County Coroner in Handcuffs - Gave out his password

Dynamic Security could have easily identified that the person logging in was not the coroner, since he or she was in the wrong place at the wrong time, or there were multiple logins.

---

Trust Isn’t Security

Frank Hayes February 12, 2007 (Computerworld) -- In Lancaster, Pa., last week, the county coroner was brought to court in handcuffs. A grand jury indicted Dr. Gary Kirchner, charging him with giving out his account name and password for a county Web site that contained confidential police 911 information. What kind of information? Names of accident victims and police informants, medical conditions, witness accounts, autopsy reports and not-yet-substantiated accusations. The site was the access point for real-time data generated and used by firefighters, ambulance crews and other emergency responders.

And who did the coroner allegedly give his password to? Newspaper reporters. Now there’s a trusting user.

Wait, it gets scarier. According to the grand jury, the reporters said Kirchner gave them the password because he didn’t want to be bothered with their phone calls asking for details about homicides, fatal accidents and suspicious deaths.

The reporters weren’t charged with illegally accessing the Web site, because they testified under immunity from prosecution. Kirchner has denied the charges against him.

But the grand jury report quotes e-mails and computer forensic evidence that paint an ugly portrait of the coroner (who apparently ignored security policies and gave away his password within weeks of taking office in 2004) and the reporters (who ignored “authorized personnel only” warnings and accessed confidential information hundreds of times over an 18-month period).

And where was IT all this time? Not noticing, mostly. Eventually, an IT staffer checked Web site logs and discovered that the site was accessed more than 50 times in two weeks from computers at a newspaper office. But that was only after one reporter mentioned in a news report that some information came from the Web site, and a reporter from a competing newspaper called the county to find out why he didn’t have access.

That’s when a supervisor realized there had been a security breach, a police investigation began, logs were checked, passwords were changed, and the grand jury went to work.

Until then, everyone apparently assumed that because users were trusted with the information on the emergency 911 Web site, they could be trusted to keep it secure. Now there’s a trusting IT department.

That trust was misplaced. And not just trust in the coroner. After the reporters’ intrusion was discovered, logs were scrutinized more carefully. In 2006, four emergency responders were prosecuted for giving out their passwords, and two other people were arrested for accessing the site.

According to the grand jury report, the results of those password leaks weren’t trivial. In one incident, a 911 caller reported suspicious drug activity in his neighborhood. His name was supposed to be kept confidential. Because of the password leaks, it wasn’t. “That caller’s name was made known on the streets, and the caller was severely beaten in retaliation,” the grand jury report said.

We want to trust our users. We have to trust them, mostly — we can’t afford to watch them every second. And most of them are worthy of that trust.

But some aren’t.

Trusting is nice. It’s sociable. It’s convenient.

Don’t do it.

We have the technology to control network access to confidential information. Beyond passwords, we can limit users’ access with IP address whitelists and blacklists. We can use VPNs. We can scan logs after the fact, looking for IP addresses that don’t belong. We can’t catch every breach, but we likely can discover some accounts that have been compromised — and some users who can’t be trusted.

Yes, that gets ugly and unpleasant. So does what comes after: the why, the how-bad and the what-to-do-now.

But the alternative is a lot uglier. The results could be lost business and exposed customer information.

Or — as they’re learning in Lancaster — assaults and handcuffs. Frank Hayes, Computerworld’s senior news columnist, has covered IT for more than 20 years. Contact him at frank_hayes@computerworld.com.

IT security goes mainstream at RSA Conference

How will IT security be integrated with physical access control??

"Protection from internal threats, such as accidental or malicious disclosure of confidential information, is expected to be a major topic this week. Websense is expected to unveil its new Content Protection Suite and McAfee also is entering the space crowded with smaller players such as Vontu, Code Green Networks and GTB Technologies."

OK - How will all of those be integrated? Does anyone really believe one company can provide all the answers?

Dynamic Security can integrate these systems if they have an interface...

Feb 6, 2007 3:39 PM

The annual RSA Conference is showing evidence of a maturing information security industry with an increasing role for big-name companies. The event has developed into an annual gathering for corporate IT pros and a showcase for hundreds of companies, small and large, that market security products and services to businesses.

Security is becoming more structured and part of the IT infrastructure at companies, instead of being added on later, analysts tell USA Today. Companies including Oracle, Microsoft, Sun Microsystems, Cisco Systems and Intel are vying for a piece of the pie, which may hurt the smaller industry players, they add.

