Twitter
Facebook
The typical buzz word in today’s cyberspace domain is “cybersecurity.” Cybersecurity is developed into layers, in which all are utilized to protect a nation’s assets, as well as incorporate strategic planning to actually attack adversaries.
Popular cybersecurity threats, such as SSL 3.0 “POODLE,” Stuxnet, the ILOVEYOU virus and many other recent loopholes, have consistently called for different levels of security to be applied. Those are the fancy names, but what personnel generally see on their machine is average and plain to the eye, such as a link on Facebook or a phishing scam through emails.
The layers of security developed through the National Institute of Standards and Technology, security policy and white papers published by SANS, the requirements made by the National Security Agency, and the standards created by the International Organization for Standardization helped derive all of the Air Force’s key components for security. These security practices have been around and have been continuously tailored for more than a decade.
As mentioned, cybersecurity is developed in layers. The layers in which a system is built are commonly viewed in an organization’s business impact analysis and formulated into a defense-in-depth or security-in-depth approach.
Defense-in-depth is used to consistently add layers of security onto different programs, ranging from physical security to the actual application of firewalls onto a particular server or network. To an end user, what does this mean? The weakest link in any security chain is a vulnerability, which makes even the strongest systems vulnerable.
Even though restarting a computer to install patches and security updates can be inconvenient, the patches pushed out to these systems protect information already known to have security vulnerabilities.
For example, Stuxnet, the first malicious software to be used as a weapon, was originally transferred through a USB plugged into an information system. This stealth virus was capable of spreading without any knowledge to the operators. It ultimately set Iran’s nuclear program back by causing physical destruction to their uranium enrichment plant, the first physical destruction of a system caused by an electronic code.
Today the Air Force sees hundreds to thousands of users accidentally and intentionally plugging in USBs to charge their phones, upload music on their computers or take work home. All are capable of transferring viruses, worms and other malicious codes.
What does this mean to Ramstein users? The Air Force dominates in air, space and cyberspace, and cyberspace is a key domain in winning today’s battles.
Data owned in Ramstein information systems, whether it is an excel spreadsheet or a nuclear weapon, needs to be protected. This data is instrumental to the flying, fighting and winning stages of today’s force. The alteration, deletion or fabrication of data could develop into hundreds of man-hours lost, or an attack on the power grid could cause hundreds of miles to be without power — all from a click of the mouse.
