buckle up

1BUCKLE UP—CYBERSECURITY WHITE PAPER

Safety First? Not.When Henry Ford brought the automobile to the masses in 1908, the Model T featured a hand crank, which, if held incorrectly, was likely to break your arm when you started the engine as the car kicked back (perhaps a bit like the horse it was replacing). In fact, by the 1920s there was an entire cottage industry that advertised add-on crank products with the promise of “Broken Bones Prevented.” Yes, in those days, people had cars that would break your arm before you even got on the road. And people drove these cars anyway! Were our parents and grandparents insane?

No, of course they weren’t. They had great new technology in their hands and were merely at the beginning of a long Automotive Safety Awareness and Adoption Curve that, amazingly enough, we’re still advancing along to this day. Take seatbelts, for instance. It wasn’t until 1984 that use of this most obvious of personal safety features was made mandatory for the first time in the U.S (in NY). That’s a mere 27 years ago and a full 76 years after Henry Ford started churning out automobiles by the thousands.

BUCKLE UPCYBERSECURITY SEATBELTS ARE FINALLY HERE. USE THEM.

Cybersecurity Seatbelts Are Finally Here. Use Them.


Today, over a century after the automobile revolutionized travel, we still have highway signs to remind us: “Buckle Up! It’s the Law.” You’d think we’d know by now. But if this tiny snippet of automobile history illustrates anything, it shows that safety isn’t the first concern when consumer technology adoption is on a tear. If anything, it’s the last.

So, I suppose we shouldn’t be surprised when we hear that the safety and security of the vast computer networks that run our government, businesses, and personal lives are all at great risk.

After all, this technology is still in its (relative) infancy: It was less than 30 years ago that the PC was even invented, and every one of the millions of web-based applications that operate most government and commercial businesses was created just in the last 15 years. And those billions of downloaded iPhone apps?

They’ve all been created in the last three years. Never before has technology advancement accelerated so quickly and ubiquitously. But, given the historical precedent to march progress forward but keep safety measures in check, you have to ask: What about computer safety? What about network security? I mean, really: Do we have any cybersecurity seatbelts, and, if so, what are they, and are we wearing them?

What Security?Are we using cybersecurity seatbelts? Sorry, but the answer is no. Not even close. All you have to do is read the morning headlines to see that nation states and individual hackers alike can waltz through our so-called network defenses with relative impunity. Suffice it to say that if Israel was able to remotely disable Syrian air defenses to make way for a bombing raid in 20071, imagine what’s possible now, four years and a generation in technology later. At the 2010 National Security Agency (NSA) Trusted Computing Conference2, the NSA Commercial Solutions Center demonstrated that with a little persistence and some off-the-shelf software you can quickly and invisibly remotely circumvent most cyber defenses in use today. When it comes to cybersecurity, it’s almost like any seatbelt we may think we have in place automatically unlatches when an accident occurs, ensuring certain peril for the virtual occupants: Our business- and mission-critical systems and data.

If we don’t fix this problem now, our computers, networks, and the vital data and systems that use them are destined to be thrown through the virtual windshield upon the first cyber “accident” and lay splattered on the virtual asphalt. For each of us, it’s only a matter of time. There’s literally nothing you can do to stop it.

Or is there?

1 As documented in Chapter 1 of Cyber War by Richard A. Clarke, 2010.2 Orlando, FL, 14-16 September 2010.



Finally, Trustworthy Seatbelts!At the 2010 NSA Trusted Computing Conference, we got a first glimpse of the clear path towards a safer computing environment—a world with cybersecurity seatbelts woven of tightly knit Trusted Computing (TC) technologies. TC technology research and development has been in the works for some time, fostered in large part by the Trusted Computing Group (TCG), an industry consortium that is defining standards for more secure computing architectures. NSA, for its part, has spent the last half dozen years proving the viability of integrating component TC technologies into a cohesive environment that together “dramatically improve protection for data, applications, and networks.3” Unlike conventional security technologies, TC solutions rely on a Hardware Root of Trust to identify trusted systems, and block untrusted hardware and software from gaining unauthorized access to networks and information. Like a sturdy seatbelt, TC technologies ensure that your data and systems will remain secure even in the most violent of cyber “accidents.”

Although far from ubiquitous, there are a variety of TC commercial products available today that can make a big difference in the level of security—the level of trust—we have in our systems and networks. These include buzzword-compliant capabilities like secure domain separation, remote attestation, and hardware-based full disk encryption. These core TC technologies are necessary to create a more trustworthy enterprise are now proven, tested, and, in many cases, Department of Defense certified.

One day soon, TC “seatbelts” will be required for all computing devices and networks. In the meantime, though, we can each do our part to protect our own enterprise’s systems and data by getting ahead of the cyber threat and implementing TC seatbelts proactively in our own enterprise. The cyber threats are real and immediate, but finally, the technology defenses are here to defend against them.

In 2011, at the 2nd Annual NSA Trusted Computing Conference, we saw first-hand how to architect that shiny, safer world we all need to live in. We know how to fix this problem. So, to paraphrase Michelin, we have a lot riding on our virtual tires. Let’s not wait 76 years to put on our Trusted Computing seatbelts.

3 “Using Trusted Computing Technologies to Provide Security in a Connected World,” The High Assurance Platform, 2010.



About DMIDMI is a leading IT solutions and business strategy consulting firm. DMI provides services and solutions in Strategic Consulting, Desktop Management, Network Management, Enterprise Applications, and Cybersecurity. We are one of the fastest growing companies in the industry, with over 500 employees and 50 civilian, defense, and intelligence agency clients. The hallmark of our business is dedication to exceptional customer service and we’re proud of our Dunn and Bradstreet Open Ratings quality and satisfaction rating of 94/100. Our record of repeat business is enviable by any standard. DMI is headquartered in Bethesda MD, with satellite and project offices throughout the world.

At DMI, we focus on “enterprise transformation”—the strategic application of innovation to create newfound economies, efficiencies, savings, and value for our government and commercial clients and their customers. We offer market-making thought leadership and the proven ability to deliver solutions to the most vexing problems facing enterprises today.

We have a dedicated Innovation Office designed to seek and bring new concepts and technologies to our clients. In the summer of 2011, we opened a state-of-the-art DMI Innovation Center in the heart of Washington, D.C. At the DMI Innovation Center you can learn, experience, and get your hands dirty with an increasing array of new technologies and solutions like many of those described above. See secure mobility in action. Learn what’s possible with Trusted Computing. And soon, experience the future of integrated, automated cybersecurity monitoring operations. You are cordially invited.

For more information, contact DMI: Andy Musliner, Chief Technology & Innovation Officer, [email protected], 240.223.4809.

DMI One Rock Spring Plaza6550 Rock Spring DrBethesda, MD 20817

DMInc.com [email protected]

©2012 Digital Management, Inc. All right reserved.

buckle up

Documents