Cyber Vision 2025: Air Force Cyber S&T Vision

Cyber Vision 2025:Air Force Cyber S&T Vision tinyurl.com/cybervision Dr. Mark T. Maybury Chief Scientist United States Air Force 14 March 2012 Distribution A. Approved for public release; distribution is unlimited. Public Release Case No 2012-XXX

National Cyber Security “We count on computer networks to deliver our oil and gas, our power and our water. We rely on them for public transportation and air traffic control… But … we've failed to invest in the security of our digital infrastructure “ President Barack Obama, 29 May 2009 “The most menacing foreign intelligence threats in the next two to three years will involve cyber-enabled espionage … insider threats … and espionage by China, Russia, and Iran.” Lt. Gen James Clapper, Jr. USAF (Ret), DNI, 31 Jan 2012 “On the global technology front, rapid advancement in communication has spread knowledge around the world, leveling competition and causing us to work harder to maintain U.S. advantages, making us more interdependent with international partners.” Michael Donley, Secretary of the Air Force, Nov 19, 2009 “We have certain industrial, design and engineering advantages, and if they are surreptitiously obtained by others, it reduces those advantages. Gen Norton A. Schwartz, Chief of Staff, USAF 27 Feb 2012“Cyberspace superiority describes our mission to gain advantage in, from, and through cyberspace at the times and places of our choosing, even when faced with opposition.” Gen William Shelton, AFSPC/CC, AFCEA Cyber Symposium, 7 Feb 2012

Cyber Vision 2025Terms of Reference ideachampions.com DOTMLPF - Doctrine, Organization, Training, Materiel, Leadership and education, Personnel, and Facilities • Background: • Need to forecast future threats, mitigate vulnerabilities, enhance the industrial base, and develop the operational capabilities and cyber workforce necessary to assure cyber advantage across all Air Force mission areas • An integrated, Air Force-wide, near-, medium- and far-term S&T vision to meet or exceed AF cyber goals and, where possible, create revolutionary cyber capabilities to support core Air Force missions • Key Stakeholders: Air Staff, MAJCOMS, AFRL, 24th AF, ESC, ASC, SMC • Approach • Identify state of the art and best practices in government and private sector • Analyze current and forecasted capabilities, threats, vulnerabilities, and consequences across core AF missions to identify critical S&T gaps • Articulate AF near (FY11-16), mid (FY16-20) and long (FY21-25) term S&T to fill gaps, indicating where AF should lead, follow, or watch • Address cyber S&T across all Air Force core missions and functions (air, space, C4ISR) comprehensively including policy as well as DOTMLPF considerations • Engage and partner (industry, academia, national labs, FFRDC, government) • Product: Cyber S&T Vision to top 4 by 7/15/12 (Report 1/1/13)

Cognitive Systems Social Systems Information Systems A Wicked Problem Dynamic,Real TimeConflicting Rapidly changing and ambiguous phenomena and human behavior, potentially competing objectives Fluid, Evolving, Contested, Congested, Competitive Decision Making Environment Mission Environment Stable systems and environment; shared cyber goals across organizations StaticUniform Static,Uncontested System Behavior Multiple actors Can’t observe/understand all behavior Do not necessarily follow predictable rules of behavior; unintended consequences Interact with environment and evolve Behavior is regular, well understood and, to a large extent, predictable Relatively closed to the environment Components not purposeful; exist only as part of larger system Linear Complex Multiple stakeholders, increasing threat, increasing complexity, greater uncertainty, rapid evolution (SAF PA Case # 2011-0033)

A Perfect Storm >80% in 2010 Internet Adoption Technology Change Threat Complexity 286M+Threats in 2010 6 million probes/day in 2011 Connectivity Foreign Supply Mobile Internet Adoption (>60% in 2010) 20-120M LOC in 2010 7M nodes in 2011 20k in 2004 Years 5.1k in 2010 Vulnerabilities 6.7k in 2007 nvd.nist.gov % outsourcing 20-50% Overruns (GAO) Cost Overruns 3.5M computers, 120k circuits in GIG in 2005 BS Production (CS and CE) weeks 8k in 1998 4.6k in 2005 11k in 2011 9k in 2009 -5% program managers <10% Overruns in 1950s Expert Staff -12% production engineers 1.7 k in 2001 -20% financial managers ResponseTimelines 1M LOC in 1998 Seconds 50K viruses in 2000 1998 2000 2002 2004 2006 2008 2010 2012

DRAFT Bold Responses Autobahn Eisenhower Sputnik Kennedy 1969 National Cyber security Initiative Bush/Obama DRAFT http://cdn1.iofferphoto.com/img/item/695/510/36/o_autobahn1.jpg thenewnewinternet.com Aerospace.orhttp://www.mamapop.com/wp-content/uploads/2010/09/moon-armstrong.jpgg

