13 ms·

DoD Budget Appears to Cut Cyber Offense, Beef Up Defenses

137 points by nomoreplease 5y ago

xoa 5y ago
FINALLY. They should have done this since the start, for decades now much of the US military has gotten cyberwar completely backwards by misapplying real world strategies to the digital world (obviously they have not been alone). "The best defense is a good offense" is often true for physical warfare, where limited resources means force concentration can be far more effective then the same resources put into static defenses. But in the digital world where data can be replicated endlessly, advantage is probably better thought of in terms of information gradients, electronic utilization, and societal models. For gradients, if a society maintains more information than another (the product of lots of resources sunk into R&D say) that translates into technological and effectiveness edge and thus real world advantage. Since information can be replicated perfectly, attacks tend to level the gradient, meaning the attackers gain the value without the same resource expenditure and can put more resources into putting the same stuff into production. For electronic utilization, computers and networks in a lot of things can improve efficiency a great deal. But that then also opens up opportunities for digital attackers. And the government digital security efforts should heavily take into account shoring up the weaknesses of the model society follows. For the West in general that has a lot of individualism, free market capitalism generating tons of data, heavy technological dependency to maximize productivity per person rather then throwing bulk cheap labor at a problem, etc. Government needs to help organizations and individuals stand up to state-level threats. So for America, I'd argue that "the best offense is a good defense" when it comes to cyber war. Like, imagine a world where we had perfect bug free systems and nobody could hack anything, vs a world where there is zero possible security and all information is shared universally. I think in the former America would have a significant advantage over more authoritarian countries for the foreseeable future. I think an open society has an edge in producing valuable knew information. But in the latter scenario I think authoritarians would be ahead. They have more people and a more directed economy, if they could essentially outsource R&D completely they'd gain more than they'd lose from it. Better late than never though. And it'll take years and years and years to prove that this is really serious and not a flash in the pan, that American defense agencies will actually choose patching over holding onto zero days (thus showing faith in the country) and so on. But I hope this does mark a permanent change where rather then mistrusting by default the likes of the NSA and other TLAs their security advice is appreciated and highly useful. One can hope.
- foota 5y ago
  I was wondering about this earlier, part of me wonders if the opposite is true, that the only way to prevent cyberwar is a nuclear like MAD arrangement.
  - meatmanek 5y ago
    MAD can work for nuclear weapons because: 1) The set of nuclear powers is well-known. 2) The barrier to becoming a nuclear power is high enough that only governments can feasibly do it. 3) You can generally tell who launched a missile at you. 4) Mutual destruction is considered a bad enough outcome by each of the nuclear powers that it's an effective first-strike deterrent. Almost none of these factors are true for cyberattacks. Cyberattacks can be done by almost anybody, including literal children. They can be laundered in a way that makes them very difficult to trace. Lots of criminal enterprises wouldn't mind if their own country's infrastructure was crippled in a counterattack to their own attack.
    - foota 5y ago
      I was under the impression that most of these kinds of attacks are primarily state sponsored and that the state is generally known.
      - not2b 5y ago
        Many ransomware attacks are private profiteers. Some appear to be private criminals who are tolerated or even encouraged as long as they only attack hostile countries, and this provides deniability. But if retaliation becomes a real threat, the players will just pretend to be someone else, and the state actors will be good at that.
        uhhhhhhhhhhhhhh 5y ago
        NorthKorean #1 Karaoke and Cyber Offensive Outpost Bar and Grill, now with starlink
- 5y ago
timeinput 5y ago
If only they'd beefed up defense of the beef supplier
- th0ma5 5y ago
  So you're advocating for a socialist takeover of the meat supply? /s
  - timeinput 5y ago
    No, just a bad joke related to the other (currently) front page story about a cyber attack impacting the beef industry https://news.ycombinator.com/item?id=27359515 https://news.ycombinator.com/item?id=27359515
    - amiga 5y ago
      To beef fair, the title was begging for it.
