Information Warfare in the Trenches
Experiences from the FiringRange
Scott D. Lathrop, Gregory J. Conti, Daniel J. Ragsdale
U.S.MilitrayAcademy, West Point, NY10996
Abstract:With the increased potential of a bona fide cyber terrorist attack and the possibility of a future “war in the wires”, we must continue to improve the education and training of individuals responsible for defending our national borders—whether those borders are physical or electronic. The Information Analysis and Research (IWAR) laboratory at the United States Military Academy (USMA) has proven to be an exceptional resource for such an education for our cadets and faculty studying information warfare and information assurance. The laboratory has also been successful in motivating the need for continued education and training in this area on a much larger scope. This paper justifies why information warfare laboratories are necessary, describes the phenomenon that is occurring as a result of the IWAR lab, explains the current configuration, and presents lessons learned that others might use in designing an Information Warfare laboratory. While this paper has a military context, the results apply to any university, corporation, or non-profit organization desiring to increase awareness and improve education in the area of information warfare
Key words:Information warfare, information assurance, education, educational laboratories
1.INTRODUCTION
Two years ago, the Information Technology and OperationsCenterdeveloped the initial Information Warfare Analysis and Research (IWAR) laboratory to support undergraduate education and faculty research in Information Assurance (IA) at the United States Military Academy (USMA). Since that time, it has matured into a much larger and robust laboratory. What began as a single, isolated network has matured into three separate networks and a library. Each component has a distinct purpose but all are aimed at furthering education in Information Assurance at USMA and throughout the IA community. With the increase in size and scope of the laboratory, technical and social issues in manageability have risen.
The original purpose of the IWAR laboratory focused on providing an isolated laboratory where students enrolled in our Information Assurance course could familiarize themselves with various known computer security exploits and employ technical measures to defend their network against such exploits. Additionally, the laboratory provided a facility for faculty members to conduct research in Information Assurance. [1] Currently, the laboratory serves not only the Information Assurance course which is limited to computer science and electrical engineering majors, but also provides a “clubhouse” atmosphere for our ACM SIGSAC student chapter; supports the annual CyberDefense Exercise (CDX) conducted with the other military institutions of higher learning and in conjunction with the NSApenetration teams, the 1st Information Operations Command, and the Air Force 92d Information Warfare Squadron [2]; is used as a focal point for congressional, academic, military, and other visitors interested in observing or replicating our work; and is used for information warfare demonstrations during a once-per-semester “Techtour” for the freshman students. The purpose of this demonstration is to motivate the plebes to take advantage of the laboratory and IA course while they are at West Point.
There are several other courses at USMA that use the laboratory in addition to the computer science-based, Information Assurance course. Almost every CS course uses the laboratory for computer security related lessons. A political science course entitled, “The Policy and Strategy of Cyberwar” uses the IWAR laboratory exclusively as their classroom in order to demonstrate the technologies that common hackers and cyber-terrorists use to gain access to computing resources and then to relate those experience to strategic level policy issues. The Cyber Policy course includes hands-on exercises where the students build viruses, worms, and malicious applets. The “Cyber Law” course uses the laboratory for a lesson to give pre-law students an appreciation of the tactics and techniques used by cyber-criminals. Finally, the IWAR laboratory provides facultywith a facility to learn about emerging information warfare. Computing infrastructure upgrades and initiatives often begin in the IWAR laboratory before inflicting them on the user base. For example, the laboratory has been used to install a Windows 2000 Active Directory infrastructure before deploying it on a larger scale. It has been also used to familiarize, test, and validate wireless security solutions prior to decisions being made on whether or not to install a wireless network. What was originally designed primarily for a single undergraduate class has blossomed into an institution-wide resource, but with that has come additional administrative overhead and technical requirements.
The intention of this paper is to provide an overview of the current state of the laboratory, the methodology used to obtain this condition, impart lessons learned to managing the increased overhead of others considering such an endeavor, and discuss future improvements.
2. BACKGROUND AND MOTIVATION
It can be argued that education in information warfare is paramount for the students at the United StatesMilitaryAcademyand the other military institutions of higher learning. Nearly a year ago, the Secretary of Defense summarized a long-standing national discussion when he stated that our dependency on information networks makes attractive targets for new forms of cyberattack. [3] In the recent Department of Defense Report to Congress, the assertion was made that “In the future, the network will be the single most important contributor to combat”. Furthermore, the report asserted the information domain must be protected and defended in order to generate and sustain combat power in the face of offensive actions taken by an adversary.[4] With the military’s increased reliance on information systems coupled with the cyber-coordinated events of September 11th 2001, the reasons for educating our students in information warfare are readily apparent.
