Lessons not learned, is it too late.

Lessons not learned, is it too late. December 8th, 2016

A few months ago an article in the Defense IT magazine had an article by Gen Hawke, the DISA commander. His topic was consolidating IT infrastructure to save money and gain efficiencies, laudable if saving money was why we had a DISA in the first place.

Fast forward to last night, I watched Tora!, Tora!, Tora! On TCM in honor of the Anniversary of Pearl Harbor and when the scene where LTG Short, Army Commander in the Pacific orders the dispersed airplanes to be consolidated wing tip to wing tip in case of sabotage I went into systems shut down. I paused the movie and after a few seconds could divinize what had happened, my pitiful excuse for a cranial occupant was telling me, “We have gathered our dispersed IT into a single point of failure, we have committed the same mistake LTG Short made.”

He couldn’t imagine an air raid on the US, especially Hawaii, no one could traverse the Pacific with a force large enough without being detected, inconceivable. But the 140,000 Japanese, some citizens some not, some already caught for spying and fifth column activities were a real threat, so he opted to defend against sabotage vs. an air raid.

What is our excuse?

We suffer cyber air raids daily and our answer is to hasten the consolidation of IT infrastructure to save money, not enhance security. Granted sabotage also occurs daily so defending against both is required as it was in 1941.

The lesson not learned, spend what is necessary to defend the systems not what is easy or efficient. Expect the adversary to do the inconceivable, history tells us that over and over again. Why are we poor students of our own profession of arms?

So when mil Cloud comes online and we migrate all the systems to one pipe someone, an unwitting insider, an insider doing the bidding of nefarious actors, or a foreign entity, state or criminal will penetrate the single layer of defense and drop a logic bomb or Trojan. Like it happened on December 7th, 1941 we will lose all sorts of C2, data, comms, etc.

We also must understand that the attack on Pearl Harbor was the beginning of the war, it got worse after that, what would the US be like without ATMs, smart phones, and cat videos? What would DoD do without email, STEs, and encrypted PEDs, or worse the classified systems used to pass orders?

How many couriers or runners would we need to establish coms across the US and the world?

We have created our own uber fragility, disrupted our stickiness (resilience), and rewarded those like LTG Hawke who decided it was a damn fine idea.

@Buzzzzkill

#IT #cloud