    - th0ma5 5y ago
      I hear a lot of people talk about the current administration not doing enough, but I was pretty sure that companies were free to have whatever bad infrastructure they think they can get away with. These ransomware things are rarely something that I would consider national security. For instance, it looks like a good opportunity for a company to take over this company and do their systems correctly.
alert0 5y ago
I would really like to see a move toward purpose built systems and actually software engineering. General purpose operating systems really speed up development time, but I am not sure we need critical infrastructure to be capable of playing Doom or running generic ransomware. In the same vein, it would be nice for the people who built these systems to be able to provide tolerances and document failure cases. This would be mandating memory safe languages, understanding dependencies, mandatory penetration tests, mandatory fuzz testing. We have standards for building bridges but not for computing systems. Another policy point would be data de-risking. It has been shown time and time again that companies cannot protect their own data, not to mention user data. I think we should make it very costly to be breached and lose PII. It would raise the bar a lot for who could do what, but I do not think companies have really demonstrated that they can handle this data responsibly. These data losses have even become a national security risk. [1] 1. https://foreignpolicy.com/2020/12/21/china-stolen-us-data-exposed-cia-operatives-spy-networks/ https://foreignpolicy.com/2020/12/21/china-stolen-us-data-ex...
- caseysoftware 5y ago
  > I do not think companies have really demonstrated that they can handle this data responsibly. Neither have governments. The entire OPM (Office of Personnel Management) background check database was breached and thoroughly compromised for years. And that system is effectively the blackmailer's wet dream. I wrote about that almost 6 years ago here: https://caseysoftware.com/blog/why-this-security-breach-is-worse-than-all-the-others-combined https://caseysoftware.com/blog/why-this-security-breach-is-w... And that was before the NSA had all their best hacking tools stolen..
  - jl2718 5y ago
    What is the responsible thing to do here? Should a government announce to the people that everybody within it is potentially operating under foreign influence?
    - Nexxius 5y ago
      Cyber COP, Experian Cyber services, and the like have provided fairly perm accounts paid for by the government due to breaches and mistaken disclosures of PII. While the above mentioned incident is one of the more notable, it ain't the first and isn't even the most recent.
tigerBL00D 5y ago
I am sure that spending multiples of $100M on cyber offense is providing ample justification to state-sponsored adversaries of all kinds to stage attacks of their own. Especially combined with Snowden-type revelations which makes the US look like an evil monopoly conspiring to aggressively exploit its dominance to eliminate all competition.
- mc32 5y ago
  State actors who do this aren’t looking for justification. They just do it because they can. Same with independent (non-state) actors. It’s not like they were being goody two shoes and suddenly with the Snowden revelations they turned.
  - bawolff 5y ago
    ??? State actors have objectives. Even if that objective is just to test their capabilities. It seems rediculous to suggest state actors are just doing it for the lulz.
  - tigerBL00D 5y ago
    Let me put it this way. You're not likely to cut your R&D budget when your competition is increasing it.
    - adventured 5y ago
      The one thing you can be certain about is that the US is absolutely not cutting its cyber offensive spending or reducing its offensive capabilities. That's all increasing, by a lot. Under no scenario will cuts to offensive capabilities happen, it doesn't matter which party or person is in the White House. Real US cyber offensive spending is buried inside of the three letter agencies and buried in classified spending segments within the budget (the $50b to $100b black budget), not out in the open in the supposedly transparent defense budget. It's very silly anybody would believe the US would cut its spending on cyber offense, while it's deep into a never-to-end cyber conflict with Russia and China; a conflict which none of the parties are much attempting to keep hidden at this point.
antattack 5y ago
Wow, cyber operations budget is tiny compared to overall military budget. Why is this such a low priority?
- annoyingnoob 5y ago
  A datacenter and a bunch of computers costs less than an airport and a bunch of fighter jets?
- tzs 5y ago
