Defense Information Systems Agency Research Articles

A HIPAA Security and Privacy Compliance Audit and Risk Assessment Mitigation Approach

Data breaches have a profound effect on businesses associated with industries like the US healthcare system. This task extends more pressure on healthcare providers as they continue to gain unprecedented access to patient data, as the US healthcare system integrates further into the digital realm. Pressure has also led to the creation of the Health Insurance Portability and Accountability Act, Omnibus Rule, and Health Information Technology for Economic and Clinical Health laws. The Defense Information Systems Agency also develops and maintains security technical implementation guides that are consistent with DoD cybersecurity policies, standards, architectures, security controls, and validation procedures. The objective is to design a network (physician's office) in order to meet the complexity standards and unpredictable measures posed by attackers. Additionally, the network must adhere to HIPAA security and privacy requirements required by law. Successful implantation of network design will articulate comprehension requirements of information assurance security and control.

Cyber security in industrial control system

For any system to secure them industrial control system plays an important role in it. It helps to design the isolated procure system, specialized communication mechanisms is used to help for the setup. And with the help of this setup the flexibility, safety, threats, and vulnerabilities are the most important things to make. To secure them from risk assessment and other protection measurement need to specify with good instruments and security. The paper describes technical aspects on Denial of Service (Dos) attack. We also identify how smart grid communication networks works in security technical implementation guides of the different countries as a defense information systems agency. A brief chronicle of cyber storm on ICS; common challenges, some mitigation of those challenge, all levels of the multi-layered ICS architecture. This paper demonstrates railway control systems (RCS) compliance estimation of immovable control system design, operational scenarios that can be used for mitigation measures and security assessment.

AESS Historical Interview With Dr. Catherine Warner

Dr. Warner is the Director of the NATO Science and Technology Organization Centre for Maritime Research and Experimentation. She was the science advisor to the Director, Operational Test and Evaluation within the U.S. Office of the Secretary of Defense. Her mission was to ensure the office fulfilled its statutory responsibility on the oversight and reporting of test and evaluation results for major weapons systems to Congress and senior Defense Department leadership. In 2013, at the request of the Defense Information Systems Agency, Dr. Warner deployed to Kabul, Afghanistan for 16 months in support of NATO's International Security Assistance Force and the U.S. Operation Enduring Freedom. She led a team of Information Technology specialists in advising Afghanistan's Ministry of Communications and Information Technology. From 1991 to 2010, Dr. Warner was with the Institute for Defense Analyses in Virginia where she performed analysis of operational tests for Army, Navy, and Air Force systems. She was an Assistant Director and the lead for Air Warfare. Her analysis portfolio included major aircraft systems such as the F-22, F/A-18E/F, V-22, and H-1. She was the lead analyst for unmanned aerial vehicle (UAV) systems including Predator, Shadow, Hunter, and Global Hawk. Dr. Warner worked at the Lawrence Livermore National Laboratory, attended the University of New Mexico, the San Jose State University, and earned both M.A. and Ph.D. degrees in Chemistry from Princeton University. Dr. Warner earned the NATO Meritorious Civilian Service Medal, DISA Exceptional Civilian Service Award, and the Presidential Rank Award.

Preserving Continuity of Behavioral Health Clinical Care to Patients Using Mobile Devices