"There seems to have been a recognition among some of the larger vendors that they can make money with security or, more likely, that they're not going to make any money if they don't have security in the future," said Gartner Analyst Ray Wagner. "That's certainly going to hurt some of the smaller vendors."

Case in point: Database giant Oracle for the first time will have a major presence at the RSA Conference. The company will promote its identity management products as well as software to secure the applications it sells to help large enterprises with things like accounting and human resources. Oracle CEO Larry Ellison is slated to deliver a keynote speech at the San Francisco event.

Microsoft Chairman Bill Gates kicked off the conference Tuesday in a keynote.

"In a lot of ways security is becoming more boring," Andrew Jaquith of the Yankee Group tells USA Today. "But boring is good. Boring means maturation. Boring means you're seeing large companies like IBM have a really rounded out security story. This is good for the mainstreaming of security into the way people run their business."

As products have become more mainstream, so have the RSA attendees. The bulk of the event is geared to less specialized visitors. "Security concerns are moving away from tech geeks with pocket protectors monitoring networks in a back closet somewhere, to something that business managers and more senior folks are concerned with," says George Tubin, an analyst with TowerGroup.

Of the more than 340 exhibitors at the RSA Conference in San Francisco's Moscone convention center, many companies in the security arena are using the event to announce new initiatives, products or product updates.

Protection from internal threats, such as accidental or malicious disclosure of confidential information, is expected to be a major topic this week. Websense is expected to unveil its new Content Protection Suite and McAfee also is entering the space crowded with smaller players such as Vontu, Code Green Networks and GTB Technologies.

VA investigating another missing hard drive

Cybercrime pays and repeats itself. Dynamic Security could protect against unauthorized removal of equipment.

Grant Gross February 05, 2007 (IDG News Service) -- The Department of Veterans Affairs (VA) is investigating a missing hard drive containing the personal records of 48,000 military veterans, the agency said.

The external hard drive contained about 20,000 personal records that were not encrypted, according to information from Rep. Spencer Bachus (R-Ala.). A VA employee reported the hard drive missing from a Birmingham, Ala., agency facility on Jan. 22, according to a VA press release.

The VA and the FBI are investigating the missing hard drive, the VA said in its Friday press release. The VA's Office of Information and Technology is conducting a separate investigation, Secretary of Veterans Affairs Jim Nicholson said in a statement.

"We intend to get to the bottom of this, and we will take aggressive steps to protect and assist anyone whose information may have been involved," Nicholson added.

In May 2006, the VA reported a laptop and hard drive containing the personal records of 26.5 million military veterans and their families had been stolen from an employee's home. Police later recovered the hardware, and the VA said computer forensics tests indicated thieves had not accessed the data. However, the theft set off criticism from several members of Congress about the VA's cybersecurity practices.

The hard drive in Alabama was used to back up information contained on an employee’s office computer and may have contained data from research projects the employee was involved in, as well as personal information, the VA said.

The VA Office of Inspector General has seized the employee’s computer and is analyzing its contents, the VA said. The VA is prepared to notify affected people and provide free credit monitoring, the agency said.

The VA will continue to aim to be a leader in protecting personal information, Nicholson said in his statement.

In August, the VA also reported that a desktop computer containing the personal information of 38,000 veterans was missing from the office of Unisys Corp., the subcontractor assisting at the agency's medical centers in Pittsburgh and Philadelphia.

The lost VA hardware prompted a congressional review of other U.S. government agencies, and agencies reported thousands of l

IT security goes mainstream at RSA Conference

Business Security for business is big business...

IT security goes mainstream at RSA Conference

The annual RSA Conference is showing evidence of a maturing information security industry with an increasing role for big-name companies. The event has developed into an annual gathering for corporate IT pros and a showcase for hundreds of companies, small and large, that market security products and services to businesses. More here

The year 2007: A review through the crystal ball

The year 2007: A review through the crystal ball

It's the season of the end-of-the-year reviews. We have used our crystal ball to jump forwards a year to provide you the ultimate review of 2007 -- here and now.

