The Insider

The Defense Department has set a deadline next month for crafting an internal report on emerging network breach-reporting regulations for cleared defense contractors, but the draft regulations are unlikely to see daylight until 2015, Inside Cybersecurity reports today:

The new regulations, mandated by Congress, would direct contractors reporting a breach to describe the techniques or methods used in the attack; to provide a sample of the isolated malicious software, if possible; and to include a summary of how DOD data in contractor systems might have been compromised.

The Pentagon has set an Oct. 15 deadline for an ad hoc DOD committee -- which has been developing the statutorily required procedures since January 2013 -- to provide an internal report to the Defense Acquisition Regulations Council director, according to a schedule updated on Friday. Inside Cybersecurity reported last week that DOD would postpone the previous deadline, Sept. 10.

Even if the committee succeeds in submitting the internal report to the council for review in October, however, it might still take months before DOD is ready to publicly release the draft regulations, let alone the final version.

Inside the Army this week quotes the service's top cyber officer as saying the relationship between the government and industry needs to tighten so the Army can be more innovative in its cyberspace operations:

Speaking at a Sept. 11 Association of the United States Army Institute of Land Warfare breakfast in Arlington, VA, Lt. Gen. Edward Cardon, chief of Army Cyber Command, called for the service to be more bold in how it experiments with cyber technology. He said doing so will require increased communication with industry, so the Army will be aware of what's on "the cutting edge" when it comes to cyber.

"The innovation side of this is absolutely critical and this is an area I think that we can really leverage what is done with private industry," Cardon said.

He described a number of initiatives in development to support more effective cyber acquisition, including an "NIE for cyber." The NIE refers to the Network Integration Evaluation, a bi-annual Army event that tests commercial off-the-shelf network technology. Cardon said his command has run a similar trial, bringing together soldiers, national lab scientists and industry partners to test cyber capabilities on a common platform. He added that he'd like the exercise, or one like it, to become a continuous fixture for the Army.

The Pentagon believes the $500 million it has requested from Congress to begin training Syrian rebels in Saudi Arabia would be enough for 5,000 fighters over the course of one year, according to Rear Adm. John Kirby, the Defense Department's top spokesman.

"That would be in phases; it wouldn't all be all at once," he told reporters today at the Pentagon. "The training itself would not take a full year, but we think that we could get more than 5,000 done in more than one year."

Kirby noted, however, that the Pentagon must first locate, vett and recruit moderate members of the Syrian force opposed to the regime of Bashar al Assad and the Islamic State of Iraq in Syria.

"Nobody is underestimating the challenge of having that done and done well," he said. "The Syrian opposition is not a monolithic group. It's not a recognized military force. There is no single recognized leader of the opposition. . . . There's no easy answers here."

Kirby added that the vetting process would likely take “a number of months” before training could actually begin.

Meanwhile, the CIA estimates that the ranks of ISIS have swollen to approximately 31,000.

As previously reported by InsideDefense.com, the Pentagon remains focused on getting Congress to appropriate the $500 million necessary to train the Syrian rebels.

The Air Force is already taking steps to make its spacecraft less susceptible to their environment, Inside the Air Force reports today. Michael Starks, the principal investigator for the center's space particle hazard specification and forecasting program, told Inside the Air Force in a Sept. 10 email that the vehicles the service flies are built using "the most up-to-date tools and standards available." Further:

"They are inherently resistant to the space environment," Starks said. "When impacts do occur, the Air Force's professional satellite operators quickly and effectively address them to avoid interruptions of space services. In close partnership with the prime and supporting contractors, the root causes are routinely identified and addressed."

In the design stage, engineers can increase resiliency in the way they design to radiation belt specifications and by working to closely simulate the space environment. Starks said that once in space, users can establish certain commands and software patches that help improve a spacecraft's service life.

The Air Force Research Laboratory's Space Weather Center of Excellence issued a broad agency announcement on space weather in the spring. ITAF further reports:

The studies that result from this BAA will focus on enhancing [space situational awareness] for DOD satellite operators, Starks said, noting that they could feed into next-generation techniques that build on what operators are doing today.

"As AFRL executes a combination of applied research and advanced technology development, it is expected that scientific and engineering advancements will be transitioned into the community through journal articles, conference participation, and improved standards thereby enhancing our collective understanding of space environmental impacts," Starks said.

Shawn Brimley, an executive vice president at the Center for a New American Security, recently said Deputy Defense Secretary Robert Work could have a tough time garnering support to carry out a truly transformational Pentagon research and development plan. As Inside the Pentagon reports today:

"The challenge for him is will he get the top-cover he needs to do the things he wants to do," Brimley said during an Aug. 26 interview. "He's looking inside the defense R&D budgets, the [internal research and development] budget for defense contractors, and I don't think he's seeing the kind of unified strategy he wants. He is trying to put together a sort of enterprise-wide, DOD-wide strategy for we think about technological offsets and innovation."