The current model for treating behavioral health patients requires that providers and patients be in the same location for appointments. However, deploying warfighters present a challenge to this current model. Recent advances in technology make telehealth or virtual visits a viable option to replace the current model. This project leveraged mobile technology to see if performing tele-behavioral health visits presented a viable option to the current in-person model for future deployed warfighters. At the time of this publication, the authors note the current pandemic lends all the more urgency to the need for enhancing our video communication platforms for remote monitoring with the Military Health System. The research team assessed existing Internet protocol-based desktop teleconferencing solutions, generically known as a Web Real-Time Communications (WebRTC) system, for establishing a secure connection to a Service Members personal mobile device outside of the Department of Defense (DoD) network. Of the five existing WebRTC systems evaluated, only the backbone component to the existing Defense Information Systems Agency Global Video Services (DISA GVS) known as Vidyo, was suitable to meet DoD security requirements and still connect with both major operating systems (OS) on mobile devices. An existing DoD program of record mobile application, mCare, was integrated with Vidyo desktop technologies to form what the research team called "Mobile Connect." Deployment of the Mobile Connect product yielded distinct differences and high levels or variability between the .osd.mil and the army.mil network connections over time. These network differences impacted quality of service solution where Mobile Connect could not be used to provide care between the .mil and patient's personal mobile devices from a osd.mil domain connection. The current DoD WebRTC systems offer potential solutions but presently cannot connect with personal mobile devices in their current configurations. Additionally, any WebRTC system used by the DoD for future connections to personal mobile device must leverage commercial Single Socket Layer certificates (e.g., not DoD issued), or the communications with the mobile device will fail as a result of an authentication error. It is technically feasible to provide desktop Video Tele-Conference capabilities from a .mil computer to a personal mobile device without compromising DoD security and information assurance requirements using future WebRTC systems. Approved ports, protocols, and system settings must be configured to accept both inbound and outbound, encrypted traffic to/from personal mobile devices to maintain consistent quality of service with all DoD networks. Of the current DoD WebRTC options, working with the DISA GVS Program Manager to expand services to support commercial mobile devices has the highest probability of future success.

Developing Enterprise Cyber Situational Awareness

The topic will focus on the U.S. Department of Defense strategy towards improving their network security defenses for the department and the steps they have taken at the agency level where components under DOD such as The Defense Information Systems Agency are working towards adding tools that provides additional capabilities in the cyber space. This approach will be analyzed to determine if DOD goals address any of their vulnerabilities towards protecting their networks. One of the agencies under the DOD umbrella called The Defense Information Systems Agency provides DOD a template on how to build a network that relies upon layers of security to help it combat cyber attacks against its network. Whether that provides an effective solution to DOD remains a question due to the many components that operate under its direction. Managing these networks is the principle responsibilities for the Department of Defense. Nevertheless, it does demonstrates that there are tools available to help DOD build an strong enterprise cyber network of situational awareness that strengthens the ability to protect their network infrastructure.

Developing Enterprise Cyber Situational Awareness

This paper will examine why its become important for organizations to develop an comprehensive Information Technology (IT) Modernization strategy that focuses on improving their business process and protecting their network infrastructure by leveraging modern-day cybersecurity tools. Most of the topic will focus on the U.S. Department of Defense’s (DOD) strategy towards improving their network security defenses for the department and the steps they’ve taken at the agency level where components under DOD such as DISA (The Defense Information Systems Agency) are working towards adding tools that provides additional capabilities in the cyber space. This approach will be analyzed to determine if DOD goals address any of their vulnerabilities towards protecting their networks. One of the agencies under the DOD umbrella called DISA (The Defense Information Systems Agency) provides DOD a template on how to build a network that relies upon layers of security to help it combat cyber attacks against its network. Whether that provides an effective solution to DOD remains a question due to the many components that operate under its direction. Managing these networks is the principle responsibilities for the Department of Defense. Nevertheless, it does demonstrates that there are tools available to help DOD build an strong enterprise cyber network of situational awareness that strengthens the ability to protect their network infrastructure.

A Telephone for the World: Iridium, Motorola, and the Making of a Global Age by Martin Collins