2007 was the year of the super bots: Never before has malicious software been equipped with so many functions that help it to hide from antivirus software and to resist removal. The majority of malicious software programs used root kits, and their number doubled again on last years figure to over 500. Local privilege escalation vulnerabilities in Windows were increasingly exploited; accounts with restricted user rights were used to gain system rights. Initially, the protective functions in Windows Vista, which has been available for end customers since January, made it more difficult for malicious code to infiltrate the system. The crimeware scene responded and numerous vulnerabilities appeared as the year progressed and these were exploited to cancel or bypass the majority of the security functions. The user account protection (UAC), in particular, proved to be ineffective: Most users just confirmed any respective requests, since they did not undertand the displayed information.

While in 2006, DDoS attacks with botnets were mainly targeted at unwanted competitors, online betting offices and consumer protection sites, 2007 also saw large attacks launched on critical infrastructures. In April, the stock exchange nearly crashed, when a DDoS attack on the electronic trading system disconnected it from the Internet for several days, resulting in automated control programs loosing control and attempting to divest shares in a panic reaction.

When analysing this event, neither law enforcement agencies nor other specialists involved were able to switch off the responsible botnet with its decentralised control. The individual bots communicated with each other in a peer-to-peer structure, similar to those used for file sharing sites; the commands transferred in the Net were encrypted and had a digital signature.

An insurance company suffered significant damages, when a botnet attack cut off all the telephones in the entire company group for two days. While the Voice-over-IP infrastructure proved to yield operational cost savings, this was at the expense of system stability, when vulnerabilities of the SIP protocol were used for targeted attacks. So far, no explanation has been found for why the attacks stopped abruptly after two days; persistent rumours say that a six-digit sum changed hands.

For security software vendors, too, 2007 was a black year: The number of critical holes detected in products that had been designed to provide a higher degree of security was higher than ever before. For instance, various worms used zero-day exploits for holes in antivirus software to find a way into the system during the mail scanning process.

For the first time, underground prices for such zero-day exploits dropped in 2007, compared to the previous year. Insiders think this drop in prices was caused by a glut of such exploits, mainly due to the broad usage of simpler fuzzing tools. Bit by bit, these half-automated vulnerability scanners are uncovering the (security) sins of a whole generation of programmers.

Again, the share of web-based attacks experienced strong growth rates. However, malicious web sites did not so much exploit holes in browsers; rather, they used holes in media player plug-ins and software for Internet Explorer, Firefox and Opera, to infect PCs. The popularity of video portals such as YouTube, MyVideo and ClipFish, as well social networking sites, contributed to this development, with the MySpace worm being the sad culmination. For several weeks, this worm exploited a hole in the Flash Player to infect the PCs of hundreds of thousands of visitors, logged their surf patterns and chat activities and posted this information in public forums.

With many companies starting to migrate to Web 2.0, the security situation changed for the worse: Cross-site scripting holes on web servers became an epidemic plague. Defacing web sites advanced from an insider gag to mass entertainment when Jonathon Ross presented his favorite pages on the sites of Buckingham Palace, the Whitehouse and the Vatican. For a short time, the Xacks archive -- named after a combination from XSS and hack -- had even more page impressions than shooting star YouTube. Meanwhile the ministry of justice announced plans to impose penalties for accessing such manipulating URLs.

Traditional web applications did not get off scot-free either. After the "month of PHP bugs" in March 2007 and the subsequent intrusion into ten thousands of web servers, global web hosters were forced to take their servers off the Net for several days, until updates for the major PHP holes were available. In a study published in June 2007, the US-CERT recommended that PHP should not be used for critical environments. The National Infrastructure Security Coordination Centre advised against the usage of PHP on the servers deployed in state and public institutions and authorities and suggested using Ruby on Rails instead.

Regarding privacy issues, 2007 experienced a continuation of the payback trend: An increasing number of companies tried to buy off the onerous restrictions imposed on the usage of personal data. With attractive offerings, they enticed customers into accepting their terms and conditions that grant the respective providers freedom from restriction in this context. The case of an IP-TV provider, who sold his advertisers profiles containing his customers' viewing behaviours, including names and addresses, led to a public awakening after radical feminists outed two conservative politicians as regular viewers of a porno channel. Since then IP-TV providers have discussed committing themselves to not passing personal data to puckish third parties.

A slip-up also cast a shadow on search engine provider Google: Contrary to their own assertions, the data octopus had analysed and indexed all e-mails processed through their mail service. Due to a mistake made by an administrator, a database of the highly secret project was mirrored onto the external index servers, and as a result, the private mails of thousands of GMail users could be accessed via the search front-end for at least one hour. This event adds weight to warnings against a potential combination of data from the traditional search engine, Google Desktop, Google Analytics, YouTube and other Google services. Whether this will have consequences or not, will be revealed in our year 2008 review.

