NSA Volunteers Give Back at Sandalwood Elementary

Source: National Security Agency NSA

BALTIMORE, MD. — Seven National Security Agency (NSA) employees took the phrase “giving back to the community” to heart during a recent visit to Sandalwood Elementary School where they shared cyber safety tips with 4th and 5th grade students and talked about their careers at NSA.
 
A new NSA K-12 pilot program called “All In” coordinated the volunteers’ visit. The All In program supports under-resourced elementary schools in the counties surrounding NSA’s Maryland headquarters with STEM and world culture education. The program’s goal is to increase awareness and knowledge to build the next generation of citizens and professionals.
 
In celebration of Cybersecurity Awareness Month in October, the volunteers shared cyber safety tips, such as password security, the good and bad of geotagging, and how to stay safe on social media and while emailing. They also highlighted their own cyber careers and experiences.
 
“The students were engaged in the discussions, eager to share their own stories related to the topics, and walked away with a better understanding on how to be cyber safe at home and in the classroom,” said Jen Greenwaldt, the K-12 Outreach/All In Baltimore County liaison. “Seeing the excitement and engagement of students at these 4th and 5th grade levels was impressive. It made me more aware of the need to educate students on this important topic.”
 
For Servia D., an engineer at NSA, the visit was personally rewarding.
 
“I was pleasantly surprised to see how engaged the students were, and how much they already knew about cybersecurity topics at a very young age,” she said. “I am truly fortunate to be part of an Agency that is highly invested into giving back to the community and helping cultivate our future generation, especially in under-represented school communities.”

To augment Sandalwood Elementary School’s cybersecurity curriculum, the NSA volunteers also shared cybersecurity resources from the National Institute of Standards & Technology and the National Initiative for Cyber Education with the school’s teachers.
 
“With the evolution of technology and the next generation becoming more in-tune with the cyber world, it’s imperative to embrace the National Cybersecurity Workforce and Education Strategy to instill the importance of cyber safety,” Greenwaldt said.
 

NSA Partners with Texas-Based Hispanic Serving Institution

Source: National Security Agency NSA

NSA has a long history of establishing research partnerships with universities, non-profits and industry, but it reached a new milestone in 2024.

The Office of Research and Technology Applications (ORTA) recently established a Cooperative Research and Development Agreement (CRADA) with the University of Texas Permian Basin (UTPB), making them the first Hispanic-Serving Institution to join the Advancing Research Innovating Solutions through Engagement (ARISE) CRADA.

As part of this agreement, UTPB students and faculty will have the opportunity to work directly with NSA researchers and liaisons on unclassified mission problems. According to ORTA deputy director said Karen Presley, this new partnership is a step forward in increasing representation of diverse students into the program.

“Diversity brings different talent, experiences, and skill sets to NSA which can lead to innovative ways of approaching problems,” Presley said. “This is a win-win for both the universities and the Agency.”

ARISE provides collaborative research opportunities to diverse, underrepresented student populations and faculty. According to Presley, it also supports NSA’s efforts to build and sustain a diverse, expert workforce that continues to provide the Nation with competitive advantages.
Presley first connected with Brian Shedd, who was then working for a public university, at a technology transfer event in 2017. They discussed collaborating on a CRADA, and although that specific agreement never came to fruition, Shedd and Presley kept in contact over the years.

Fast forward to 2024, Shedd, who is now the executive director of UTPB’s Office of Innovation and Commercialization, reached out to ORTA about the opportunity for UTPB to join the ARISE program. That initial chance conversation seven years ago turned into an impactful opportunity for NSA, UTPB, and the greater southwest Texas region, Presley said.

“It’s a testament to the idea that no interaction is too small: a brief run-in with a colleague can, years later, turn into a major collaboration,” she added.

UTPB prides itself on being a small school that thinks large and lives locally, according to Shedd.

“National security, cybersecurity, and infrastructure are all topics that are important to our region,” he said. “This partnership is unique for the university and provides an opportunity for students to get their hands on early stage technology.”

According to Shedd, the university’s business and computer science programs will start by performing market and intellectual property assessments. Eventually, they will participate in research and development to address some of the Agency’s mission problems.

“This partnership has been years in the making, and we’re excited to finally see it come to fruition,” Presley said. “I really can’t wait to see what the students at UTPB are able to achieve through this CRADA.”


