CommunityEditor
11-20-2008, 07:23 PM
The Defense Department has imposed an immediate ban on the use of thumb drives and other easily portable devices that offer digital memory storage, with some sort of viral intrusion into the military’s worldwide computer networks apparently spurring the move.
The Pentagon would not confirm or deny the ban, although it is spelled out in at least two Air Force directives, one of which sources the order to the Defense Department command that oversees the networks.
Neither directive spells out why the ban was imposed throughout the Defense Department’s Global Information Grid, which includes more than 17,000 local and regional networks and about 7 million individual computers.
But an intrusion or infection is the only explanation, said renowned security expert and author Bruce Schneier.
“Certainly, it’s a propagation problem they’re worried about,” said Schneier, chief security technology officer for BT, a British-based global communications firm. “If it’s preventive, why wasn’t it preventive last week? Something happened, and they’re worried about it propagating.”
The quickest way to stop additional problems, Schneier said, is to disallow the use of all flash media.
“They’ve got something they need to deal with,” Schneier said. “And they can deal with it better if things don’t move in and out of network. The problem with things like USB sticks is that they’re off-line storage.”
One official told Military Times that the latest ban was not related to bandwidth issues that prompted a system-wide May 2007 prohibition on accessing social networking and entertainment sites on military computers.
Neither Air Force directives state explicitly that a Defense Department-wide ban is in place. But one notes that the order to stop using flash media was issued by U.S. Strategic Command, which is responsible for operating and defending the .mil and .smil domains.
That internal Air Force memo, directed at Washington, D.C., Air Force offices and dated Nov. 17, orders “immediate suspension” of the use of such devices on all NIPR and SIPR networks.
A similar message, which did not mention StratCom, was posted online by Whiteman Air Force Base, Mo.
“The Chief of Staff of the Air Force recently implemented a policy prohibiting the use of memory sticks, thumb drives, flash memory cards such as XD, SD, Micro, Mini, CF, MS, cards etc., cameras, portable music players and [Personal Digital Assistants],” the message states. “Excluded are Blackberry devices that do not have the flash memory such as a Micro SD card installed.
“All remaining removable media such as external hard drives, CDs or DVDs, and other various items can be used if the following policies are met: All removable media must be labeled with the appropriate security classification. All other removable media such as external hard drives, CD/DVD reader/writer items must be scanned with a virus scanner prior to use.”
StratCom and its Joint Task Force-Global Network Operations, which manages the Global Information Grid, would not comment, referring all questions to the Pentagon. There, a spokesman responded but said operational considerations prevented any detailed comment.
“Daily, there are millions of scans” of the Global Information Grid, said Air Force Lt. Col. Eric Butterbaugh. “For security reasons, we don’t discuss the number of actual intrusions or attempts, or discuss specific measures commanders in the field may be taking to protect and defend our networks.”
Butterbaugh said the Defense Department “aggressively monitors its networks for intrusions and has appropriate procedures to address threats.”
“To address continuous and constantly changing cyber threats, guidance regularly is provided to the field about current threats and measures for users to take to ensure our information systems remain secure,” he said. “It’s the responsibility of every user to help protect the network.”
Article: http://www.armytimes.com/news/2008/11/military_thumbdrive_ban_112008w/
The Pentagon would not confirm or deny the ban, although it is spelled out in at least two Air Force directives, one of which sources the order to the Defense Department command that oversees the networks.
Neither directive spells out why the ban was imposed throughout the Defense Department’s Global Information Grid, which includes more than 17,000 local and regional networks and about 7 million individual computers.
But an intrusion or infection is the only explanation, said renowned security expert and author Bruce Schneier.
“Certainly, it’s a propagation problem they’re worried about,” said Schneier, chief security technology officer for BT, a British-based global communications firm. “If it’s preventive, why wasn’t it preventive last week? Something happened, and they’re worried about it propagating.”
The quickest way to stop additional problems, Schneier said, is to disallow the use of all flash media.
“They’ve got something they need to deal with,” Schneier said. “And they can deal with it better if things don’t move in and out of network. The problem with things like USB sticks is that they’re off-line storage.”
One official told Military Times that the latest ban was not related to bandwidth issues that prompted a system-wide May 2007 prohibition on accessing social networking and entertainment sites on military computers.
Neither Air Force directives state explicitly that a Defense Department-wide ban is in place. But one notes that the order to stop using flash media was issued by U.S. Strategic Command, which is responsible for operating and defending the .mil and .smil domains.
That internal Air Force memo, directed at Washington, D.C., Air Force offices and dated Nov. 17, orders “immediate suspension” of the use of such devices on all NIPR and SIPR networks.
A similar message, which did not mention StratCom, was posted online by Whiteman Air Force Base, Mo.
“The Chief of Staff of the Air Force recently implemented a policy prohibiting the use of memory sticks, thumb drives, flash memory cards such as XD, SD, Micro, Mini, CF, MS, cards etc., cameras, portable music players and [Personal Digital Assistants],” the message states. “Excluded are Blackberry devices that do not have the flash memory such as a Micro SD card installed.
“All remaining removable media such as external hard drives, CDs or DVDs, and other various items can be used if the following policies are met: All removable media must be labeled with the appropriate security classification. All other removable media such as external hard drives, CD/DVD reader/writer items must be scanned with a virus scanner prior to use.”
StratCom and its Joint Task Force-Global Network Operations, which manages the Global Information Grid, would not comment, referring all questions to the Pentagon. There, a spokesman responded but said operational considerations prevented any detailed comment.
“Daily, there are millions of scans” of the Global Information Grid, said Air Force Lt. Col. Eric Butterbaugh. “For security reasons, we don’t discuss the number of actual intrusions or attempts, or discuss specific measures commanders in the field may be taking to protect and defend our networks.”
Butterbaugh said the Defense Department “aggressively monitors its networks for intrusions and has appropriate procedures to address threats.”
“To address continuous and constantly changing cyber threats, guidance regularly is provided to the field about current threats and measures for users to take to ensure our information systems remain secure,” he said. “It’s the responsibility of every user to help protect the network.”
Article: http://www.armytimes.com/news/2008/11/military_thumbdrive_ban_112008w/