So let's just hope that our crystal ball is wrong...

Not by Firewalls alone: Firewall vulnerability using the NAT

The same trick can be used by hackers of course...

Jürgen Schmidt

The hole trick

How Skype & Co. get round firewalls

Peer-to-peer software applications are a network administrator's nightmare. In order to be able to exchange packets with their counterpart as directly as possible they use subtle tricks to punch holes in firewalls, which shouldn't actually be letting in packets from the outside world.

Increasingly, computers are positioned behind firewalls to protect systems from internet threats. Ideally, the firewall function will be performed by a router, which also translates the PC's local network address to the public IP address (Network Address Translation, or NAT). This means an attacker cannot directly adress the PC from the outside - connections have to be established from the inside.

This is of course a problem when two computers behind NAT firewalls require to talk directly to each other - if, for example, their users want to call each other using Voice over IP (VoIP). The dilemma is clear - whichever party calls the other, the recipient's firewall will decline the apparent attack and will simply discard the data packets. The telephone call doesn't happen. Or at least that's what a network administrator would expect.

Punched

But anyone who has used the popular internet telephony software Skype knows that it works as smoothly behind a NAT firewall as it does if the PC is connected directly to the internet. The reason for this is that the inventors of Skype and similar software have come up with a solution.

Naturally every firewall must also let packets through into the local network - after all the user wants to view websites, read e-mails, etc. The firewall must therefore forward the relevant data packets from outside, to the workstation computer on the LAN. However it only does so, when it is convinced that a packet represents the response to an outgoing data packet. A NAT router therefore keeps tables of which internal computer has communicated with which external computer and which ports the two have used.

The trick used by VoIP software consists of persuading the firewall that a connection has been established, to which it should allocate subsequent incoming data packets. The fact that audio data for VoIP is sent using the connectionless UDP protocol acts to Skype's advantage. In contrast to TCP, which includes additional connection information in each packet, with UDP, a firewall sees only the addresses and ports of the source and destination systems. If, for an incoming UDP packet, these match an NAT table entry, it will pass the packet on to an internal computer with a clear conscience.

Switching

The switching server, with which both ends of a call are in constant contact, plays an important role when establishing a connection using Skype. This occurs via a TCP connection, which the clients themselves establish. The Skype server therefore always knows under what address a Skype user is currently available on the internet. Where possible the actual telephone connections do not run via the Skype server; rather, the clients exchange data directly.

Let's assume that Alice wants to call her friend Bob. Her Skype client tells the Skype server that she wants to do so. The Skype server already knows a bit about Alice. From the incoming query it sees that Alice is currently registered at the IP address 1.1.1.1 and a quick test reveals that her audio data always comes from UDP port 1414. The Skype server passes this information on to Bob's Skype client, which, according to its database, is currently registered at the IP address 2.2.2.2 and which, by preference uses UDP port 2828.

Step 1: Alice tries to call Bob, which signals Skype.

Bob's Skype program then punches a hole in its own network firewall: It sends a UDP packet to 1.1.1.1 port 1414. This is discarded by Alice's firewall, but Bob's firewall doesn't know that. It now thinks that anything which comes from 1.1.1.1 port 1414 and is addressed to Bob's IP address 2.2.2.2 and port 2828 is legitimate - it must be the response to the query which has just been sent.

Step 2: Bob tries to reach Alice, which punches a hole through Bob's Firewall.

Now the Skype server passes Bob's coordinates on to Alice, whose Skype application attempts to contact Bob at 2.2.2.2:2828. Bob's firewall sees the recognised sender address and passes the apparent response on to Bob's PC - and his Skype phone rings.

Step 3: Alice finally reaches Bobs computer through the hole.

Doing the rounds

This description is of course somewhat simplified - the details depend on the specific properties of the firewalls used. But it corresponds in principle to our observations of the process of establishing a connection between two Skype clients, each of which was behind a Linux firewall. The firewalls were configured with NAT for a LAN and permitted outgoing UDP traffic.

Linux' NAT functions have the VoIP friendly property of, at least initially, not changing the ports of outgoing packets. The NAT router merely replaces the private, local IP address with its own address - the UDP source port selected by Skype is retained. Only when multiple clients on the local network use the same source port does the NAT router stick its oar in and reset the port to a previously unused value. This is because each set of two IP addresses and ports must be able to be unambiguously assigned to a connection between two computers at all times. The router will subsequently have to reconstruct the internal IP address of the original sender from the response packet's destination port.

