Cyber Security Professionals Seek Balance

by Mike Pierson
Air Force Space Command Public Affairs

8/19/2015 - Colorado Springs, Colo.  -- A perfectly secure computer network may also be perfectly useless, while the most capable weapon system may also be the most vulnerable.

That's the nature of cyber security today, Brig. Gen. Kevin Wooton, Principal Director of Integrated Air, Space, Cyberspace and Intelligence Operations, Headquarters, Air Force Space Command, reminded an audience at the fifth annual  Cyber Security Training and Technology Forum here on Aug. 19, his last duty day in the Air Force after 30 years of service.

"Our task, and our frustration is that we are charged with having the most secure cyberspace environment possible," he told the audience of about 500 network security experts, "but, we have to maintain the user experience" that helps accomplish the operational mission.

It is that balance, between security and usefulness, that those who secure and operate information systems have to strike every day, he said.   Perfection in cyber security is a worthy goal, but may not be worth the cost.

"Perfect is the enemy of the good," Wooton said. "We can strive to be perfect and we will miss the boat entirely, because we will expend so much energy, resources and time on the last three or four percentage points to get us up to 100 percent (security) instead of understanding how good 95 percent is, especially if we're at 30 percent now!"

Security, Wooton said, is much more than making equipment work.  Cyber security experts have to learn what the warfighter needs, how to provide that safely and must learn to communicate so that everyone benefits.

Wooton highlighted a recent reorganization at Headquarters, Air Force Space Command, where intelligence, operations and cyberspace experts were merged into one staff organization.  "For the first time, in AFSPC, you have space operators, cyber operators and intelligence professionals sitting in the same room, trying to solve the same problems."

Cyber security is an issue not just for space systems, but for many other modern weapon systems that may contain dozens, if not hundreds of embedded systems; computers that communicate with the outside world, Wooton said.

One of the major benefits of the staff consolidation is an appreciation for "baking in" cyber security to space and communication systems.  "We know (if we build in cyber security from the outset) we can save as much at 78% ... over the lifecycle of a system."  Building cyber security into an older system, on the other hand is, "like building an airplane in flight."

"You are some of the most valued assets in the United States," he told the crowd of information security professionals. "It's going to take cyberspace professionals" to strike the proper balance between cyber security and operational needs.