CAC use nearly halves DOD network intrusions, Croom says

COLORADO SPRINGS, Colo. -- Although there are 6 million probes of Defense Department networks a day, successful intrusions have declined 46 percent in the past year because of a requirement that all DOD personnel log on to unclassified networks using Common Access Cards, Air Force Lt. Gen. Charles Croom, said in a speech at the AFCEA SpaceComm 2007 conference.

DOD has battled increasingly sophisticated attacks against its networks in the past year, and reconnaissance and attacks still continue 24/7, said Croom, director of the Defense Information Systems Agency and commander of the Joint Task Force for Global Network Operations.

It is essential to use CACs, which electronically verify a user’s identity, to access unclassified DOD networks because 75 percent of that traffic also moves across the public Internet, he said. Croom all but ruled out use of Outlook Web Access by remote users because of its poor security. The software’s use in DOD will require approval from a three-star general, he said.

Croom added that the number of successful socially engineered e-mail attacks against DOD users – a practice known as spear phishing – has declined 30 percent in the past year due to increased security awareness training. All department employees and contractors who use DOD networks were required to complete spear phishing awareness training as of this month.

DOD has already issued 10 million CACs to users of DOD networks, which include the National Guard, active and reserve forces, and contractors, Croom said. This accounts for 91 percent of all users on the unclassified networks. Use of CACs and public-key infrastructure tokens eliminates the need to use passwords, which Croom said is the major problem in protecting DOD networks.

Passwords can be harvested automatically by keyloggers or from notes people stick on their computers, Croom said.

When asked if the DISA and JTF-GNO plan to relax restrictions against the use of Outlook Web Access by Guard and reserve units, which do not have the infrastructure to support the use of CACs, Croom was unrelenting.

DOD networks are weapons systems that must be protected to support vital combat and logistics missions, and Guard and reserve units need to access them securely, Croom said. He suggested these units develop a virtual private network infrastructure that can support CACs.

Featured

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

  • Comment
    Pilot Class. The author and Barbie Flowers are first row third and second from right, respectively.

    How VA is disrupting tech delivery

    A former Digital Service specialist at the Department of Veterans Affairs explains efforts to transition government from a legacy "project" approach to a more user-centered "product" method.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.