Former CYBERCOM Leader Urges Collective Defense Against Cyber Threats

The former leader of U.S. Cyber Command and the National Security Agency shared his vision of a collaborative network of companies sharing cyber threat information in near-real time—a “radar picture,” he termed it—that could be anonymized and shared with the federal agencies tasked with protecting the United States.

“We couldn’t see attacks on the country,” retired four-star general Keith Alexander told a Washington Post Live webcast  about his time leading the combatant command. “We weren’t doing defense. We were doing response.”

The government will never have enough workers in cybersecurity, he said, especially since the private sector has its own needs. “We have this huge network, but every company defends its own [part],” Alexander said. “The adversary sees this as a great opportunity, because they know if they can get into one company it gets them” into all the parts of the larger network it connects to.

But imagine “90 midsized companies with 10 security people each. If those 90 companies worked together, that’s 900 people,” he said. By sharing what they are seeing, their knowledge of how to combat the threats—crowdsourcing the early warning system—then sharing it with the appropriate federal agencies, “then we can make cyberspace a safe space.”

Alexander pointed out that current threat analysis is signature-based. That is, a particular threat has a hash value unique to it, and networks are told to block that value whenever it shows up. The problem is, hackers can make the slightest tweak to the malware and generate a new hash value, which will be successful until it is identified and the new value is added to the blacklist.

“You need a behavioral set of analytics to detect beacons, lateral movement in networks, things like that,” he said. Using machine learning and artificial intelligence to screen for those kinds of activities and determine which ones appear significant is the first step, then the threat information could be shared with the broader cybersecurity community.

Setting up the collective early warning system is just part of the solution. Anonymizing the collected data is also important. “What you’re sharing is not company names [or] IP addresses,” he said. “You’re sharing metadata about behaviors.”

That information then could be used by federal agencies to meet their two cybersecurity missions: providing assistance and protection for companies under attack, and defending the country as a whole.

“We have to practice how we’re going to defend this nation. If an adversary is trying to take down the electrical grid, what do you want to do about it?” he asked. “The rules of engagement have to be [defined], then we have to practice, then we have to work with our allies.”

Alexander said the cloud does provide additional security but the problem has been the lack of visibility regarding on-premises systems that then connect to the cloud.

“SolarWinds started on-prem, then spread through the cloud,” he pointed out. “We need to see what hits companies that have both on-prem [resources] and cloud … The cloud brings to us this capability to create the radar picture.”

Cyber threats are a constantly moving target. So is technology. Alexander said his concern looking ahead is the advent of 5G networks. “5G adds a couple of levels of magnitude of complexity,” he said. “It increases the attack surface. Think of [the Colonial Pipeline attack] times 50.”

Alexander said cyberattacks are becoming more commonly thought of as weapons of conventional warfare. He cited Iran's use of ransomware against the Gulf states and China’s increasingly heated rhetoric against Taiwan as sources of concern.

Then there’s Russia.

“Russia has used cyber in every [military] attack since 2007,” he said. “We see that nexus. I believe this is going to be part of the battlespace, [and] as a nation we’ve got to stop it there. We’ve got to be ready. We’re so blessed with what we’ve got … Put aside the politics – we’re the most advanced technological country in the world. We’ve got to defend that and train [for] it.”

Though threats are substantial and growing, Alexander believes that his vision of a shared defense model could go a long way toward keeping the country safe.