Army to Modernize Tracking System for Cyber Attacks

US Army Cyber CommandThe U.S. Army is preparing to modernize Blue Force Tracking, its friendly forces tracking system, to ensure continued operability in the event of cyber and electronic warfare attacks.

The Army Wants to be Able to Track Friendly Forces During a Cyber Attack
C4ISRNET | By Daniel Cebul

Washington — The U.S. Army is preparing to modernize its friendly forces tracking system so that it will continue to operate through cyber and electronic warfare attacks.

The service’s situational awareness network, known as Blue Force Tracking, already receives periodic updates, but a more significant upgrade is needed if troops are to be adequately equipped for future warfare. “This capability improvement is necessary as the United States faces increased cyber and electronic warfare threats from near-peer adversaries,” Lt. Col. Shane Sims said in an Army press release.

Defense News reported in November 2017 that Russia’s Zapad exercise took place in a largely EW-hostile environment. Because Russia proved it can jam its own forces relatively easily, military officials are concerned about how well NATO forces are prepared to operate in GPS- and communication-denied environments.

To address these issues, the program office partnered with the Army’s Communications Electronic-Research, Development and Engineering Center, or CERDEC, and ran concurrent studies that examined the capabilities and limitations of current blue force tracking technology.

The work included:

A traffic study that explored how the current blue force tracking system generates and receives data, as well as the requirements of moving data digitally to identify any network vulnerabilities.

A cyber and electronic warfare study that aimed to identify what emerging technologies need to be developed to stay ahead of adversaries. The Army announcement notes, “assured positioning, navigation and timing, known as PNT, for soldiers in GPS-denied environments was the primary goal in this study.”

A network study that examined how to communicate future data more efficiently within the network.

A transport study that identified the physical infrastructure — radios, satellites and antennas — needed to move larger quantities of information. Part of the solution is to build in redundancies into the network to use different radios and different frequency bands.

This might entail deploying satellites of higher technological quality in larger quantities. A new satellite infrastructure that could handle more data and transmit information faster was credited with the improvements soldiers observed the last time the BFT system was upgraded in 2011.

“The goal of the next-generation BFTs is to reduce the cognitive burden on soldiers by creating a simply and intuitive network,” Sims said.

The Army issued a request for information on the system this month, and CERDEC is set to meet with Army leaders to discuss an acquisition strategy in February.

The Army hopes to issue a request for proposals from industry in early 2020, and could begin fielding the new BFT by 2025, the release said.

The Risk of Insider Threat

Research demonstrates that most fraud risk is attributed to insider threat. In a study almost one third of all cyber attacks were committed by ex-employees.

It’s Not Just Cybercriminals: Insider Threats Still a Top Cyber Risk for Corporations
Property Casualty 360° | By Rhys Dipshan

As cyber espionage and ransom ware attacks wreak increasing damage on the world economy, it makes sense that many companies think their biggest threats comes from external actors.
But most risk still emanates from inside the organization, according to the Kroll’s Global Fraud & Risk Report.
The report was based on a survey conducted among 540 senior executives across six continents and found that a significant amount of companies’ fraud, cybersecurity and security incidents were caused by current or former employees.
Risks from current & former employees
Ex-employees, for example, were key perpetrators in 37% of security incidents that happened outside the cyber realm. What’s more, 25% of security incidents were caused by middle- or senior-level employees, while 26% were by junior employees.
Junior employees were also the most likely to cause fraud incidents, followed by ex-employees.
And while most cybersecurity incidents were caused by random cyberattackers, at 34%, ex-employees still accounted for 28% of all attacks, while senior or middle management employees accounted for 19%, and junior employees 16%.
Alan Brill, senior managing director with Kroll’s cyber security and investigations practice, noted that oftentimes, organizations will concentrate too much on high-tech cybersecurity needs, such as protecting their networks, and miss the fact that their biggest “risk factor comes from those who have access to sensitive information.”
Ensure former employees don’t have access
One major shortcoming among organizations is not properly ensuring former employees do not have access to enterprise systems. “You need to be able to not just plan the steps the company is going to take [when an employee leaves], but you have to have a way of knowing that the steps are actually being done. I think in many cases, there is a disconnect from what managers believe is being done and what is happening on the ground,” Brill said.
Brill also advised organizations to ensure that “the right agreements are [in] place” to limit employees’ and contractors’ access to sensitive information, and train employees on the appropriate data handling procedures.
Most companies surveyed took measures to mitigate the risk of insider threats. Over 80%t restricted employees from installing software on company devices and had employee training programs. Over 75% had internal cybersecurity policies and procedures.
But Brill noted that it’s not enough to just have security programs and policies without constantly reviewing their usefulness. He said that many companies need to use “metrics to understand if what they’re doing is effective,” and build their security programs around tested results.
Fraud, information theft
Such proven programs are becoming increasingly necessary given the wide range of fraud and cybersecurity incidents that organizations face in the current economy. The survey found, for example, that 29% of respondent companies suffered fraud, which resulted in information theft, loss or attack, while 27% had theft of physical assets or stock, and 26% uncovered a conflict of interest.
Information theft and conflict of interest incidents were experienced by 5% more companies in 2017 than in 2016, the biggest increase among all types of fraud incidents.
Brill noted that such conflict of interest incidents are becoming more common as enterprises rely on more vendors in their supply chain and as compliance offices become “more able to detect conflicts of interest” through the use of better compliance technology.
More vulnerable to all types of threats in 2018
With regards to cyber incidents, the survey found the amount of companies attacked by malicious viruses rose 3% to 36% in 2017, while those suffering email phishing attacks rose 7% to 33%, which Brill attributed to such scams becoming more sophisticated.
When compared with the 2015 survey results, respondents believed they’re more vulnerable to all types of threats in 2017 than they were two years prior, with the exception of theft of physical assets or stock. Areas where respondents believe their vulnerability had increased the most since 2015 included IP theft, management of conflicts of interest, and market collusion.