundamentally free movement reduction of areas, the spread of ideas. When we say competition for allegiance and competition for identification. What do we mean by that? If I were to start the phrase, I pledge allegiance to the everyone would know what would come next, right? Flag of the United States of America. But allegiances are changing. If you lived somewhere else you might have no allegiance to a nation itself, but maybe to Hamas or al-qaida or Google. So you re seeing great competition. Rapid, but unequal economic growth. Essentially it s all about nets in the other quadrant. It s about India and China in terms of rapid growth. Looking now to resources. That competition between India and China is going to be consuming at an ever-increasing rate. When I was in high school the United States was 6 percent of the population and we consumed 35 percent of the resources. If India and China consume 50 percent and we consume 35 percent, what does that leave for the rest of the world? Right? So tremendous competition for that. Demographically, there are several common denominators. Again, I ve never been accused of being a futurist, but I do like to look into the future because that s where I plan to spend the rest of my life. [Laughter]. But if you really look at it, there is tremendous change in the area of demographics. A common denominator are the problems and challenges you re seeing in the Middle East. Obviously social media is a piece of it, but how would you characterize the people who are fighting for change in the Middle East? They re young. They re young. So you re going to have Middle Eastern, Indian, Chinese, African countries that are getting younger and growing faster and faster. European countries, Japan, growing slower and slower. We re kind of in the middle. Then information and much of the rest of the presentation is about that. Let me just ask, who in here does banking on the web? Raise your hand if you do. Could I have your Social Security numbers? [Laughter]. Okay, who did banking on the web 15 years ago? Ten? Five? That s exponential growth.

3 Cybersecurity: Emerging Threats 3 So in conclusion -- [Laughter]. Then design, manufacture and services, all moving overseas. We re talking about the future, but again, the secret to the future, the near future, I believe is in the present. Future doesn t repeat itself, right? History does not repeat itself, but it does have children with a strong family resemblance. So I would argue that if you take a strong analysis of things you re seeing today, that would give you great insight on what you re going to see in the future. So let s look at these couple of examples here. Everyone knows what Israel did to Syria back in 06, 07. Syria had the biggest, they thought the best, Russian-made, Soviet-made air defense system. Israel turned them out, flew in, and then bombed a North Korean built nascent nuclear facility. The next year Russia did a DDOS, denial of service attack to Estonia. If you look at the pictures on the left column and the pictures on the right column, that s what they did to their government web site. They took the picture of their leader and replaced them with pictures of Hitler. Not just that, the web sites were shut down. Did similar things to Estonia. So what are the implications as you look to the future? These are cyber attacks that you already have seen today. In the future you re going to see a merging of cyber and kinetic and intel. Whereas in the past you might have thought well gee, a colonel might come in and tell the young captain, I love that cyber stuff, give me some of that cyber stuff. You cyber guys come in and do this or that. You re going to see a merging of the three media. Where from an intel perspective, if you have to ask for cyber at the beginning of phase one, it s too late. You re going to have to have your intel troops, your intel capabilities in place in phase zero. Part of the planning, part of understanding the web, part of understanding the enemy. Then you can say go off and do great things. You re going to see, and you re already seeing, a tradeoff in options between kinetic and non-kinetic attack. You re going to see, again, the Israelis could have taken out the Syrian IADS kinetically, but it was smarter to take them out from a cyber offensive attack. This is probably putting too fine a point on it to call these emerging cyber vulnerabilities, but this is where I m headed with the presentation.

4 Cybersecurity: Emerging Threats 4 If you look at DISCUS, the satellite in the upper panel, the one on this side; and you look at WGS; they both do essentially the same thing. Unprotected satellite com. One WGS satellite is somewhere between five and eight times more capable than one DISCUS, depending upon whether you believe the Air Force s numbers or the contractor s numbers. So one WGS is about as capable as the entire DISCUS fleet. I have a question. It s a technical question. Is a communication satellite a cyber node? Okay, this side is going absolutely. This side is going, that s a trick question. [Laughter]. So I ll talk to this side. [Laughter]. I think it is. I think it is. So we re doing a transition, of course, to remotely piloted vehicles. Anyone read Wired for War by Dr. Singer? I highly recommend that. It kind of made my stomach churn a little bit. The good news is I won t live long enough to be replaced by a machine, but these young folks, I m not so sure. In the upper right you actually have an airplane, helicopter-like, that actually is palm-sized. It has a SIGINT and an IMINT payload in it. This is an actual product that was in the first page of last week s Air Force Times. And in SCADA, you already saw a chart on SCADA by General Lord, but again, it s just machines talking to machines, collecting data, telling them what to do. So as we transition to more capable satellites, as we transition to a more pervasive use of remotely piloted systems, as we transition toward a use of systems that actually connect to other systems, I would ask you, would we be more vulnerable from a cyber perspective or less? Don t all answer at once. [Laughter]. I would say more vulnerable. So the implications, again, we are building -- As we increase our dependence on net-enabled systems, we are increasing our vulnerability to cyber attack. So our emphasis on security - - The cleanup batter gets to talk about security. I get the easy part, to talk about how hard it id. Then we increase our vulnerability to cyber attack. This is an emerging threat slide that kind of shows you how pervasive the use of the internet is. There may be a better way to say it. But the second bullet is what I want to foot-stomp. Two points. The first point, if you look into the near future, the near future is going to show some resemblance to the past. So if you pick which things you think are going to change