Current systems being developed by the Army depend on this network-centric warfare concept. For example, Land Warrior is a wireless networked system of computers. Each infantry solider in a 30-soldier platoon wears a personal computing device that communicates with other soldiers in the platoon through a wireless local area network (LAN). The system enables the exchange of terrain, enemy, and friendly information; digital maps; operations orders; and e-mail messages between the soldiers in order to facilitate information dominance.[5][6] Such systems also are to provide a “just-in-time” logistics framework, enabling supplies such as ammunition and food to be pushed forward as the information indicating a logistics shortfall is autonomously sent to the supply forces. These systems will connect into the Army’s tactical Internet. Without technically savvy soldiers and an information structure designed to protect and defend these critical assets, the Army’s reliance on information dominance is a fragile one.
Consider the fact that the Code Red worm infected more than 250,000 systems in approximately nine hours on July 19, 2001.[7] Had even one percent of those computer systems been military end systems such as Land Warrior, rather than commercial or home-based computers, the effects would have been to cripple the unit’s reliance on such systems—infrastructures which our doctrine advocates as being a combat multiplier by increasing situational awareness (that is the ability to spatially and temporally know where the enemy is and where friendly units are). If such systems are denied service, or worse compromised, then clearly information dominance is no longer established. The future of the military’s information dominance on the battlefield hinges on the security of the networked information systems providing the necessary services—thus, the increased requirement that future officers educated at the military institutions of higher learning become aware of such issues and their potential solutions.
The issues in assuring our information are much larger than just what the military foresees. Our nation’s critical infrastructures and economic structure are becoming increasingly reliant on information systems and the Internet that provides connectivity between such systems. Addressing these issues requires an education in information warfare that does not merely theorize and describes such concepts. A hands-on, active learning experience entails that we provide an environment where students, employees, and anyone managing or administrating information systems can apply theoretical concepts in an isolated environment [8]. Such an environment allows the unleashing of viruses, worms, and Trojan horses so as not to have an effect on a production network. Kaucher and Saunders found that even for management-oriented graduate courses in Information Assurance, a hands-on, laboratory experience enhances the students understanding of theoretical concepts [9]. The above reasons justified the original creation of the IWAR laboratory and validate continued expansion and improvements to the laboratory.
Recent success in the Cyber Defense Exercise and the educated, yet tough, information assurance questions coming from our former students further justify the usage and improvements to the IWAR laboratory. OurCyber Defense team showed vast improvement between the first and second years of the competition. The Cyber Defense Exercise (CDX) is an annual competition between the United States Military, Naval, Air Force, Merchant Marine, and Coast Guard Academies. At USMA, the competition serves as the final project for senior-level computer science majors enrolled in the Information Assurance (IA) course. Participating students are required to design, implement, configure, and secure a network of computers. Required services are determined by the exercise’s operation’s order and allowed red team attacks are controlled by a set of rules. After verifying all services are running, the students must secure that network using open source tools. Each school’s network is then attacked by members of the NSA’s red team, the Army’s 1st Information Operations Command, and the Air Force’s 92d Information Warfare Aggressor squadron while the students attempt to maintain the required services; prevent and detect attacks; and then recover and restore any loss of information or services.
The main goal of the CDX is to reinforce the knowledge that students have acquired in academic courses addressing the protection and defense of information systems. To take part in the exercise, the participating students are required to design and implement a security plan for a network comprised of various operating systems, services, and applications. Their plans must address the issue of maintaining confidentiality, integrity, availability, and authentication of all services and resources. The National Security Agency’s Director of Information Assurance sponsors the event and awards a trophy to the school with the best overall showing in the competition. The trophy is a traveling award that resides at the winning school for a given year.
In the first CyberDefense exercise, our students struggled to maintain services and provide security simultaneously. Much of their effort was aimed at maintaining the required services leaving little time for analysis and improvements in their defensive plan. [2] In the recently completed 2002 CyberDefense exercise, the students not only maintained the majority of the required services throughout the exercise, but also had a very high success rate in defending their network from the red team. Not only did they secure the network with the tools and technologies learned during their course work, but they also were able to explore various other security options such as Bastille Linux, one-way Ethernet cables for intrusion detection systems, and honeypots. A majority of their success is due to the fact that both students and faculty had access to a facility such as the IWAR laboratory and even more of an opportunity to work with the various technologies such as firewalls, vulnerability scanners, system integrity tools, and intrusion detection systems that are required to defend such a network.