  You can't infer priority from budget size, because different military activities have different equipment requirements. Need the capability to send a few guys in a helicopter to attack an enemy physically? You are looking at hundreds of millions for the helicopter and weapons. Need to have a few guys remotely hack a foreign website? A few computers, a good internet connection, and some comfortable chairs. No matter how high you prioritize those kinds of cyber ops you aren't going to need a budget anywhere what even a modest fleet of aircraft or ships or tanks needs. Sometimes there may be a need to blow up something or physically sabotage something in another country to facilitate some cyber ops goal, but that would be carried out by the people with drones or planes or by special ops, depending on what the relationship is between the US and the country the operation will be in and so how discrete the US needs to be, and the money to support such capabilities would show up on their budget rather than the cyber ops budget.
- R0b0t1 5y ago
  There's a large black budget that is unattributed. And, IIRC, the Vault 7 leaks implicated shell companies in the maintenance of CIA infrastructure.
ahurmazda 5y ago
Tbh, I prolly wouldn’t going around publicly disclosing my budgets for offensive capabilities (or at least in it’s entirety). Let the enemies keep guessing
- not2b 5y ago
  In a democracy, the people need to have a say as to how money is spent. The detailed capabilities can be hidden (and will be), but I think it's a good idea to shift to defense, and the shift in focus should be openly debated. Besides, cyber offense isn't a means of defense, because you'd need to figure out how to retaliate against and tit for tat escalation of attacks would be a disaster.
  - adventured 5y ago
    There is no shift happening what-so-ever. They're hiding the offensive spending for plausible deniability purposes, and to keep some information from US enemies. It's trivially easy to shift expansion in the cyber offensive spending to the black budget segment, so US enemies can't get a clean idea of what the US is spending or not spending in that area. The US does this as a matter of routine in defense spending, and has across most of the post WW2 era.
  - xkcd-sucks 5y ago
    All the three letter agencies in the USA have burned all their trust regarding secrecy. Better (re:public opinion, funding) to be truthful
  - koheripbal 5y ago
    Democracy does not require military spending transparency.
asdff 5y ago
For people in this field, are we seeing any movement towards smaller, decentralized intranets that would be physically impossible to hack without physical penetration? It seems like the issue with a lot of these hacks of critical systems is that they exist on the open internet, where a team of security researchers in Russia can access them conveniently from home. If more things were gapped, it seems like the security benefits would be huge, and convenience costs could be worked around in various ways.
- nexuist 5y ago
  > where a team of security researchers in Russia can access them conveniently from home ...or a team of your employees, who for one reason or another couldn't make it to the office every day since March of last year. In other words, VPNs. These are the smaller intranets you are talking about. Of course they still need to be capable and privileged enough to allow your employees to do their jobs, and this same requirement is the reason why ransomware can strike so effectively.
  - tonyedgecombe 5y ago
    We did manage to run power stations and military installations before the internet came along. I'm sure there would be inconveniences but it seems a small price to pay to keep critical infrastructure running.
max-ibel 5y ago
Seems clear to me: move offensive stuff in the 3-letter agencies and black budgets, where they belong. Then we're officially the good guys, too :)
gigatexal 5y ago
I think I am going to get downvoted to hell. So be it. I don’t think there’s any reasoning with the Putin’s or the Xi’s of the world when it comes to this cyber Cold War. They both have highly skilled and motivated state-sponsored hacking divisions of their respective military or intelligence agencies. They’re simply far, far outside American reach. Not to mention the cypher pirates that operate on their soil and attack countries like the US that they turn a blind eye to. Bolstering our tech best practices to focus on being secure and training workers to better understand what phishing looks like etc., but I think the solution is more proactive than that. I think the solution is clandestine operations conducted by say the CIA to either infiltrate these ranks and turn would be hackers into allies or it’s straight up murder of the hackers by some US spy and have it look like a common crime in that country. These attacks will only escalate and I fear they boil over into a full blown war. If diplomacy doesn’t work, if turning our would be attackers into allies doesn’t work, then what other option do we have if cyber defenses aren’t enough (the best defense is always one step behind a smart and adaptive attacker)?