5 Cybersecurity: Emerging Threats 5 exponentially, they will drive the changes in technology but the things that we re doing right now, if we extend those things, will be helpful as we try to defend ourselves against increased cyber attack. Let s just build that out. Everyone knows about the cofounder of Intel, Dr. Moore, in 1965, and said that you re going to double computing capability. He said every 18 months. It s between 18 months and two years. I think if you go all the way back to your room-sized computer, back to -- let s do a cell phone survey. Who has a cell phone of some sort? Raise your hand. Great. Who had a cell phone 15 years ago? Wow. You must be pretty strong because they were pretty big back then. Fifteen, ten, five? So exponential change, right? Who s had the same cell phone for five years? Raise your hand. Not many. What s the point? Technology is changing so quickly that something that was very expensive when I was in high school or college, thousands of dollars to buy a computer that you d use for years and years, is something that everyone in here except for one smart person changes their cell phones every year or so. And frankly, they re just about to be throw-away devices, the cell phones. That s another key point, because it really isn t about the host. It s really about the data. Cell phones are only important to the extent you can actually use them to communicate. Right? Which is why I don t have an iphone. I like to talk to people when I -- This is another way of showing what I showed you earlier. The orbits around earth show the increasing dependence on cyber as a medium. Then again, you re going to see the use of the internet in various forms of social networking technology will significantly increase. Decision-makers, analysts, military systems, increasingly dependent on cyber. A high percent of the network on the internet. Is there anyone here who does all their banking on the internet? Then if that went down you would go to the checkbook, right? That s what you d do if you could find it. [Laughter]. Ten years from now would you even have those checkbooks? So if you lost that capability, what kind of situation would you be in? Pervasive use of mobile communication media. If I were to say, and this is consistent with General Lord, across the rapidly decreasing size in the packages, in transistor packages, the increasing use of internet. I would say the biggest thing that I

6 Cybersecurity: Emerging Threats 6 expect to see the exponential change in is the transition to mobile use. So if you were to take your iphone or your Droid and decompose it and compare it to the first computer that you purchased when you went to grad school, in my case my phone is significantly more capable. Yesterday when I was driving and listening to wired in the car, they said the name of a futurist, and while I was at a stoplight I pulled out my Droid and downloaded him and found out all about him. Just while I was at the stoplight, not while I was driving. [Laughter]. So the things that you used to be in a mainframe environment to do, then in your office, then at home, you can now do on the Metro. Our increasing reliance on that mobility, though, is an increasing vulnerability. The other place I think you ll see exponential change is that a third of the users, a little more, live in Asia. But again, significantly more than a third of the people live in Asia. If you go back to the slide that General Lord showed with the photographic memories we have in here where it showed the developed world and the less developed world. The slope of the curve on the less developed world is actually very very sharp. So you re going to see a dramatic increase. Why do we care, and what does it have to do with threats? Well, if, for example, you thought you might be at war with China, for example, and if you think of -- It s interesting. We were talking today and someone said America is 20-something percent in math or that. Yeah, that s if you take all folks from all segments of society. I would put the top five percent of American students against any student on planet Earth. I would put your Harvard, MIT, Academy grads against anyone. But we have a diverse society. We do have folks who don t graduate from high school. Let s take our top five percent or two percent students. Okay, how many students would that be? Any math majors in here? Let s say there s 80 million people in school, so the top two percent of 80 million, right, 160. If you take the top two percent of China s students, how many would that be? 80 million. Right? Now, I suspect a lot of you folks know the way the Soviets used to develop athletes, that s the way China is developing cyber specialists. They take the best 50 or 60 kids in a school who are good at math and give them computers. Those kids have a run-off. The number one kid goes to a special school. Those kids have a run-off. So maybe you have half a million Chinese

