1. The Cyber Challenge Lessons Learned from the Department of Energy
Rolf Mowatt-Larssen
Senior Fellow
Belfer Center, Kennedy School of Government, Harvard University
March 22, 2011

2. National Cyber Strategy – a Maginot line?
How question arose….my own experience
Statement of the problem- two cyber summits
External assessment -national cyber plan
Internal assessment - DOE strengths and vulnerabilities
What needs to be done?
Cyber triage
Protect the crown jewels
Integrate the offense and the defense
Revise the cyber investment model

3. DOE Stakeholder $24+ billion dollars, 100k+ people 50K clearances
National laboratories
R&D
DOE Core
Nuclear weapons – the crown jewels
Science
Scientific and technological innovation, R&D
High speed computing
Energy
Life sciences
Cyber-related assets
Scope of intelligence work
Intelligence community role
Field intelligence elements
Work for others – trend line

4. Cyber Summit Opening Remarks September 26, 2007
“Never looked at the whole (cyber) problem…”
“(We have)..a process orientation, not a mission orientation.”
“Take out a blank sheet of paper - how can we protect DOE? Articulated risk-taking..rank order what needs to be protected, and draw a line on what cannot be protected.”
“Our science mission is highly dependent on speed, transparency of communications…the national framework can jeopardize that mission, if it imposes a framework that is in conflict with that.”

5. Cyber Summit Opening Remarks
“The defense must be informed by the offense. If not, we don’t have a prayer. The offense is killing the defense.”
defense $
offense
time

6. External Assessment
National strategy lacks strategic policy input and civilian/political framing/boundaries
Muddled thinking
Ad hoc --tools development
Blur -- cyber war and peace
Gray areas -- authorities and jurisdictions
Offensive bias – assumption of cyber dominance
“Let’s not kid ourselves…our adversaries are doing the same to us…jumping the air gap.”
Inverted pyramid of risks – highest priority risks are getting least amount of attention

8. Assessing Cyber Threats – Three Conceptual Flaws
Risk = Intent X Capability X Consequences
1. $ drives the train!
2. Technical assessment of vulnerabilities/risks trumps actor-specific (intelligence) judgments
3. Threats posed by actors are not assessed holistically, in context of cyber serving as means to ends

9. Internal Assessment
Priorities are misaligned to risks – threat pyramid is inverted
Resources and attention paid to least defendable, lowest value assets
Cyber threats viewed as technical challenge, vice actor-based
Competitive business model limits cooperation between laboratories
Offense and defense segregated
Investment process - “wine by the glass”
Multi-lab work on “grand challenges” lacking
Limited investment for long term cyber R&D
Badly stove piped bureaucracy due to compartmentation , competing cultures and objectives

10. Hurwitz’ Model in DOE National Security Markets Individuals
Capabilities Infrastructure Tools
Threats $ Biz model Scientific culture
Cooperation Competition Intellectual property
Need to know Proprietary Transparency
Multi-year Single year Project
Multi-lab Single lab Expert
Crossover between domains produces uneven results:
Tactical vice strategic Stovepiped Insufficient expert
results bureaucracy collaboration

11. What needs to be done?
Establish role for DOE in developing and implementing national cyber strategy
Develop an integrated cyber architecture within DOE
Harmonize/synchronize with individual programs, missions and constituencies within DOE and external customers (including Congress)
Cyber policy (CIO)
Security
Intelligence
Science
Infrastructure protection

12. Getting Priorities Right
Cyber triage
Simplification, leadership and follow-through
Continually assess progress in seven areas
Protect the crown jewels – define the core
Define the scale of value
Define the cyber threat statement
Define the protective systems
Infrastructure protection
Cyber research and development
Strengthen the defense
Internal and external communications strategy - garner policy support for determining acceptable level of risk

13. Longer Term Planning
Develop national policy and doctrine vis-à-vis cyber war, deterrence, defense
Zero base cyber priorities and realign resources to risks/threats as matter of policy
Integrate offense and defense into a single strategy
Adopt principle – offense must inform defense
A focus on information and “best practices” sharing between offense and defense
Modify the cyber business/investment model
Defining cyber grand challenges
Long term investments in infrastructure, not tools
R&D - what are the game changers?