Other NAT routers will try to assign ports in a specific range, for example ports from 30,000 onwards, and translate UDP port 1414, if possible, to 31414. This is, of course, no problem for Skype - the procedure described above continues to work in a similar manner without limitations.

It becomes a little more complicated if a firewall simply assigns ports in sequence, like Check Point's FireWall-1: the first connection is assigned 30001, the next 30002, etc. The Skype server knows that Bob is talking to it from port 31234, but the connection to Alice will run via a different port. But even here Skype is able to outwit the firewall. It simply runs through the ports above 31234 in sequence, hoping at some point to stumble on the right one. But if this doesn't work first go, Skype doesn't give up. Bob's Skype opens a new connection to the Skype server, the source port of which is then used for a further sequence of probes.

Skype can do port scans. Here it suceeds on port 38901 and connects through the firewall.

Nevertheless, in very active networks Alice may not find the correct, open port. The same also applies for a particular type of firewall, which assigns every new connection to a random source port. The Skype server is then unable to tell Alice where to look for a suitable hole in Bob's firewall.

However, even then, Skype doesn't give up. In such cases a Skype server is then used as a relay. It accepts incoming connections from both Alice and Bob and relays the packets onwards. This solution is always possible, as long as the firewall permits outgoing UDP traffic. It involves, however, an additional load on the infrastructure, because all audio data has to run through Skype's servers. The extended packet transmission times can also result in an unpleasant delay.

Use of the procedure described above is not limited to Skype and is known as "UDP hole punching". Other network services such as the Hamachi gaming VPN application, which relies on peer-to-peer communication between computers behind firewalls, use similar procedures. A more developed form has even made it to the rank of a standard - RFC 3489 "Simple Traversal of UDP through NAT" (STUN) describes a protocol which with two STUN clients can get around the restrictions of NAT with the help of a STUN server in many cases. The draft Traversal Using Relay NAT (TURN) protocol describes a possible standard for relay servers.

DIY hole punching

With a few small utilities, you can try out UDP hole punching for yourself. The tools required, hping2 and netcat, can be found in most Linux distributions. Local is a computer behind a Linux firewall (local-fw) with a stateful firewall which only permits outgoing (UDP) connections. For simplicity, in our test the test computer remote was connected directly to the internet with no firewall.

Firstly start a UDP listener on UDP port 14141 on the local/1 console behind the firewall:

local/1# nc -u -l -p 14141

An external computer "remote" then attempts to contact it.

remote# echo "hello"  nc -p 53 -u local-fw 14141

However, as expected nothing is received on local/1 and, thanks to the firewall, nothing is returned to remote. Now on a second console, local/2, hping2, our universal tool for generating IP packets, punches a hole in the firewall:

local/2# hping2 -c 1 -2 -s 14141 -p 53 remote

As long as remote is behaving itself, it will send back a "port unreachable" response via ICMP - however this is of no consequence. On the second attempt

remote# echo "hello"  nc -p 53 -u local-fw 14141

the netcat listener on console local/1 then coughs up a "hello" - the UDP packet from outside has passed through the firewall and arrived at the computer behind it.

Network administrators who do not appreciate this sort of hole in their firewall and are worried about abuse, are left with only one option - they have to block outgoing UDP traffic, or limit it to essential individual cases. UDP is not required for normal internet communication anyway - the web, e-mail and suchlike all use TCP. Streaming protocols may, however, encounter problems, as they often use UDP because of the reduced overhead.

Astonishingly, hole punching also works with TCP. After an outgoing SYN packet the firewall / NAT router will forward incoming packets with suitable IP addresses and ports to the LAN even if they fail to confirm, or confirm the wrong sequence number (ACK). Linux firewalls at least, clearly fail to evaluate this information consistently. Establishing a TCP connection in this way is, however, not quite so simple, because Alice does not have the sequence number sent in Bob's first packet. The packet containing this information was discarded by her firewall.

10 Security Gotchas that you forgot...

Gotcha, Gotcha, Gotcha. Always forgetting something! Dynamic
Security can handle all these problems. It is like having central locking in
your automobile.

---

The 10 Most Overlooked Aspects of Security

NOVEMBER 29, 2006 | Feel like
you're forgetting something?