137 points by nomoreplease 5y ago

xoa 5y ago

FINALLY. They should have done this since the start, for decades now much of the US military has gotten cyberwar completely backwards by misapplying real world strategies to the digital world (obviously they have not been alone). "The best defense is a good offense" is often true for physical warfare, where limited resources means force concentration can be far more effective then the same resources put into static defenses. But in the digital world where data can be replicated endlessly, advantage is probably better thought of in terms of information gradients, electronic utilization, and societal models. For gradients, if a society maintains more information than another (the product of lots of resources sunk into R&D say) that translates into technological and effectiveness edge and thus real world advantage. Since information can be replicated perfectly, attacks tend to level the gradient, meaning the attackers gain the value without the same resource expenditure and can put more resources into putting the same stuff into production. For electronic utilization, computers and networks in a lot of things can improve efficiency a great deal. But that then also opens up opportunities for digital attackers. And the government digital security efforts should heavily take into account shoring up the weaknesses of the model society follows. For the West in general that has a lot of individualism, free market capitalism generating tons of data, heavy technological dependency to maximize productivity per person rather then throwing bulk cheap labor at a problem, etc. Government needs to help organizations and individuals stand up to state-level threats. So for America, I'd argue that "the best offense is a good defense" when it comes to cyber war. Like, imagine a world where we had perfect bug free systems and nobody could hack anything, vs a world where there is zero possible security and all information is shared universally. I think in the former America would have a significant advantage over more authoritarian countries for the foreseeable future. I think an open society has an edge in producing valuable knew information. But in the latter scenario I think authoritarians would be ahead. They have more people and a more directed economy, if they could essentially outsource R&D completely they'd gain more than they'd lose from it. Better late than never though. And it'll take years and years and years to prove that this is really serious and not a flash in the pan, that American defense agencies will actually choose patching over holding onto zero days (thus showing faith in the country) and so on. But I hope this does mark a permanent change where rather then mistrusting by default the likes of the NSA and other TLAs their security advice is appreciated and highly useful. One can hope.

foota 5y ago
I was wondering about this earlier, part of me wonders if the opposite is true, that the only way to prevent cyberwar is a nuclear like MAD arrangement.
- meatmanek 5y ago
  MAD can work for nuclear weapons because: 1) The set of nuclear powers is well-known. 2) The barrier to becoming a nuclear power is high enough that only governments can feasibly do it. 3) You can generally tell who launched a missile at you. 4) Mutual destruction is considered a bad enough outcome by each of the nuclear powers that it's an effective first-strike deterrent. Almost none of these factors are true for cyberattacks. Cyberattacks can be done by almost anybody, including literal children. They can be laundered in a way that makes them very difficult to trace. Lots of criminal enterprises wouldn't mind if their own country's infrastructure was crippled in a counterattack to their own attack.
  - foota 5y ago
    I was under the impression that most of these kinds of attacks are primarily state sponsored and that the state is generally known.
    - not2b 5y ago
      Many ransomware attacks are private profiteers. Some appear to be private criminals who are tolerated or even encouraged as long as they only attack hostile countries, and this provides deniability. But if retaliation becomes a real threat, the players will just pretend to be someone else, and the state actors will be good at that.
      - uhhhhhhhhhhhhhh 5y ago
        NorthKorean #1 Karaoke and Cyber Offensive Outpost Bar and Grill, now with starlink
5y ago

timeinput 5y ago

If only they'd beefed up defense of the beef supplier

th0ma5 5y ago
So you're advocating for a socialist takeover of the meat supply? /s
- timeinput 5y ago
  No, just a bad joke related to the other (currently) front page story about a cyber attack impacting the beef industry https://news.ycombinator.com/item?id=27359515 https://news.ycombinator.com/item?id=27359515
  - amiga 5y ago
    To beef fair, the title was begging for it.
  - th0ma5 5y ago
    I hear a lot of people talk about the current administration not doing enough, but I was pretty sure that companies were free to have whatever bad infrastructure they think they can get away with. These ransomware things are rarely something that I would consider national security. For instance, it looks like a good opportunity for a company to take over this company and do their systems correctly.