NSA ORTA establishes partnerships with industry, academia, and other government agencies to help accelerate mission goals, advance science, foster innovation, and promote technology commercialization. Click here to learn more!

STEM Fest: Engineering Ideas Into Reality

Source: National Security Agency NSA

Join the National Cryptologic Museum for the 10th Annual STEM Fest! Explore a world of discovery where science, technology, engineering and math come together!

Get ready for hands-on exhibits, exciting activities and industry experts that will help spark curiosity and creativity!

The NCM is partnering with the Maryland STEM Festival for the 10th consecutive year. It’s a chance to explore the latest innovations in the STEM fields and have a family fun adventure! STEM Fest is free and open to the public.

When: November 9,, 2024 10am-4pm
Where: National Cryptologic Museum
8290 Colony Seven Rd, Annapolis Junction, MD 20701
 

Robots on the Plains: NSA Helps Native Students Engage in Cybersecurity Learning

Source: National Security Agency NSA

Last month, National Security Agency (NSA) affiliates traveled to North Dakota’s Turtle Mountain Indian Reservation to teach Native high school students about programming, cybersecurity, and robotics.

Dr. Adam Tagert from Research and Dr. Nathan BrownEagle from Cybersecurity attended NSA Day, the final day of the Sandia National Laboratory-sponsored camp at Turtle Mountain Community College (TMCC)—a private tribal land-grant community college founded by the Turtle Mountain Band of Chippewa Indians in 1972.

NSA’s diverse workforce, cybersecurity mission, and history of bringing the robots to Indian Country attracted the attention of the National Nuclear Security Administration and Sandia National Labs. Sandia then extended the invitation to NSA’s American Indian Alaska Native Employee Resource Group (AIAN ERG) to participate in the event with Tribal community colleges and universities.

NSA Day at the camp was included for students interested in future STEM or cybersecurity careers. TMCC has a strong focus in cybersecurity and is working towards accrediting a Bachelor of Science in Cybersecurity to add to their Associate of Applied Science program.

The first assignment of NSA Day at the camp was to program a set of robots to play soccer.

“It was inspiring to see students take a difficult challenge and the excitement that followed when they saw the robots move based on their commands and programming,” Tagert said, explaining that is the benefit of robotics. “It’s the ability to see the effect on the real world compared to changing something on a monitor.”

After a few soccer matches, where the students had the robots push a neon green foam ball into the goal, the NSA team performed a cyberattack on the robots to show that without cybersecurity, simple attacks, like a denial of service (DoS) can make cyber devices uncontrollable. A DoS is an event in which an attacker sends more information than the recipient can handle, which causes delays or missed commands.

The students then experimented by attacking each other’s robots and defending themselves with a mitigation that caused the robot to stop listening to commands over a set threshold. The students took to the final activity eagerly, which was more programming intensive than the soccer game and cybersecurity component.

This camp has appealed to Native youth in the past, even successfully attracting Native interns to Sandia National Labs over the past two summers.

“Hopefully, these students will be interested in applying for Stokes or other programs,” BrownEagle said. “Our opportunity to present just shows the impact of NSA reaching out to a broader demographic of STEM fair participants.”

BrownEagle added that a shortened version of the activity has also been presented at various national STEM conferences over the years.

“I’m grateful that Sandia recognized the value of Adam’s curriculum and invited us to bolster the region’s cybersecurity education for these Native students,” BrownEagle said.

“Remember Why You’re Here”: Mother of 9/11 Victim Visits Morrison Center Memorial

Source: National Security Agency NSA

FORT MEADE, Md. – “It shows you how fragile life is,” mother of Flight 93’s youngest victim said with tear-filled eyes at the sight of her 20-year old daughter’s photo and purse on display at the 9/11 memorial in the lobby of the Morrison Center on NSA/CSS Washington’s East Campus.
 
Earlier this year, Deborah “Debby” Borza donated to NSA the purse that her daughter carried on 11 September 2001. She was recently invited to the Agency to view this memorial on what would have been her daughter, Deora Bodley’s, 43rd birthday.

Debby Borza weeps at the sight of NSA’s Flight 93 memorial in memory of her daughter.