DRAFT Cyber S&T Vision REQUIREMENTS AND PLANS MISSION FOCUS STRATEGY MAJCOM Requirements Air Cyber Space Cyber Cyber Vision United States Air Force CyberS&T Vision2011-2026 AF/ST TR 12-0131 December 2012 Cyber (C2, IT, Comms) Independent Senior Expert Review C2ISR Cyber Mission Support(A1, AQ, A6, M&S, Critical Infrastructure) Cross Cutting Enabling S&T RFIs, EXPERT SUMMITS DRAFT

Cyber Vision Team • Senior Governance Team (3*) • Dr. Mark Maybury (chair), Lt Gen Mike Basla (AFSPC/CV –> SAF/CIO A6), Lt Gen Janet Wolfenbarger (SAF/AQ), Lt Gen William Lord (SAF/CIO A6), Lt Gen Larry James (AF/A2), Lt Gen Chris Miller (AF/A8) • Key Senior Stakeholders • Lt Gen Charles Davis (ESC/CC, AFPEO C3I and Networks), Lt Gen Ellen Pawlikowski (SMC), Maj Gen Ken Merchant (AAC), Lt Gen Thomas Owen (ASC), Lt Gen “Hawk” Carlisle (A3/5), Maj Gen Neil McCasland (AFRL), Maj Gen Suzanne Vautrinot (24th AF), Maj Gen Mike Holmes (A3/5), Dr. Steve Walker (AQR), Dr. Jackie Henningsen (A9), Lt Gen(Sel) John Hyten (AQS –> AFSPC/CV), Maj Gen Robert Otto (AFISRA/CC), Maj Gen(Sel) Samuel Greaves (AFSPC/A8/9) • Cyber S&T Mission Area Study Leads • Air: Dr. Kamal Jabbour (AFRL/RI), Dr. Don Erbschloe (AMC), Mr. Bill Marion (ACC) • Space: Dr. Doug Beason (AFSPC), Col Brad Buxton (SMC) & Dr. Jim Riker (AFRL/RV) • Cyber: Dr. Rich Linderman (AFRL/RI), Dr. Doug Beason (AFSPC) & Mr. Arthur Wachdorf (24th) • C2ISR: Dr. Steven K. Rogers (AFRL/RY), Mr. Ron Mason (ESC), Mr. Stan Newberry (AFC2IC), Dr. Chris Yeaw (AFGSC), B Gen Scott Bethel (AFISRA/CV), B Gen (S) John Bansemer (AFISRA/CVA), DISL Keith Hoffman (NASIC), Dr. Rick Raines (CCR, AFCyTCoE) • Mission Support (Talent, Training, Acquisition, Infrastructure): Dr. Steve Walker (AQR), Maj Gen Tom Andersen (LeMay Center), Mr. Mike Kretzer (688th), Dr. Nathaniel Davis (AFIT), BG Dwyer Dennis (AFMC/A2/5) • Enabling Technology: Dr. Jennifer Ricklin (AFRL), Dr. Robert Bonneau (AFOSR) • Threat: Mr. Gary O’Connell (NASIC), Col Matthew Hurley (AF/A2DD)

DRAFT DRAFTSenior Independent Expert Review Group (SIERG) DRAFT

Key Events 18-20 Jan – Preliminary Air-Cyber Mission Meeting – Edwards AFB 23 January – Threat Workshop (SCI), Washington, DC (7-9 Feb, AFCEA Cyber Conf, Colorado Springs) Air-cyber: 8 Feb (Scott AFB), 9 Feb (Langley) 8-9 Feb 24th AF/US Navy Cyber Tech Summit, Colorado Springs, CO 24 Feb – RFI Input Due (See www.tinyurl.com/cybervision) 29 Feb – 2 Mar – West Coast Industry Visit for team leads 5-9 March – AFOSR Computational Sciences Review, DC 12-13 March – Air Workshop, Langley 14-15 March – C2ISR Workshop, Langley 19-21 March – Space-Cyber, Cyber, S&T Workshops, AFSPC, Peterson AFB 22-23 March – AFA Cyber Futures Conference, Gaylord, DC 27 March - Mission Support Summit, DC 28 March - AF-DoE Cyber Summit, ORNL 29 March - DARPA Cyber PM Briefs to CV25 Mission Leads TBD April – NSA/CYBERCOM Day, Ft Meade 10 April @SAFTAS- Senior Independent Expert Review Group – Slide Review 9 May @SAFTAS - Senior Independent Expert Review Group – Doc Review

Disinformation, distraction, confusion Insider attack, unwitting behavior Data and policy corruption Disruption of C2, behavior manipulation Code manipulation, malware Induced inaccuracies and failures Denial of service, exfiltration Worms, viruses, flooding Life-cycle implants of backdoors Triggered malfunction, performance loss Loss of communication Physical destruction, eavesdropping Elements of Contested Cyber TARGETS ATTACKS EFFECTS Human Organization Command and Control Formation Sensor Processing Mission Layer Application Layer OS/Network Layer HW/Systems Layer • Materials, Devices & Comm. Links 11

