Naval Sea Systems Command (NAVSEA) and the Navy as a whole are working on several documents to educate the procurement community and the fleet about cybersecurity.
NAVSEA Chief Engineer Rear Admiral Bryant Fuller told an American Society for Naval Engineers event Thursday that a technical advisory board on information assurance / technology Navy Information (IA / IT TAB) has already approved eight technical standards for cybersecurity in Navy systems, and is expected to have approximately 24 by the end of the fiscal year.
âPart of the job of the TAB is technically figuring out what we want to do, and one of the things we are working on are specifications and standards,â Fuller said in his presentation of the TAB, which was said. surveyed a few years ago and includes the chief engineers of all Navy and Marine Corps system commands, as well as representatives from the US Cyber ââCommand and the Information Domination Directorate (OPNAV N2 / N6).
NAVSEA now takes these standards and specifications and determines how to apply them to ships and on-board systems. Fuller said his direction of engineering NAVSEA (SEA 05) spent most of fiscal 2015 studying cyberdevelopments at Navy warfare centers, universities, and national labs to understand which cyber tools are available. Now SEA 05 and the Navy must decide, âWhat do we really need? We focused really hard on going and looking at the kind of tools and things we have for situational awareness, intrusion protection systems, intrusion detection systems, abnormal behaviors, tools to recognize abnormal behaviors, resilience, concepts of operations, operating systems, âbut no decision has yet been made on what the ideal cybersecurity tool actually looks like .
Fuller knows some qualities he wants to see in the eventual cybersecurity tool. This should be common between warfare systems and machine control systems, he said. The tool will not only have to monitor the limits of each Navy control system, but also monitor the system for abnormal behavior. The tool should also be scalable to give every system the level of protection it needs, and it should be software-based and scalable to keep pace with the threat environment.
Human behavior will also need to be adjusted to help the cybersecurity system. Hull, Mechanical and Electrical (HM&E) systems do not need to be connected to the network at all times, and should only be connected when the crew needs to send data off the ship, Fuller said. – although even a part-time connection to a network means that the systems will need robust cybersurveillance.
Ideally, he said, “if we can get the 80% solution, make it scalable and scalable, then we can put it in place, work on human behaviors, we’ll be much better – and then log out where. we don’t need to be – we’ll be better off than now. And then as we learn more, better tools come out, threats evolve, so we’re just going to upgrade.
To help achieve this ideal, SEA 05 takes standards and specifications from the TAB and turns them into a functional requirements document for on-board systems specifically. Fuller said he expects this document to be completed by the end of the year, and that an objective architecture will then be developed based on the FRD. These documents will guide the cybersecurity architecture of future ships, including the upgrade of the Arleigh Burke Flight III-class guided missile destroyer, the LHA-8 amphibious assault ship, the replacement of the LX dock landing ship ( R) and more. And a Vessel Change Document (SCD) series will be released to describe how to re-equip existing vessels to include cybersecurity tools.
Several other lines of effort are also underway, Fuller said. Two years ago, CYBERCOM released a Cyber ââBest Practices Manual that Fuller believed focused on information systems, so SEA 05 released an appendix to the manual in July to include best practices for control systems.
Fuller’s team visited a fleet destroyer to observe how Sailors actually operate the control systems, and plan to visit two more ships in the coming weeks. These observations will inform future updates to the manual’s appendix.
More robust pre-deployment cyber certification also affects the operational fleet. Previously, the Navy only certified that warfare systems were hardened against cyber threats, but machine control systems will now also be added to the certification, creating a “more holistic certification” before going overseas, Fuller said. .