Reviewed by: A Telephone for the World: Iridium, Motorola, and the Making of a Global Age by Martin Collins Rebecca Slayton (bio) A Telephone for the World: Iridium, Motorola, and the Making of a Global Age. By Martin Collins. Baltimore: Johns Hopkins University Press, 2018. Pp. 280. Hardcover $44.95. Iridium was an ambitious business and engineering venture that aimed to provide telecommunications services to the entire world. Using both published sources and oral history interviews, Martin Collins's new book situates Iridium in the transition from the Cold War era, in which U.S. military interests played a dominant role in shaping technological research and development, to an era in which neoliberal philosophy and free markets seemed ascendant. Collins argues that Iridium represented corporate, technological, and ideological conceptions of "the global." Launched by the U.S.-based multinational corporation Motorola, Iridium was part of a broader globalization of Western businesses that characterized the late twentieth century. Technologically, Iridium was literally global; initial proposals envisioned seventy-seven satellites (hence "Iridium," the element with atomic number seventy-seven), providing communications to any place on earth. And ideologically, the project drew upon and amplified the notion that global markets were a force for social progress. Iridium grew out of the Systems Engineering Group within Motorola's Government Electronics Division, which aimed to move beyond the division's traditional work as a subcontractor for military, intelligence, and space projects by becoming a prime contractor for commercial as well as government customers. Iridium eschewed new technology and instead focused on the organizational innovations needed to achieve "manufacturability" in a globally-dispersed workforce. This meant focusing on "quality," as epitomized for example in Motorola's Six Sigma method of reducing errors to 3.4 per million opportunities (the fraction of instances more than six standard deviations from the mean of a normal distribution). Whereas previous satellite manufacture had focused on designing single vehicles for worst-case-scenarios, Iridium focused on the timely production of an entire constellation of satellites, which only needed to succeed in aggregate. Iridium also used "culture" as a tool which "aimed to respect the local (whether inhering in an individual, an institution, or a geographic region)" while assuming that "it could be harmonized with the global (as conceived by the venture)" (p. 4). In fact, Iridium hired cultural anthropologists and futurists who predicted that the "Iridium Revolution" would have a beneficial impact on cultures around the world, advancing individual entrepreneurship, women's rights, sexual freedom, and more. In the mid-1990s, major media outlets such as Wired magazine publicized Iridium in similarly glowing terms. [End Page 928] Yet in 1999, Iridium filed for bankruptcy. Despite some rhetoric about uplifting citizens of the developing world, the service was largely marketed to well-heeled business travelers who did not need "global" telecommunications, but rather mobile telecommunications in the major cities that served as hubs of global commerce. By the 1990s, networks based on terrestrial cellular towers could serve these needs with more compact phones, better reliability, and lower costs than a satellite-based network. Additionally, Iridium depended upon partnerships with "gateways" in nations around the world; these were tasked with obtaining regulatory permission to operate Iridium, and then selling the service to companies that would then enroll individual subscribers. But many gateways did not share Western business values or priorities, and faced constraints not anticipated by Iridium; ultimately, they did not generate a sufficient number of customers. The tensions between Iridium's global multinational ambitions and local political and cultural realities played a significant role in the project's demise. Iridium's greatest asset, a globe-spanning satellite constellation, was nonetheless rescued from a fiery fate of de-orbiting and incinerating as the satellites plunged towards the earth. The U.S. military stepped in to encourage a group of investors to buy the satellites, forming Iridium Satellite Corporation. The Defense Information Systems Agency then promptly awarded the new corporation a contract. Iridium was ultimately used for communications in the Iraq and Afghanistan wars. Collins' account of Iridium is well-researched and written. It brings together and builds upon multiple themes in the history of technology, including digital utopianism, "systems" thinking, business history, and...

Financial and Administrative Infrastructure for the Early Internet: Network Maintenance at the Defense Information Systems Agency.

Popular and scholarly histories of computer networking often focus on technical innovation and the social impact of those innovations. These histories are marked by a contradiction, namely, failing to explain the existence of the infrastructure that they must ultimately use as evidence for the success of innovation, and the conduit of its social impact. The story of the U.S. Defense Advanced Research Agency's (DARPA's) Arpanet, and the role of both in the invention of the modern Internet, is a central archetype of this genre. Taking our lead from recent work in infrastructure and maintenance studies, we propose a methodological and ontological inversion of Internet historiography-centering our explanation around the infrastructure that is assumed but not explained in innovation-centric accounts. We do so by focusing on the U.S. Defense Communications Agency (DCA; now the Defense Information Systems Agency), which is traditionally cast, contra DARPA, as a conservative enemy of innovation. We explore its maintenance of the financial and administrative infrastructure necessary for the Arpanet to function as a contribution to broader histories of network infrastructure.

