Nakasone Says U.S. Works to Stay Ahead of Cybersecurity Curve

 May 28, 2021 | BY Terri Moon Cronk , DOD News

Twenty years after the Sept. 11, 2001, attacks, the great threat to the nation has evolved into cyberspace — a new strategic environment where cyber actors can increase their power, degrade the power of others, and gain a strategic advantage, said Army Gen. Paul M. Nakasone.

"Our adversaries are operating with a scope, scale and sophistication unlike anything we've seen before," said Nakasone, commander of U.S. Cyber Command and director of the National Security Agency. "Their tactics have evolved far beyond spear phishing and exploitation of weak passwords. Today, our adversaries are targeting and infiltrating our systems by exploiting supply chain and zero-day vulnerabilities, and our adversaries are demonstrating a new risk calculus that has changed the traditional threat landscape."

Speaking virtually to the Armed Forces Communications and Electronics Association, Nakasone said that, by operating in cyberspace, U.S. adversaries can cause damage while operating below the level of armed conflict, and they're targeting U.S. economies, critical infrastructure and electoral processes. Adversaries also have launched persistent malicious cyber campaigns to erode U.S. military advantages and increasingly leverage social media to carry out [and] influence operations. These adversaries also steal U.S. defense secrets, intellectual property and personally identifiable information, he added.

Social media as we know it didn't exist 20 years ago, so now there's a trove of data in smartphones and social media accounts that adversaries can use against us, Nakasone said. Even fitness trackers and genealogy information are data points for our adversaries, who can use that information for malign purposes, such as counter intelligence, social engineering, or ransomware attacks.

China and Russia are the two greatest threats to the United States, and China is the pacing challenge, he said.

"China is becoming more assertive economically, diplomatically, militarily and technologically," Nakasone said. "It seeks to undermine a stable and open international order to establish its credibility and dominance in the global system."

He characterized Russia as a disruptive threat that aims to undermine the integrity and legitimacy of political systems. "Russia has demonstrated its ability to conduct influence operations in numerous countries, often by combining effective target development with the power of social media," he said, noting that China and Russia are conducting malicious cyber campaigns to erode U.S. military advantages, threaten U.S. infrastructure and reduce U.S. economic prosperity.

Nakasone said the United States must also actively deter rogue regimes, such as North Korea and Iran, which are unpredictable and destabilizing presences in their respective regions. "North Korea poses a significant threat to the international financial and commercial sectors by sponsoring cyber exploitation of financial institutions to illicitly acquire funding and evade U.S. and United Nations sanctions." 

He said Iran has also demonstrated the capability and intent to strike in its region and against the United States in cyberspace. "Moving forward, we expect that these and other adversaries will increase their efforts in cyberspace to undermine U.S. and allied interests," he said. "These malicious actors will continue to identify vulnerabilities in software across our governments, military and private-sector networks. And they'll embrace common anonymization platforms, generalized toolkits and open-source capabilities — anything that makes it more difficult for network defenders to detect and attribute their activity."

Such challenges to the United States will increase in both scale and scope, Nakasone said. "We must raise the bar. We must be resilient, and we must act. Our success in the new era of strategic competition will rely, in part, on our ability to develop partnerships of all kinds that acknowledge shared risks, shared goals and shared solutions. Our adversaries have worldwide reach. Partnership is where the power is."

Nakasone said U.S. Cyber Command and the National Security Agency work with the U.S. government, private industry, academia and international partners to achieve and maintain cyberspace superiority by building resilience at home, implementing proactive defense strategies, and contesting adversaries' campaigns and objectives. He added it's through these partnerships and collaborations that the U.S. will make it increasingly difficult for adversaries to operate. 

NSA expanded its ability to counter cyberthreats and share information with partners in innovative and unclassified ways when agency leaders opened the Cybersecurity Collaboration Center in December, Nakasone said. NSA partnerships with the private sector enable the agency to quickly secure national security systems, the Defense Department and defense industrial base networks.

"Thanks to our existing public-private dialogue, NSA has been able to quickly identify and issue advisories on critical vulnerabilities and commercial software for the national security systems that could also potentially affect millions of users around the world.

"We're all here with one overarching goal: to secure our future," Nakasone said. "And as threats evolve and our nation and our adversaries become more sophisticated, we must remain ahead of the curve. I have confidence that we, as a nation working together, will meet the critical challenges ahead."