Brimley, who co-authored a paper with Work in January on the future of defense innovation, said the deputy secretary may have arrived at the precisely the right time.

"I think he's going to play a much more active role in assuring that the pot of money that exists on general, defense-wide R&D is thought of as a strategic lever," he said. "He wants to see a strategic frame for how that money is spent; communicate those priorities and hold people accountable for budget submissions that communicate those priorities."

With President Obama set to outline his strategy to defeat the Islamic State on national television tonight, congressional Republicans have ideas of their own.

House Armed Services Committee Chairman Buck McKeon (R-CA) released a fact sheet today that includes "five elements he believes are essential to any strategy designed to defeat and destroy ISIL":

1. Recognizes the Immediate Threat to US National Security

• ISIL is more than a regional threat, it poses a clear and certain threat to the United States, our interests, and our allies and partners across the globe.

• Waiting until a terrorist organization is planning an “imminent” attack will cost American lives, as we learned 13 years ago on September 11th.

• ISIL also poses an imminent and existential threat to our allies in a critical region within the world.  Their assistance is key to comprehensively and sustainably handling this threat.

2. Calls for Swift Action with a Clear Objective to Destroy ISIL

• The window for targeting ISIL while it is still operating largely in the open and has not yet fully blended in with the populace is closing.

• A go-slow strategy gives ISIL the space and time to defeat potential partners, attract more foreign fighters, secure additional funding, and plot and plan for future attacks against the United States, Europe, and our interests in the region.

• Our allies recognize that now is the time to act and are seeking US support and leadership. Missing the opportunity presented by this coalition will make the job harder in the long run and will not lead to a sustainable solution.

3. Embraces Simultaneous Operations In Iraq and Syria

• An Iraq first, or Iraq only strategy cannot sufficiently erode ISIL. Decisive simultaneous action in Iraq and Syria is required to deny ISIL a safehaven.

• Waiting until the political situation in Iraq becomes more clear fails to create the space for moderate Sunnis to reject ISIL. Rather it allows ISIL to further radicalize the population and foment sectarian tensions.

• Actions in Syria can be tailored to reduce the risk that operations embolden Assad or Jahbat al-Nusra and other al Qaeda affiliates.

4. Establishes the US as a Leading Coalition Partner

• The US is uniquely able to build, lead, and support coalition operations. There are military options available to us that leverage the capabilities of regional allies on the ground, with the US in a supporting role.

• It is misleading to suggest that the use of any American forces on the ground is akin to “serial occupation.”

• There is a narrow opportunity to defeat ISIL that will not require American boots on the ground in “surge” level numbers, but anyone who suggests a minimalist approach will be successful is not being clear-eyed about the challenge and resiliency of ISIL.

5. Does Not Rely On a Counter Terrorism (CT)-Only Approach

• Air strikes alone will not defeat ISIL, or meaningfully degrade them.

• Our allies are willing to lead the fight, but they will not be able to succeed on the ground without US support in areas like command & control, intelligence, refueling, and special operations.

• A strategy that closely resembles the CT centric standoff operations of the last 5 years is one that cannot prevent this threat from growing. Nor can it sufficiently roll ISIL back as a threat.

McKeon will expand on this in a speech at the American Enterprise Institute tomorrow morning.

The Defense Department inspector general's office recently performed a "quality assurance assessment" of the Missile Defense Agency's Exoatmospheric Kill Vehicle.

In a report released today, the IG found that while most of MDA's EKV quality management systems managed by prime contractor Boeing and subcontractor Raytheon were in compliance, "some areas need improvement." Specifically:

A. Boeing and Raytheon were not ensuring that software development processes and testing were sufficient, which could result in reliability issues.

B. Boeing and Raytheon did not ensure all quality assurance and technical requirements for mission-critical assemblies flowed down to the supply chain and were verified. Therefore, it is uncertain that all supplier products will meet system, performance, and reliability requirements.

C. Boeing and Raytheon were not adhering to configuration management processes, specifically with respect to management of change processes for design requirements. This leads to some uncertainty in fielded configurations.

D. Missile Defense Agency, Boeing, and Raytheon were not ensuring that all quality management systems were in compliance with the AS9100C standard. We identified a total of 48 nonconformances that were violations of the AS9100C standard. These nonconformances could result in the production of nonconforming hardware and software which could effect mission success.

Consequently, the IG recommends the MDA director do the following:

A. Ensure software development processes are fully documented, implemented, and enforced throughout the Exoatmospheric Kill Vehicle supply chain.

B.1 Ensure all suppliers of critical items are identified as critical suppliers, receive the necessary contractual requirements, and requirements are verified throughout the supply chain.

B.2 Ensure fielded hardware affected by an insufficient Hardware Acceptance Review Checklist process is assessed for risk.

C. Ensure design and configuration changes do not circumvent the Missile Defense Agency Assurance Provisions for configuration management.

D. Conduct an effective root cause analysis and implement corrective actions for all 48 nonconformances including assessing the risk to fielded hardware.