alert0 5y ago

I would really like to see a move toward purpose built systems and actually software engineering. General purpose operating systems really speed up development time, but I am not sure we need critical infrastructure to be capable of playing Doom or running generic ransomware. In the same vein, it would be nice for the people who built these systems to be able to provide tolerances and document failure cases. This would be mandating memory safe languages, understanding dependencies, mandatory penetration tests, mandatory fuzz testing. We have standards for building bridges but not for computing systems. Another policy point would be data de-risking. It has been shown time and time again that companies cannot protect their own data, not to mention user data. I think we should make it very costly to be breached and lose PII. It would raise the bar a lot for who could do what, but I do not think companies have really demonstrated that they can handle this data responsibly. These data losses have even become a national security risk. [1] 1. https://foreignpolicy.com/2020/12/21/china-stolen-us-data-exposed-cia-operatives-spy-networks/ https://foreignpolicy.com/2020/12/21/china-stolen-us-data-ex...

caseysoftware 5y ago
> I do not think companies have really demonstrated that they can handle this data responsibly. Neither have governments. The entire OPM (Office of Personnel Management) background check database was breached and thoroughly compromised for years. And that system is effectively the blackmailer's wet dream. I wrote about that almost 6 years ago here: https://caseysoftware.com/blog/why-this-security-breach-is-worse-than-all-the-others-combined https://caseysoftware.com/blog/why-this-security-breach-is-w... And that was before the NSA had all their best hacking tools stolen..
- jl2718 5y ago
  What is the responsible thing to do here? Should a government announce to the people that everybody within it is potentially operating under foreign influence?
  - Nexxius 5y ago
    Cyber COP, Experian Cyber services, and the like have provided fairly perm accounts paid for by the government due to breaches and mistaken disclosures of PII. While the above mentioned incident is one of the more notable, it ain't the first and isn't even the most recent.

tigerBL00D 5y ago

I am sure that spending multiples of $100M on cyber offense is providing ample justification to state-sponsored adversaries of all kinds to stage attacks of their own. Especially combined with Snowden-type revelations which makes the US look like an evil monopoly conspiring to aggressively exploit its dominance to eliminate all competition.

mc32 5y ago
State actors who do this aren’t looking for justification. They just do it because they can. Same with independent (non-state) actors. It’s not like they were being goody two shoes and suddenly with the Snowden revelations they turned.
- bawolff 5y ago
  ??? State actors have objectives. Even if that objective is just to test their capabilities. It seems rediculous to suggest state actors are just doing it for the lulz.
- tigerBL00D 5y ago
  Let me put it this way. You're not likely to cut your R&D budget when your competition is increasing it.
  - adventured 5y ago
    The one thing you can be certain about is that the US is absolutely not cutting its cyber offensive spending or reducing its offensive capabilities. That's all increasing, by a lot. Under no scenario will cuts to offensive capabilities happen, it doesn't matter which party or person is in the White House. Real US cyber offensive spending is buried inside of the three letter agencies and buried in classified spending segments within the budget (the $50b to $100b black budget), not out in the open in the supposedly transparent defense budget. It's very silly anybody would believe the US would cut its spending on cyber offense, while it's deep into a never-to-end cyber conflict with Russia and China; a conflict which none of the parties are much attempting to keep hidden at this point.

antattack 5y ago

Wow, cyber operations budget is tiny compared to overall military budget. Why is this such a low priority?

