CISO Perspectives: The Einstein Program

On Jan. 8, President Bush issued the Cyber Initiative order,
otherwise known as National Security Presidential Directive 54
(HSPD-54)/Homeland Security Presidential Directive 23 (HSPD-23).
The order, issued in response to increasingly complex and
aggressive cyberattacks against U.S. government and civilian
network infrastructures, outlined dramatic measures to improve the
security of government networks.


Among other measures, the order authorized the National Security
Agency to monitor federal computer networks. The joint directive
also required that the government dramatically scale back the

This is the third of three commentary articles written for GCN by a group of writers who make up the (ISC)2 U.S. Government Advisory Board Executive Writers Bureau. The Bureau includes volunteer federal information security experts from government and industry. A full list of Bureau members can be found here.


number of points at which federal networks connect to the public
Internet.


Included among the publicly

disclosed components of the Cyber
Initiative is the deployment of Einstein sensors on approved
federal government Internet access points. The Einstein Program,
managed by Homeland Security Department’s National
Preparedness and Policy Directorate, will capture certain segments
of federal network traffic in near real time, in order to perform
analysis and provide federal agencies with situational awareness
concerning the state of Internet traffic across the federal .gov
domain. This passive collection of data needed for analysis will
not interfere with the communications to and from agencies.
Targeted data collection is strictly limited and is determined
based on criteria for anomaly detection and other information
technology risks. This data may include:



  • Autonomous System Numbers (ASN). An ASN identifies the
    autonomous system and networks using the same specified routing
    policy and enables the systems to exchange information.

    With the explosive adoption rates of virtualized computing environments due to their promise of less costly data center hardware, quicker provisioning and increased flexibility, federal government chief information security officers are faced with the challenge of effectively securing these virtualized environments while balancing the constant pressure on IT to respond quickly to urgent business needs. The CISO's challenge is further complicated by the fact that there's a marked absence in guidance from the standards bodies, very little from the vendor community and a very serious knowledge gap in the systems administration, security practitioner, and audit communities. This article will explore some of the virtualization security best practices that hold the most promise for government systems.


  • Internet Control Message Protocol (ICMP) Type/Code. ICMP is
    used to communicate control messages on the Internet between
    hosts/routers.
  • Packet Length. A packet is a specially formatted group of bits
    containing data, an Internet Protocol (IP) address and control
    information that is transmitted over a network as a collective
    unit.
  • Protocol. A protocol is a standardized means of communication
    among machines across a network.
  • Sensor identification and connection status. Sensor
    identification is the description of where the sensor is located as
    to clearly identify which network, system or agency the data is
    coming from.
  • Source and Destination IP Address. IP addresses are four octet
    (32-bit) source or destination addresses that uniquely identify
    computers either on a given network or on the Internet.
  • Source and Destination Port. In the networking world, the term
    “port” is a number that identifies the beginning or
    endpoint of a logical connection.
  • Transmission Control Protocol (TCP) flag information. Simply
    stated, a TCP flag is information that is added to packets
    traveling between computers that describes the status of the
    connection between the computers.
  • Timestamp and duration information. A time that is printed to a
    file (such as e-mail) or other location to help keep track of when
    data is added, removed, sent, received, etc.
  • Payload Information.

The intent is that Einstein’s automated collection,
correlation, analysis and sharing of the above network flow data
from the various federal civilian government agencies will be
instrumental in:

  • Determining the scope and effect of any specific worm across
    the federal government and how it relates to the Internet community
    at large.
  • Detecting anomalous network behavior or activities against the
    federal government and determining whether it’s a focused
    attack or part of a larger Internet-related activity.
  • Determining the level of impact and any damage associated with
    cyberattacks against the federal government.
  • Diagnosing specific federal agency Internet traffic problems as
    they relate to the much larger Internet backbone
    infrastructure.
  • Pinpointing the apparent source responsible for any
    cyber-related attacks.
  • Determining the cyber state of the federal government in near
    real-time and its interaction with the global Internet
    community.
  • Compiling an overall situational awareness of trends and
    traffic patterns for all participating federal agencies.
  • Detecting early warning and indications of emerging attacks and
    malicious reconnaissance activities and adverse impact on federal
    government agencies.
  • Correlating system compromises across the federal
    government.

Though some may argue that Einstein technology is a little too
late, the obvious benefits of a fully implemented and robust
program that provides a cyber weather map for the federal
government are hard to deny. Interestingly though, despite its
promises, the program does pose major challenges for several
federal chief information security officers (CISOs) who would
otherwise benefit greatly from the program’s capabilities.

The program makes several underlying assumptions about the
pre-existence of a number of key infrastructures within federal
agencies that may not be correct in all cases. Looming large among
these are the assumptions that all targeted agencies have incident
response personnel trained and cleared at the appropriate levels
and with the capabilities to discuss classified detects via phone
(Secure Telephone Equipment) or e-mail (Secret Internet Protocol
Router Network, SIPRNet). There are, of course, wide variances
between departments and agencies because there has been no
requirement for such capability.


The program also makes an implicit assumption regarding the
robustness of the incident response capabilities of federal
agencies. Here too, we find major variances across departments and
agencies with capabilities ranging from fully outsourced cyber
response activities, minimally staffed lights-out operations, to
fully staffed 24x7 operations.


On the more technical front, it still isn’t clear the
degree to which DHS Einstein technology will be capable of true
active mode configuration employing underlying Deep Packet
Inspection to “unwrap and inspect” packets. The ability
to detect attacks is one thing, preventing network-based attacks
and malware at wire speeds is another.


Consequently, the perceived passivity of the Einstein sensor
technology itself becomes another area of concern. The bare-bones
staff at operational incident response centers is already
sufficiently overwhelmed with alerts from enterprise anti-virus,
deployed network and host-based intrusion detection and firewall
and router log analysis. One could argue that adding another
passive data source to include in an already bandwidth-constricted
triage process isn’t helping complete the
prevent-detect-respond triad.


The Einstein Program and its promise to deliver a federal cyber
weather map is greatly needed to improve the cyber early warnings
and indicators across the federal government and to enhance overall
federal cyber situational awareness. The program however, is not
without a number of challenges, which if overlooked by DHS program
directors, could degrade the program’s overall
effectiveness.



Reader Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above