EVOLUTION AND RATIONALE FOR UNITED STATES DEPARTMENT OF DEFENSE ELECTROMAGNETIC PULSE PROTECTION STANDARD

ABSTRACTThe United States (US) Department of Defense (DoD) Electromagnetic Pulse (EMP) protection standard offers a solid basis for protecting commercial communication, data, and control facilities. Because of the standard's shielded barrier and test requirements, it is not surprising that there is a strong temptation within industry and government to dismiss the MIL‐STD 188‐125 approach in favor of less rigorous protection methods. It is important to understand that US DoD EMP protection standard for fixed facilities, MIL‐STD‐188‐125, reflects an evolution by trial and error that spanned a period of decades beginning with the acquisition of the Minuteman Missile System in the 1960s. In fact, one of the main motivating factors for developing the standard was that system developers in the Air Force, Army, Navy, and Defense Communications Agency (now Defense Information Systems Agency) and the Federal Emergency Management Agency tried less technically‐sound approaches that failed in their effectiveness, testability, and maintainability. This paper revisits the development of the US DoD standard and explains its provisions and underlying technical rationale. The paper's objective is to enable the public officials and engineers involved in planning and implementing EMP protection for critical infrastructure facilities to avoid the pitfalls encountered in the past and use the best practices available to achieve low risk protection designs that can be maintained over the entire lifecycle of critical infrastructure systems.

Database Security: What Students Need to Know

Introduction Database technologies are a core component of many computing systems. They allow to be retained and shared electronically and the amount of contained in these systems continues to grow at an exponential rate. So does the need to insure the integrity of the and secure the from unintended access. The Privacy Rights Clearing House (2010) reports that more than 345 million customer records have been lost or stolen since 2005 when they began tracking breach incidents, and the Ponemon Institute reports the average cost of a breach has risen to $202 per customer record (Ponemon, 2009). In August 2009, criminal indictments were handed down in the United States to three perpetrators accused of carrying out the single largest security breach recorded to date. These hackers allegedly stole over 130 million credit and debit card numbers by exploiting a well known database vulnerability, a SQL injection (Phifer, 2010). The Verizon Business Risk Team, who have been reporting breach statistics since 2004, examined 90 breaches during the 2008 calendar year. They reported that more than 285 million records had been compromised, a number exceeding the combined total from all prior years of study (Baker et al., 2009). Their findings provide insight into who commits these acts and how they occur. Consistently, they have found that most breaches originate from external sources, with 75% of the incidents coming from outside the organization as compared to 20% coming from inside. They also report that 91% of the compromised records were linked to organized criminal groups. Further, they cite that the majority of breaches result from hacking and malware often facilitated by errors committed by the victim, i.e., the database owner. Unauthorized access and SQL injection were found to be the two most common forms of hacking, an interesting finding given that both of these exploits are well known and often preventable. Given the increasing number of beaches to database systems, there is a corresponding need to increase awareness of how to properly protect and monitor database systems. At its core, database security strives to insure that only authenticated users perform authorized activities at authorized times. It includes the system, processes, and procedures that protect a database from unintended activity. The Defense Information Systems Agency of the US Department of Defense (2004), in its Database Security Technical Implementation Guide, states that database security should provide controlled, protected access to the contents of your database and, in the process, preserve the integrity, consistency, and overall quality of your data (p. 9). The goal is simple, the path to achieving the goal, a bit more complex. Traditionally database security focused on user authentication and managing user privileges to database objects (Guimaraes, 2006). This has proven to be inadequate given the growing number of successful database hacking incidents and the increase in the number of organizations reporting loss of sensitive data. A more comprehensive view of database security is needed, and it is becoming imperative for students in the computing disciplines to develop an understanding of the issues and challenges related to database security and to identify possible solutions. Database security is often included as a topic in an introductory database course or introductory computer security course. However as the knowledge base related to database security continues to grow, so do the challenges of effectively conveying the material. Further, many topics related to database security are complex and require students to engage in active learning to fully comprehend the fundamental nature of database security issues. This paper presents a set of subtopics for inclusion in a database security component of a course. These sub-topics are illustrated using a set of interactive software modules. …

The Circuit-Switched Network Design and Analysis Model: A Chronology of Its Development and Use

The Defense Information System Agency (DISA) has managerial and engineering responsibility for a circuit-switched network currently known as the Defense Information System Network—Voice. This network was originally implemented in the 1960s and was known as the Automatic Voice Network. Throughout this time, DISA has used a network design and analysis model to reconfigure the network. This model was developed in the early 1970s, has been continually enhanced, and is used on a weekly basis to engineer and manage the network. Since 1975, it has been used to save the United States (U.S.) government approximately $1,400,000,000.00. In this paper, we present a chronology of its development, enhancement, and use.