annoyingnoob 5y ago
A datacenter and a bunch of computers costs less than an airport and a bunch of fighter jets?
tzs 5y ago
You can't infer priority from budget size, because different military activities have different equipment requirements. Need the capability to send a few guys in a helicopter to attack an enemy physically? You are looking at hundreds of millions for the helicopter and weapons. Need to have a few guys remotely hack a foreign website? A few computers, a good internet connection, and some comfortable chairs. No matter how high you prioritize those kinds of cyber ops you aren't going to need a budget anywhere what even a modest fleet of aircraft or ships or tanks needs. Sometimes there may be a need to blow up something or physically sabotage something in another country to facilitate some cyber ops goal, but that would be carried out by the people with drones or planes or by special ops, depending on what the relationship is between the US and the country the operation will be in and so how discrete the US needs to be, and the money to support such capabilities would show up on their budget rather than the cyber ops budget.
R0b0t1 5y ago
There's a large black budget that is unattributed. And, IIRC, the Vault 7 leaks implicated shell companies in the maintenance of CIA infrastructure.

ahurmazda 5y ago

Tbh, I prolly wouldn’t going around publicly disclosing my budgets for offensive capabilities (or at least in it’s entirety). Let the enemies keep guessing

not2b 5y ago
In a democracy, the people need to have a say as to how money is spent. The detailed capabilities can be hidden (and will be), but I think it's a good idea to shift to defense, and the shift in focus should be openly debated. Besides, cyber offense isn't a means of defense, because you'd need to figure out how to retaliate against and tit for tat escalation of attacks would be a disaster.
- adventured 5y ago
  There is no shift happening what-so-ever. They're hiding the offensive spending for plausible deniability purposes, and to keep some information from US enemies. It's trivially easy to shift expansion in the cyber offensive spending to the black budget segment, so US enemies can't get a clean idea of what the US is spending or not spending in that area. The US does this as a matter of routine in defense spending, and has across most of the post WW2 era.
- xkcd-sucks 5y ago
  All the three letter agencies in the USA have burned all their trust regarding secrecy. Better (re:public opinion, funding) to be truthful
- koheripbal 5y ago
  Democracy does not require military spending transparency.

asdff 5y ago

For people in this field, are we seeing any movement towards smaller, decentralized intranets that would be physically impossible to hack without physical penetration? It seems like the issue with a lot of these hacks of critical systems is that they exist on the open internet, where a team of security researchers in Russia can access them conveniently from home. If more things were gapped, it seems like the security benefits would be huge, and convenience costs could be worked around in various ways.

nexuist 5y ago
> where a team of security researchers in Russia can access them conveniently from home ...or a team of your employees, who for one reason or another couldn't make it to the office every day since March of last year. In other words, VPNs. These are the smaller intranets you are talking about. Of course they still need to be capable and privileged enough to allow your employees to do their jobs, and this same requirement is the reason why ransomware can strike so effectively.
- tonyedgecombe 5y ago
  We did manage to run power stations and military installations before the internet came along. I'm sure there would be inconveniences but it seems a small price to pay to keep critical infrastructure running.

max-ibel 5y ago

Seems clear to me: move offensive stuff in the 3-letter agencies and black budgets, where they belong. Then we're officially the good guys, too :)

gigatexal 5y ago

I think I am going to get downvoted to hell. So be it. I don’t think there’s any reasoning with the Putin’s or the Xi’s of the world when it comes to this cyber Cold War. They both have highly skilled and motivated state-sponsored hacking divisions of their respective military or intelligence agencies. They’re simply far, far outside American reach. Not to mention the cypher pirates that operate on their soil and attack countries like the US that they turn a blind eye to. Bolstering our tech best practices to focus on being secure and training workers to better understand what phishing looks like etc., but I think the solution is more proactive than that. I think the solution is clandestine operations conducted by say the CIA to either infiltrate these ranks and turn would be hackers into allies or it’s straight up murder of the hackers by some US spy and have it look like a common crime in that country. These attacks will only escalate and I fear they boil over into a full blown war. If diplomacy doesn’t work, if turning our would be attackers into allies doesn’t work, then what other option do we have if cyber defenses aren’t enough (the best defense is always one step behind a smart and adaptive attacker)?