Recently much attention is being given to the topic of cyber warfare and rightfully so. Our computers and networks are under continuous attack from all over the world. The level of sophistication of these attacks and the quality of the code written to perform these attacks both have raised significantly in the past year. Experts agree we have entered a new era of warfare and are transitioning from bombs and bullets to bits and bytes.
In January two classified presidential directives were signed related to defending the country against cyber attacks. At that time the price tag was estimated at $6 billion. In mid May the price tag was revised and believed to be $17 billion. Now, the price has risen again to be $30 billion. That is a big pot of money by anyone’s standards. So the question is, where will this money be spent? Increasing cyber defense will require investment in Research and Development as well as in existing technology and services. The first and most critical activity will be to fortify current systems against known cyber threats.
Spending Allocation:
- Hardware 18% $5.4 Billion USD
- Software 25% $7.5 Billion USD
- Consulting 29% $8.7 Billion USD
- Services 24% $7.2 Billion USD
- R&D 4% $1.2 Billion USD
The R&D efforts will focus on near term delivery of advanced defensive capabilities (like behavioral modeling) of software processes and transaction to evaluate if they pose a threat to the system. Additionally, advanced modeling capabilities are required for evolving defenses and investigative activities. Advanced modeling will be used to certify and authenticate chips, hardware and software to be authentic and free of malicious code. One of the most promising capabilities centers on the development of a “Digital DNA” database repository. The ultimate goal of this work is the same as with current DNA forensics — to identify the perpetrators of the assault. Most cyber attacks leave behind forensic evidence that can be used to assess the capabilities of the attacker, understand the implications of the attack and to create defensive measure to guard against this type attack in the future. With all the attacks that have taken place, there is significant intelligence out there about techniques, cyber weapons, and strategies that have been used in these cyber assaults. Analysis of this evidence can create Digital DNA which could also help to identify the source of the malicious code and potentially lead to the attacker.
ASDF represents the four Digital DNA characteristic sets.
A = attributes, abilities, abstraction, architecture, assembly, adaptation
S = style, signatures, syntax, structure, source, specification, scope
D = demographics, delivery, development, discipline, data, design
F = functions, features, faults, formidability, fields, forms, factors
There are currently over a million pieces of malware. On average there are approximately 200 new computer viruses released monthly, so the raw cyber DNA materials are not in short supply. The potential use and value of the Digital DNA repository will increase with every single entry and the analysis of attacks. According to a source close to the Digital DNA project, the repository is currently in its infancy, it continues to grow and mature with the knowledge gained from each cyber attack. John Foley, CEO of Defcomm1 and former CEO of Vigilant Minds a leading managed security services provider said, “Much like the human genome project, Digital DNA will basically fingerprint the technical and human factors behind the malicious software and attacks.” Security experts believe that Digital DNA type data is a critical component and required to fight cyber attacks and defend systems.
{ 11 comments… read them below or add one }
I have nothing to say about the first half of the article, but it is concerning to see sensitive counter cyber warfare techniques being disclosed in the second half. It’s not a new technique, but this is not something that should reach the public.
The Digital DNA is for a being developed as a commercial product for use by law enforcement, businesses and the defense and intelligence industry. It is not classified nor is it protected under For Official Use Only Information. This was openly discussed at a security conference and on a webinar earlier this year. I do go to great lengths as not to provide any direct or derivative intelligence in these pieces. I appreciate your concern and for the record I did leave out some of the more interesting aspects of the Digital DNA concept and product for the reasons you mentioned. Believe me there are many subjects that I have been asked to write on that I have declined for the security reasons.
“Loose lips sink ships” still applies…
DID YOU EVER CONSIDER – hackers knowing we can trace the attack code back to them is a deterrent? I saw Kevin present on this back in the fall of 2004 at a Venture Capital conference in Silicon Valley. What you don’t realize is that all antivirus software works on the code signatures derived from a virus database. This is an evolution of what is been going on for years.
I have just read everything you posted on this cyber warfare blog. I must say I am impressed. Although, I had heard of your work before from some of my staff so it was expected. That being said, I must say it has left me wondering – if this is what you are willing to share openly, how interesting the topics must be you discuss in a closed/classified setting! I will be contacting you shortly.
I imagine the USA has been ahead of the game for some time in secret, but now that the profile of the issue has risen to material public concern it’s going to get more funding and become official.
$30 billion is nothing. Expect that to triple in the next 2-3 years. We’re only starting to understand the capabilities of China, India and even rouge code breakers/virus’s. It’s madness! http://www.madnessletters.com
Regarding the DNA_DB. Is it being implemented by the government, private sector, or a collaborative endeavor? And who exactly will have access to the information? My faith in the expediency of a federal bureaucracy is a bit lacking. Not to mention, isn’t this already being done, to some extent, by the private sector (ie. anti-bug companies)?
http://www.symantec.com/business/security_response/threatexplorer/threats.jsp
https://forums.symantec.com/syment/blog?blog.id=emerging
Sure, code can be categorized by human preferences & discrepancy (as well as device variances, etc.), but such information could also be falsified. Calling it “evidence” is a bit too definitive, in my humble opinion. And wouldn’t a DNA_DB also allow entities to “cut & paste” or create code, in order to hide their own “tells”? :\
Then there is the “So what!” defense. What if a country is caught with their hand in the honey jar? They can still blame it on another country, a private entity, have absolutely no idea what you’re talking about, or claim NATO brought in the Mig-29 to shoot down that drone. :| After all, who has ever gone to war over data?
Maybe countries will one day sign treaties & international bans prohibiting malicious code use… eh, probably not.
For those who are curious & bored…
http://snort.org/
http://www.sans.org/resources/idfaq
http://www.honeypots.net/
http://www.honeynet.org/
http://nmap.org/
You continue to provide really interesting information, Kevin.
I’m curious as to your source for the funding breakdown.
DID YOU EVER CONSIDER – hackers knowing we can trace the attack code back to them is a deterrent? I saw Kevin present on this back in the fall of 2004 at a Venture Capital conference in Silicon Valley. What you don’t realize is that all antivirus software works on the code signatures derived from a virus database. This is an evolution of what is been going on for years.
The Digital DNA is for a being developed as a commercial product for use by law enforcement, businesses and the defense and intelligence industry. It is not classified nor is it protected under For Official Use Only Information. This was openly discussed at a security conference and on a webinar earlier this year. I do go to great lengths as not to provide any direct or derivative intelligence in these pieces. I appreciate your concern and for the record I did leave out some of the more interesting aspects of the Digital DNA concept and product for the reasons you mentioned. Believe me there are many subjects that I have been asked to write on that I have declined for the security reasons.