Most likely, you are.

Did you post
a surveillance camera in your server room? Check the trash can for discarded
disk drives that weren't wiped clean of sensitive data? Do a deep background
check on that new database administrator you hired? Look into that new
third-party security services offering?

Encrypt the backup of the
year-end financial data?

Gulp. Maybe you're not quite ready for the
holidays.

You'd better watch out. But don't cry, and don't pout, because
you're not alone. Most organizations have at least a few security issues that
have been lost in the shuffle, and it's not too late to give them some
attention.

So, with the help of Dark Reading's editorial advisory board,
we've compiled this list of The 10 Most Overlooked Aspects of IT Security, along
with the risks of skipping out on them, and some advice on how to attend to
them. Our research turned up a wide variety of opinions on these topics, many of
which are environment-dependent, so we're giving you this list in no particular
order. You decide which bases you've got covered -- and which ones need your
attention.

Consider this our contribution to your holiday shopping list.
Post 'em on your blog and the company intranet, pass them on to your colleagues
and business partners, all in good cheer. There is still plenty of time to make
your own list -- and check it twice.

(Editor's note: If there are other
commonly forgotten security measures you've just remembered, we'd love to hear
about them. Please send comments via the message board associated with this
story, not by email. All postings are completely anonymous.
Enjoy.)

Contents:

• Page 2: Physical
  security
  
• Page 3: Proper
  disposal of devices, storage media, and sensitive
  documents
  
• Page 4: Background
  checks
  
• Page 5: Getting
  control of the at-home user
  
• Page 6: Taking
  advantage of built-in security functions
  
• Page 7: Analyzing
  trends in security log files
  
• Page 8: Training
  
  
• Page 9: Outsourcing
  of security functions
  
• Page 10: Encryption
  
  
• Page 11: Integration
  of security with software development
  

— The Staff, Dark
Reading

Next Page: Physical
security

US Military Roadmap: 'Fight the Net

 IT Security Problems Recognized by the Military

US Military Roadmap: 'Fight the Net' 

JANUARY 30, 2007 | Ground operations, air operations, maritime operations -- and now, information operations? That's right -- the U.S. military wants to add information operations as a new military core competency, according to a newly declassified Defense Department document called the "Information Operations Roadmap." The 78-page document, written in October 2003 and signed by former Defense Secretary Donald Rumsfeld (complete with blacked-out blocks of classified text), was obtained via the Freedom of Information Act by the National Security Archive at George Washington University and reported by BBC News. It provides a sneak-peek into the military's ambitious goals for information operations: using/fighting the Internet, improving psychological operations (psyops), and dominating the electromagnetic spectrum. Bottom line: Information is crucial to the military's success.

"Fight the Net" is a major recurring theme of the document. Given the rise in hacker and cybercrime risks to U.S. businesses, the military should fight the Internet as if it were an "enemy weapons system," the document says. It also points out that networks are becoming more vulnerable and calls for a defense-in-depth strategy for "providing Combatant Commanders with the tools necessary to preserve warfighting capability." The document hints about the use of "offensive cyber tools" and computer network attacks as well as integrated weapons systems, but much of that section is classified, and therefore sketchy. Sean Kelly, business technology consultant with Consilium1, says the "fight the net" campaign is the wrong approach. "I agree that our Defense Department needs to have strong security strategies for defending our information systems -- especially intelligence databases, as well as key communications channels," Kelly says. "I would hope that our Defense Department would employ some of the best and brightest network security professionals to develop a strategy that identifies and protects -- through monitoring and taking action where necessary, [a] good old fashioned incident response program -- high-risk areas of its own networks as well as on the Internet." The military's IO Roadmap also includes improving psyops, which today are more "reactive" and "not well organized," according to the document, including better using technology -- radio, television, print, and Web -- to spread the word.

But one of the most compelling issues in the roadmap was the military's interest in getting control of the electromagnetic spectrum. "To prevail in an information-centric fight, it is increasingly important that our forces dominate the electromagnetic spectrum with attack capabilities," according to the document. Kelly says controlling the electromagnetic spectrum is extreme. "Instead of taking an 'us against the world' approach, we should be collaborating with other nations to identify threats and develop a plan address known vulnerabilities," he says. "We can decide how we want to defend our internal interests and network infrastructure, but we should not be seeking the ability to have full control over the electromagnetic spectrum." Defense Department officials were not available for comment in time for this posting.