Defense cyber chief: The cloud is the military's next Internet

Military networks and software must be tied to the cloud to defend Defense Department computers against adversaries, the Pentagon's cyber chief said Wednesday night.

Currently, Defense data reside on three main systems that cannot be centrally secured, creating disparate levels of protection that serve as entryways for ever evolving malicious software, according to military officials. The top brass envision fixing this setup with a cloud -- a common network infrastructure capable of spotting and blocking threats remotely for all the military's databases, PCs and other electronics.

Gen. Keith Alexander, chief of U.S. Cyber Command, called the cloud approach "active defense," adding that "hunting on our networks has got to change." He was speaking to computer security officials from the public and private sectors at a conference organized by the Security Innovation Network. "We have to find a way to communicate dynamically and pass those signatures around," Alexander said, referring to the digital fingerprints of malware that are loaded into antivirus software to detect threats.

So far intruders have caused more economic than physical pain -- but that may change soon, he said.

Exploitation of sensitive data has generated "the greatest transfer of wealth that's gone on in history," Alexander said. Cybercrime saps about $114 billion worldwide annually, according to security firm Norton. In 2007, Russia was suspected of orchestrating a network overload in Estonia that disrupted government and commercial systems for two weeks.

But "what I'm concerned about is destruction," where, for example, malware directs industrial systems controlling dams to explode "in the not too distant future," Alexander said.

He said the cloud can serve as a shield against such attacks by more quickly identifying signs of network manipulation. Statistics indicate most intrusions are discovered by personnel between six and nine months after an initial breach, Alexander said. Automating surveillance through a central service, or in the cloud, would speed response times, he explained.

"How do we create the next set of architecture that is more defensible and can ensure the integrity of our data? I think it's in the cloud," Alexander said.

Estonian officials in attendance backed the U.S. commander's faith in the cloud for national security.

"I believe Gen. Alexander was right. You can't contain cyber in a box," Jaak Aaviksoo, Estonia's education and research minister and former defense minister, told Nextgov. "You have to reach out in a proactive way."

Alexander did not specify which military division will administer the centralized security arrangement. The Defense Information Systems Agency is reported to be a likely Defensewide cloud supplier.