A course in software reuse with Ada 95

Courses in software reuse based on Ada have been taught for several years in Department of Computer Science at North Carolina A&T State university [2][5][6]. The course materials have been updated and adopted for Ada 95 under a curriculum development grant from the Defense Information System Agency. The new course forms a semester-long undergraduate course titled "Software Reuse with Ada 95".In this course software reuse levels, general criteria, and software development with reuse are overviewed. Software development for reuse and object-oriented design techniques that support reuse are taught. Ada 95's object-oriented features and how to integrate these features to develop reusable artifacts are examined. Reuse library and management techniques are discussed. Students are trained as designers, implementers and clients. They practice the object oriented software development process by implementing a team project.

A software engineering using Ada 95 course

This paper presents a software engineering course titled "Software Engineering Using Ada 95" for undergraduate junior and senior levels. This course was developed under a Defense Information System Agency curriculum development grant support. In this course software methodology, object oriented techniques, CASE tools and the software development process are addressed. Ada 95 is also taught. Students are guided to design, implement, test and document various components and subsystems by using CASE tools. Four projects are designed that are either individual or team projects. By developing these projects students practice all steps of the software development process, various object oriented techniques, and integrate advanced features of Ada 95 into these system developments.This course covers all basic software engineering topics in the ACM/IEEE Computing Curriculum as well as part of advanced software engineering topics [3][5], trains students to be software engineers with experience in various industrial environments, guides students to practice using Ada 95 [2] and promotes Ada 95 applications. Therefore, this course is applied towards satisfying requirements for a B.S. degree in Computer Science, Computer Engineering, Software Engineering and Information Management.

The DGSA: unmet information security challenges for operating system designers

The Department of Defense (DoD) Goal Security Architecture (DGSA) introduces a broader view of information security from that previously held by the Department, one which has much more in common with the requirements of an inter-networked commercial view of information security. The purpose of this paper is to introduce designers of operating systems to the most important aspects of the DGSA conceptual framework in order to open discussions on both the suitability of the framework and the feasibility of its implementation. The rationale for this framework is discussed in this paper. Challenging aspects of implementation are presented, and areas needing refinement prior to operating system implementation are described.Work supported by the National Security Agency and the Defense Information Systems Agency under contract number DASW01-94-C-0054. The views expressed in this article are those of the authors and do not reflect the official policy or position of the Department of Defense or the U.S. Government.

The first ACM Workshop on Education in Computer Security

Abstract : A successful first ACM Workshop on Education in Computer Security (WECS) was held in Monterey, CA on January 29-31 of 1997. The workshop was sponsored by ACM SIGSAC, the National Security Agency, the Defense Information Systems Agency, and the Naval Postgraduate School. Proceedings from the workshop are in preparation and should be available later in 1997. The workshop was international. For many, it was the first time we had met in person. Attendees came from the academe, government and industry. Although educators comprised the majority, participation by potential employers of INFOSEC professionals helped to focus pedagogical objectives. The confluence of perspectives resulted in interesting discussions.

A customer-to-carrier interface for trouble administration

This paper describes a customer-to-carrier trouble administration service based on the Network Management Forum (NMF) service management concept. Implementing a trouble administration gateway for direct on-line submission and interaction of trouble tickets is being realized through a standard interface known in industry as “Electronic Bonding”. This interface supports connectivity between an ISO/ITU-T Common Management Information Protocol (CMIP) manager and multiple agents. A Defense Information Systems Agency (DISA) project, described herein, enables a customer, acting in a manager role, to track trouble reports across public carrier networks.