Another recent example, which validates the continued usage and improvements to the IWAR laboratory, are the experiences a former student, now an Army second lieutenant, had when attempting to determine a technical solution to a typical information assurance issue in determining the appropriate balance between service and security. The problem the lieutenant was trying to solve was providing access to .mil sites from IP addresses originating from within the Republic of Korea (ROK). Soldiers in the lieutenant’s organization were attempting to take continuing education courses offered on-line through the Army’s .mil portal. However, the soldiers could not access the sites through their ASDL and cable modem connections from their homes located off Army installations. The problem had existed since the September 11th, 2001 attack on the WorldTradeCenter, when the Army decided to block access to all .mil sites from IP addresses originating from within the Republic of Korea and from several other foreign countries. Therefore, soldiers could only take the online courses from computers, which were on a military installation. The security solution imposed by the Army defeated the purpose of after-hours education for those soldiers living off an Army installation in any oversea location. [10]
The lieutenant, based on his experiences in the IA course and specifically, in the IWAR laboratory, realized that technical solutions should exist (VPN, PKI, proxy servers, etc) that would both provide soldiers with access to .mil URLs while simultaneously protecting the Army servers in Korea. The lieutenant fielded the question with a proposed, well-informed solution to the USMA IA faculty and Computer Emergency Response Team (CERT) who made minor changes to the lieutenant’s solution and then proposed an Army-wide recommendation for overseas units.
Such examples highlight that the experiences learned in the IWAR laboratory directly translate to solutions in real world applications. The IWAR laboratory component of the IA educational program at West Point provides a much richer experience for students than what classroom instruction alone could provide.
3.RELATED WORK
Primarily due to the increasing importance of IA education, many colleges and universities are beginning to invest resources towards the construction of information security laboratories. [9, 11, 12] Others have been looking at using simulation-based tools to educate their students. [13] To the best of our knowledge, no one has attempted to design and implement a laboratory on the scale or complexity currently exhibited by the IWAR laboratory. Others have created laboratories, primarily to serve different purposes, but none have the similar heterogeneous nature or scale that the IWAR demonstrates.
Kaucher and Saunders describe an Information Assurance laboratory that they use at the NationalDefenseUniversity for educating information assurance and information security professionals. Their network serves a different purpose and thus does not need to be the same scale or complexity as we have built into the IWAR laboratory. Similar characteristics include a heterogeneous network. One of the unique features of their network is that they expose the entire network to their students. This works well for their particular situation, as their students often need to see the entire network to “demystify the technology.” [9] However, for this particular application major portions of the network are not revealed to the computer science and electrical engineering majors taking the IA course. This forces students to conduct reconnaissance using port scanners and similar tools. Exposing the network might be a better idea for Cyber Policy and Cyber Law courses, but the administrative overhead to perform such a task makes it unfeasible.
Others have taken heterogeneous networking to another level by implementing different layer 2 architectures such as Ethernet, Asynchronous Transfer Mode (ATM), and Fiber Distributed Data Interface (FDDI) on a token ring. [12] Their network design is different from ours in that they are using it more for system modeling and simulation, networking, and special projects rather than information warfare. The scope of their network is also much smaller and where our heterogeneous nature consists of multiple operating systems and services, their heterogeneous flavor is a result of different link layer protocols. Some similarities also exist, however. We have begun establishing a wireless network using the 802.11b protocol in order to further investigate the security issues surrounding this wireless protocol.
Yasinsac describes a computer security laboratory project for outreach, research, and education. Their laboratory serves a similar purpose as the IWAR laboratory but on a smaller scale. Similar to the IWAR laboratory, they have been challenged to provide an environment where students are free to explore without creating administratively challenging headaches when systems break because of the use of certain tools. One of their solutions is to use a virtual machine software wrapper created by Vmware. [11] We also use Vmware but more so to provide a heterogeneous environment of operating systems rather than to control computer configuration. We control the configuration by re-imaging the systems or swapping hard drives when a student has applied a technology that causes unrecoverable damage. We place certain machines in an “administrative” mode and specify that these machines are off-limits. While this approach has worked thus far, we realize that in future years we may have to impose further constraints. However, we encourage our students and researchers to attack the various servers that exist in our laboratory.