Partnership and Focus COCOMs CYBERCOM Intelligence Community NSA, CIA, NRO, FBI, IARPA Army, Navy, Marines Land and Maritime cyber National Labs Air, Space, C4ISR Federal Research DARPA, NSF, FAA, OSTP, NASA FFRDCs Critical Infrastructure DHS, EPRI, Utilities Industry & Consortia (e.g., DIB Pilot) Academia Air Force will leverage cyber capabilities and investments of our partners and focus S&T investment on Air Force missions

DRAFT Principles & Practices DRAFT • Principles • Least Privilege (e.g., white listing, discretionary access control) • Balance of power (e.g., distribution of authority, peer review, two person rule) • Minimization – limit attack surface, limit dependencies, reduce capability to essentials • Simplification – Pursue only necessary complexity • Resiliency (flexibility, rapid reconstitution, active defense), Robustness (e.g., redundancy), and Readiness (e.g., intel/situational awareness, training) • Diversity • Speed (responsiveness) , Agility, and Evolvability • Balance (Offense/defense, human creativity and machine intelligence, confidence/control) • Cost and efficiency • Practices • Systems, e.g., redundancy, diversity, roots of trust (hardware and software, supply chain) • Architectures, e.g., loose couplers (avoid brittleness) • Acquisition, e.g., clear/focused requirements, early/continual user/test involvement, early prototyping and rapid cycles for evolution, modular/open standards, model driven archs • Information, e.g., chain of custody, encryption at rest/in motion • Operations, e.g., fractionated authority, cyber hygiene • People, e.g., accessions, education and training, deep experience

DRAFT AF Cyber S&T Vision DRAFT “Assured cyber advantage across air, space, cyber, C2ISR, and mission support” Assured – Ensured operations in congested, competitive, contested, and denied environments in spite of increased dependencies, vulnerabilities, and threats Cyber – its defense, exploitation, operation Advantage – we seek a speed, agility, and effectiveness edge over our adversaries to ensure operational dominance Across – we require superiority within and across Air, space, cyber, C2ISR, mission support – we require full spectrum cyber solutions

DRAFT AF Core Mission Prioritized S&T Roles DRAFT Technology Leader – Creates or invents novel technologies through research, development and demonstration. Key S&T for core Air Force Title 10 missions and associated platforms with few or no other investors outside of the Air Force, e.g., IADS Fast Follower– Rapidly adopts, adapts or accelerates technologies originating from external leading organizations, e.g., hardening DoE’smicrogrids Technology Watcher– Uses and leverages others S&T investments for non core missions, e.g., generic IT

BACKUP Slides

What is Out of Scope? • In: • Cyber exploitation, defense, operations • Cyber security of communications, data links, power • OSD (R&E) Priority Steering Committees – Cyber, Data to Decisions, Autonomy and cyber aspects of Human Systems and Resilient Systems Engineering (but not Countering WMD, EW/EP) • Out: • Commodity commercial IT infrastructure and communications • Spectrum allocation and/or management – except for application to use of cyber methods for spectrum protection • Electronic warfare • Directed energy - lasers or high power microwave for sensing or communication

Software Challenges Source: SEI, LM Increasing % of mission systems software (air, space, cyber, C2ISR) Large (10s of millions SLOC) and complex - (dependencies) Acquisition difficult - 46% over budget (by 47%) or late (by 72%); Successful projects have 68% specifications Scarce Talent

Cyber Trends (top500.org) Source: www.dodlive.mil • Bigger: HPC: Petascale to exascale • Programmable, performance (peta to exa), green • Smaller: Nanoelectronics (e.g., nanowires, memristers) • Diverse: Clusters, clouds, GPUs, FPGAs • Embedded: 4.5M LOC in F-35, 90% of functionality • More contested and dangerous: Advanced threat, insider threat, supply chain • More competitive: global hardware, software, talent • More complex: Interconnected • Greener: infrastructure and algorithms • Less US talent: STEM Challenge

DoD Cyberspace Strategy Source: DoD Strategy for Operating in Cyberspace, May 2011

Cyber JCTDs Non Persistent Desktop Browser (NPDB) Protection and Operation of IP Secure Network Terrain (POINT) DISA Mission Assurance Decision Support System (MADSS) Computer Adaptive network Defense in Depth (CANDID) Smart Power Infrastructure Demo for Energy Security and Reliability (SPIDERS) Cross Domain Collaboration Information (CDCIE)

Executable Lines of Code in Mission Systems Sources: CARD Data, SEI, CSIS Analysis. Fig 7 from 2009 DSB TF on IT Acquisition

Adoption Acceleration Source: http://visualecon.wpengine.netdna-cdn.com/wp-content/uploads/2008/02/history-of-products.gif See also: http://www.karlhartig.com/chart/techhouse.pdf

Cyber Vision 2025: Air Force Cyber S&T Vision