Lessons from the Military
Jay Heiser is a smart guy, but I don't know why he became so anti-military when he wrote Military mindset no longer applicable in our line of work last year. He wrote in part:The business world should stop looking to the defense community for direction on information security.
I used to believe that the practice of information security owed a huge debt to the military. I couldn't have been more wrong...
The business world doesn't need the defense community to help it develop secure technology, and, whenever it accepts military ideas, it winds up with the wrong agenda...
It's time our profession stops playing war games and gets in touch with its business roots.
I found two responses, Opinion: Military security legacy is one of innovation, integrity and Opinion: The importance of a military mindset, countering Mr. Heiser. I also found poll results showing 77% of respondents answered "absolutely critical" or "somewhat important" when reading the question "How important is a military mindset when planning and executing an enterprise security strategy?"
Well, it's Friday night and you know what that means in the Bejtlich household. That's right, time to watch a new episode of Dogfights. I don't have any insights based on the episode I just watched, but it reminded me of training I received my first summer at Camp USAFA. One of the exercises we ran involved Air Base Ground Defense. We learned some basic principles and then acted first as attackers and then defenders. It occurred to me that ABGD is in some ways similar to defending digital assets, although we digital security people are not armed. This denies us the capability of truly deterring and incapacitating threats. Attribution is also easier when the enemy is physically present.
Still, I'd like to do my part showing Mr. Heiser what business can learn from the military. Much of corporate America (and Germany, and Japan) seems to be having its lunch eaten by the Chinese dragon, so it's time to take some lessons from people who do security for a living when lives are at stake.
I decided to take a look at DoD Joint Publications and found Joint Tactics, Techniques, and Procedures for Base Defense. Just skimming it I found several very interesting sections. For example, the executive summary includes this:
The general characteristics of defensive operations are:
- to understand the enemy;
- see the battlefield;
- use the defenders’ advantages;
- concentrate at critical times and places;
- conduct counterreconnaissance and counterattacks;
- coordinate critical defense assets;
- balance base security with political and legal constraints;
- and know the law of war and rules of engagement.
I think digital non-military, non-police forces can do all of these except the counterattack portion of number 5. For that we need the military and police to act, or to have them deputize us. Notice numbers 1 and 2 imply monitoring, and number 4 implies being able to recognize critical times and places via digital situational awareness.
These items are displayed in the following graphic, which expands on number 3:
The document continues:
The primary mission of the base is to support joint force objectives.
In other words, the base does not exist to provide security. The base exists to perform "business functions."
Essential actions of the defense force are to detect, warn, deny, destroy, and delay. Every intelligence and counterintelligence resource available to the base commander should be used to determine enemy capabilities and intentions. The base commander must make the best use of the terrain within the commander’s AO [area of operation].
Again, we cannot destroy the enemy, but police and military can.
This final graphic displays some physical perimeter defense measures.
This graphic nicely displays principles like defense in depth. Notice also the "intrusion detection" system (labeled "sensor") and the "network forensics" system (labeled "video camera"). Visibility is provided by lighting. If you're a Jericho Forum fan, imagine these defenses collapsed around the host or even data.
I plan to take a closer look at this document and the Air Force version, AFI 31-301, Air Base Defense.
Comments
Is this an issue? Sure it is! Ask someone...C-level manager, etc...if they know where their "critical assets" are located, and they say, "yes". Ask them where they are, and you either get a "deer-in-the-headlights" look, or a broad, sweeping arm movement over the entire infrastructure. Responders will be (and are) asked to image drives from 20GB to 2TB to tell the C-level managers if there is any credit card data or other PII on the drive...hey, a knucklehead Marine like me knows that you can save yourself time and money by knowing that ahead of time!
It easy to say something "doesn't work" when it isn't used or implemented properly. It's easy for someone non-military to say that the "military mindset" doesn't work when Ivy league business school grads are running companies into the ground because they think they know better. The fact is that it does work...if you use it right!
Personally, I think it's a natural extension of security principles from the physical world into the digital world, which is just the way things evolved. After all, many of the same people were responsible for both in the beginning. Maybe now that the field has advanced on its own for a while, it will start to diverge more from its roots.
So? How many of those polled have a military background? I bet quite a few so I don't trust the poll. But ask yourself this: Do you believe that military tactics are useful for your work because you are from the military and not because they work or are even relevant? I bet its the former.
If I have to choose between being defended by 1) people who have been trained for defense and have practiced defense, or 2) people who have neither training nor experience, I will choose 1.
"But attempts to use the resulting B1 systems collapsed under the weight of impracticality".
However, the concepts regarding these systems are still sound, but their implementation of them at the time were not.
He also implied that military policy impeded progress in commercial security, but name one government department that has not enacted bad policy at one time or another.
As reponder Tanji points out, the military must err on the side of the caution as lives and defense of a nation may be at stake, whereas in business (only) livelihoods, and revenues may be affected.
Rich Mogull sums it up very nicely on his blog today, the main point being the need to differentiate between those things from the military that can be applied and those that do not translate well into the commercial space.
The Soviets had "Defense in Depth" way before us IT geeks started to use it, and it involves using a second echelon of defense to catch anything that breaks through the front lines and a reserve force to react to any unforeseen contingency.
I think if you're looking for a manual to compare to what we do, a better bet is to look at something along the lines of Operations Other Than War, Limited Intensity Conflict, or Stability and Support Operations. The Marines have the "Small Wars Manual" which would probably fit in there nicely.
And yes, I have been on the ground doing these kinds of things, not just reading about them in books. =)