The Cyber Challenge Lessons Learned from the Department of Energy Rolf Mowatt-Larssen Senior Fellow Belfer Center, Kennedy School of Government, Harvard University March 22, 2011

National Cyber Strategy – a Maginot line? How question arose….my own experience Statement of the problem- two cyber summits External assessment -national cyber plan Internal assessment - DOE strengths and vulnerabilities What needs to be done? Cyber triage Protect the crown jewels Integrate the offense and the defense Revise the cyber investment model

DOE Stakeholder $24+ billion dollars, 100k+ people 50K clearances National laboratories R&D DOE Core Nuclear weapons – the crown jewels Science Scientific and technological innovation, R&D High speed computing Energy Life sciences Cyber-related assets Scope of intelligence work Intelligence community role Field intelligence elements Work for others – trend line

Cyber Summit Opening Remarks September 26, 2007 “Never looked at the whole (cyber) problem…” “(We have)..a process orientation, not a mission orientation.” “Take out a blank sheet of paper - how can we protect DOE? Articulated risk-taking..rank order what needs to be protected, and draw a line on what cannot be protected.” “Our science mission is highly dependent on speed, transparency of communications…the national framework can jeopardize that mission, if it imposes a framework that is in conflict with that.”

Cyber Summit Opening Remarks “The defense must be informed by the offense. If not, we don’t have a prayer. The offense is killing the defense.” defense $ offense time

External Assessment National strategy lacks strategic policy input and civilian/political framing/boundaries Muddled thinking Ad hoc --tools development Blur -- cyber war and peace Gray areas -- authorities and jurisdictions Offensive bias – assumption of cyber dominance “Let’s not kid ourselves…our adversaries are doing the same to us…jumping the air gap.” Inverted pyramid of risks – highest priority risks are getting least amount of attention

Assessing Cyber Threats – Three Conceptual Flaws Risk = Intent X Capability X Consequences 1. $ drives the train! 2. Technical assessment of vulnerabilities/risks trumps actor-specific (intelligence) judgments 3. Threats posed by actors are not assessed holistically, in context of cyber serving as means to ends

Internal Assessment Priorities are misaligned to risks – threat pyramid is inverted Resources and attention paid to least defendable, lowest value assets Cyber threats viewed as technical challenge, vice actor-based Competitive business model limits cooperation between laboratories Offense and defense segregated Investment process - “wine by the glass” Multi-lab work on “grand challenges” lacking Limited investment for long term cyber R&D Badly stove piped bureaucracy due to compartmentation , competing cultures and objectives

Hurwitz’ Model in DOE National Security Markets Individuals Capabilities Infrastructure Tools Threats $ Biz model Scientific culture Cooperation Competition Intellectual property Need to know Proprietary Transparency Multi-year Single year Project Multi-lab Single lab Expert Crossover between domains produces uneven results: Tactical vice strategic Stovepiped Insufficient expert results bureaucracy collaboration

What needs to be done? Establish role for DOE in developing and implementing national cyber strategy Develop an integrated cyber architecture within DOE Harmonize/synchronize with individual programs, missions and constituencies within DOE and external customers (including Congress) Cyber policy (CIO) Security Intelligence Science Infrastructure protection

Getting Priorities Right Cyber triage Simplification, leadership and follow-through Continually assess progress in seven areas Protect the crown jewels – define the core Define the scale of value Define the cyber threat statement Define the protective systems Infrastructure protection Cyber research and development Strengthen the defense Internal and external communications strategy - garner policy support for determining acceptable level of risk

Longer Term Planning Develop national policy and doctrine vis-à-vis cyber war, deterrence, defense Zero base cyber priorities and realign resources to risks/threats as matter of policy Integrate offense and defense into a single strategy Adopt principle – offense must inform defense A focus on information and “best practices” sharing between offense and defense Modify the cyber business/investment model Defining cyber grand challenges Long term investments in infrastructure, not tools R&D - what are the game changers?