SRI workshop summary

The Workshop on "Domain Analysis in the DoD," sponsored by the Software Reuse Initiative (SRI) and Defense Information Systems Agency (DISA), was held at MITRE Corporation, in McLean, Virginia on 26 - 27 September 1995. The primary purpose of the workshop was to discuss issues related to identifying and scoping domains with emphasis on product lines and to assess the usefulness of the strawman SRI Domain Scoping Framework as a proposed basis for this scoping activity. To this end, two specific objectives were identified:1. to identify the barriers facing Program Executive Offices (PEOs) and Program Managers (PMs) in incorporating domain analysis technology in their organizations and programs and2. to recommend a range of solutions and/or approaches to address and overcome these barriers.Many DoD and Industry programs can benefit from the application of domain analysis technology (concepts, processes, methods, and tools). However, PEOs/PMs rarely have enough information regarding why, when, or how to use domain analysis on their programs. A more basic question is whether there are sufficient reuse benefits within an organization/domain to warrant the associated investment in domain engineering - does a product line exist that justifies reuse costs? The solution to this problem involves bringing together leading domain analysis experts and PEO/PM representatives and managers to discuss a framework, currently under development by the DoD SRI, to guide DoD managers in applying domain analysis in their organizations and programs.The workshop brought together over fifty representatives from DoD, commercial, and academic organizations, with varied interests and perspectives on Domain Analysis, including those of methodologist, practitioner, management, and customer. The workshop approach included a Program Management panel, Domain Analysis Experts panel, a follow-up plenary discussion session and two working group sessions. In the working groups, the attendees were divided into 5 color-coded teams: Blue, Green, Gold, Orange, and Red, and were instructed to 1) identify issues in performing domain scoping, using the SRI Domain Scoping Framework as a "strawman"; and 2) make recommendations for improving the framework and applying its principles in real-world situations.The teams were chosen to provide a diversified mix of view-points. Each team included a facilitator/rapporteur (responsible for keeping the discussion activities relevant to the task at hand) and a Framework expert (who served as the technical authority on issues relating to framework content). The general team approach involved focusing on issues and actions within the individual teams and then looking across teams for common threads in the plenary sessions. The ultimate goal was to build consensus and move ahead with implementation recommendations.

Architectural design of a common operating environment

The Global Command and Control System is the next generation replacement for the legacy World Wide Military Command and Control System, which has served the command and control needs of several high level US military commands for more than 20 years. The GCCS is implemented on heterogeneous Unix workstations as opposed to the WWMCCS's mainframe implementation. The GCCS will eventually extend down to tactical levels of command and control not encompassed by the earlier system. For this and other reasons, the Defense Information Systems Agency is undertaking the architectural design of the new GCCS common operating environment. The architecture for the Global Command and Control System's new common operating environment will comprise several modern architectural concepts currently used in complex, distributed systems. We plan to reduce the environment's complexity by using architectural components supported by existing commercial products and standards.

Trials of wireless, secure electronic mail

The US Department of Defense (DOD) is a large user of both e-mail and security services. The introduction of commercial wireless communications and networks, and the recognition by industry of the need for security has provided the opportunity for development and trials of a wireless, secure e-mail service. The Center for Systems Engineering at the Defense Information Systems Agency has developed this capability and conducted trials with a small community of DOD users who have requirements for mobility in the workplace. These trials have introduced DOD approved security into commercial wireless data networks, and have inserted advanced technology into the hands of DOD users. The objective of these trials was to validate the system design, evaluate performance and utilization, and obtain user feedback. To realize a broad-based trial, the authors selected multiple wireless services, e-mail packages, security packages, and mobile computers, which were integrated in various combinations to meet user needs and allow a thorough trial. Both packet radio (RAM and ARDIS) and cellular digital packet data (CDPD) services were employed for the wireless connection of the mobile unit to a mail server on the user's local area network (LAN). Two commercial e-mail packages (LOTUS CC:Mail and Microsoft Mail) were integrated with the wireless service and with the security packages. Two security packages were used, one based on commercial software (SecretAgent) and the other based on a PCMCIA card (FORTEZZA) developed by the National Security Agency.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

Providing an analytic structure for key system design choices

The design of a system, especially a system architecture, requires the balancing of multiple performance parameters with the system cost and other implementation issues. Multi-attribute utility theory provides a structured, coherent framework for conducting an analysis in which system designs are evaluated on multiple performance parameters. This paper describes the application of multi-attribute utility analysis to the design of the Worldwide Digital Signal Systems Architecture (WWDSA), a telecommunications system, by the United States' Defense Communications Agency (now called the Defense Information Systems Agency). The advantages of using multi-attribute utility theory during the system design are highlighted. In addition, we discuss several key analytical issues that led to this application being a success in the eyes of the decision makers.