7 Cybersecurity: Emerging Threats 7 scholars trying to break into General Basla s account. I don t think that s an overstatement to say you can expect that within this decade. One more thing about exponential change. I ve been thinking about it a lot because I ve been reading about it. I would say don t underestimate how much change you can get in a decade. Military technology changes exponentially. What does that mean? If you re a Roman Legionnaire and you do 20 years and have your up or out board, that s how the Romans did it, right? And retire at 20. How much do you think technology changed from the first day that you picked up a sword to the last day? Not much at all. And how big was the world? Napoleon -- of course Napoleon was a genius. Napoleon could sit in a tower and with a spyglass look and analyze every aspect of a battle because it was contained within a small area. Take these two contrasts forward. General Molner, how much did technology change from the beginning of your career to the end? Amazing, right? Sir, you ve been in since when? How much did it change in your career? And his career s a little shorter than yours, sir. [Laughter]. The change pace is increasing. Now look at the scale and scope. Napoleon could see an entire battle. If you watch Spartacus or the 300, you could see everything at once, right? How broad is the battle today? Where would you have to be to see all parts of it with your spyglass? You d have to be in space, right? The moon, maybe. You d see half of it. So increasingly rapid change. I already used one Godfather joke so I ll let this one go. Next slide. He already made fun of the cloud so I can t talk about it much. But to say that any change that puts us in a direction of data that we are less able to control increases our vulnerability and increases the target space for our adversaries. Whether that adversary would be an organized adversary like perhaps a China. And one of the unique and interesting things about cyber space is that lack of attribution, low barriers to entry, asymmetrical targets. It was interesting, I was downstairs talking to some of the instructors working with the students with the Cyber Patriot competition and I said how would you characterize them? One instructor said he works at a contractor that I won t name, and teaches this to adults. He s teaching his 8 th gradesr the same

8 Cybersecurity: Emerging Threats 8 material at twice the rate. Not just because they re so much smarter. They are smarter. It s because so much of what we ve learned is irrelevant because things have changed. The bottom line is increasing vulnerability. If you have a spare minute at a stoplight on your way home take out your Droid or your iphone and there was a study that the New York Police Department did with the FBI. It looked at 19 home-grown terrorists. The underwear bomber, the Fort Hood bomber, the person who tried to do the bomb in the New York Times. Common denominators? Again, we re looking at trend analysis, right? Looking at indicators that allow us to look into the future. Born here, raised here, American citizens, radicalized and trained by data that they got on the web. On the web. So as this population becomes increasingly diverse you could see, you re already seeing an environment in which you have -- again, how many people have we lost in the United States, in the United States proper, due to terrorism since 9/11? So the people who are responsible for preventing that threat have done a pretty darn good job, I would say. That job s going to get harder when you re looking at radicals not just from overseas, but radicals from across town potentially. I have already talked about all this. I just want to point out one thing that I hadn t talked about previously. I saw earlier that Dick Clark was supposed to speak, and he pulled out for some reason. I ve got good news. I read his book last night. Here s what he says -- [Laughter]. No, there s a piece in it early in the book where he takes a Dell computer and actually he s quoting Thomas Friedman. He goes through each component and talks about where it actually came from, how many countries. So when you buy that Dell computer that was designed in San Antonio with help from India and assembled in Taiwan with its components from Malaysia, every place that it was touched was an opportunity for someone to introduce something in there that you don t like. That s the shortest course you ll ever get on supply chain concerns, but I think that s kind of the bottom line of it. Here are domains. You have space, air, land and sea. Where s cyber? Everywhere? I agree. It s everywhere. It s those green lines. So if you put software on an F-22, and I know

9 Cybersecurity: Emerging Threats 9 you worked fighter programs, that makes it net-enabled, does heads-up display. I think my last boss, Hoot Gibson, said he was in the latest fighter and they ve got this heads-up display that when you look down at the airplane it s as if the airplane isn t there. That s cool. So you re building a generation of aircraft and a generation of fighter pilots that can t fight without the capabilities that cyber and space provide. It would actually be more complicated than that, because in the future if you really look, the next generation of space systems are going to be crosslinked. So it won t always be just to the Ops Center, it will be to each other. Right? Well, you should be thoroughly frightened by now. But hopefully you share my view that we will continue to see rapid change, particularly in the area of technology, particularly in the area of computer capabilities and with the emphasis on mobilization. And as we diversify and as we diversify our population, you will also see an increase in our reliance on foreign capabilities, not just to build but also to design and again, all are things that we will see in our cyber future. Those are the threats. I ll entertain any questions on any topic at this time? Oh, we re out of time. I want to thank you for your time. Thanks. # # # #