Borza and her partner, Gregory Linden, began their visit at the National Cryptologic Museum with a guided tour from the Center for Cryptologic History Chief John Tokar and a retired NSA employee and museum docent.

After a first-hand look into the Agency’s history, Borza and Linden boarded a van to East Campus to see the 9/11 memorial.
 
“What a great honor to have you here,” Deputy Director Wendy Noble said as she greeted them both upon their arrival.
 
Noble shared with Borza how much this memorial means to NSA.
 
“The reason we have it in the front of the building is especially for new employees, to remember why you’re here,” she said.
 
The project manager of the 9/11 memorial, and other members of the Morrison Center construction team were also present for the visit.
 
“A lot of folks that come and work here were born after 9/11,” the project manager said, sharing how the memorial helps the workforce relate to this tragic event in history.
 
 The co-facility manager and former Morrison Center construction manager, along with members of the Facility Management Team from East Campus, also got emotional and thanked Borza for her contribution.

Picture of Flight 93 victim Deora Bodley, and the purse she carried on 9/11 on display at the 9/11 memorial at NSA/CSS Washington’s Morrison Center.

The co-facility manager explained how Borza was instrumental in the Flight 93 memorial at NSA becoming a reality, and her visit brought it all together.
 
Borza was equally grateful for the time and hard work they put into the entire display, especially the piece honoring her daughter.
 
“To the gentlemen who built it, thank you,” she said. “Thank you for taking on that responsibility. This is amazing.”
 
The 9/11 memorial displays: an American flag from Shanksville, Pennsylvania; elevator tracks from the World Trade Center; limestone rubble and a partially melted laptop from the Pentagon; and Bodley’s purse, cleaned and preserved from the Flight 93 crash site.
 

A Day Etched Into Memory

 
On 11 September 2001, Borza’s daughter was entering her junior year as a French and child psychology major at Santa Clara University in California, and was returning to school after a visit with girlfriends on the East Coast. She had gone to the airport early that morning to accommodate her friend who had an early class. While Bodley was not scheduled to be on Flight 93 traveling from Newark International Airport to San Francisco, she was able to get a seat on standby.
 
Borza was at work when she got a tearful phone call from her daughter’s friend, saying that she had gotten on an earlier flight.
 
It was in that moment that Borza had an unsettling feeling, and went to a church across the street to pray. Borza recalled that she asked God, “Where is Deora?” and she heard a quiet voice respond, “She’s with me.”

Moments later, Borza got a call from the airline, and heard, “I’m sorry to inform you—” from the other line. Borza dropped the phone.
 

Debby Borza reads a quote at the 9/11 memorial.

Remembering and Honoring Her Daughter’s Legacy

 
Bodley dreamed of becoming a child psychologist, and was committed to community service, volunteering in high school, working with the America Reads program, and tutoring kids after school.
 
Since that phone call, Borza has dedicated her life to honoring her daughter and the other lives lost in Shanksville, and even relocated to Maryland to be closer to the crash site and to Washington D.C.
 
She has been a fixture in Congress and Shanksville since 2001 — working on memorial plans, committees, and legislation where she served on the board for Families of Flight 93 and the 9/11 National Memorial Trail.
 
“She’s the unofficial mayor of that place! Everybody knows her,” Tokar said as he accompanied Borza to the Flight 93 crash site.
 
Borza spent the day prior to the NSA visit at the Flight 93 memorial in Pennsylvania, watching the recent solar eclipse and commemorating her daughter’s birthday.
 
She was asked to speak to a school group that was scheduled to be at the Tower of Voices memorial that day to highlight history and take in the experience. There, Borza and the students made memories as they ate Oreos (her daughter’s favorite snack), and got to see a scientific wonder happen before their eyes.
 
“Being with those kids, I felt Deora closer than ever before,” Borza said.
 
The Tower of Voices, a 93-foot tall musical instrument holding 40 wind chimes, stands as a landmark feature near the entrance to the Flight 93 National Memorial, located in Somerset County, Pennsylvania.

NSA Deputy Director Wendy Noble with Debby Borza, mother of 9/11 victim, standing in front of the 9/11 memorial at NSA/CSS Washington’s East Campus.

The living memorial creates a set of forty tones (“voices”) to remember Bodley and the 39 others who died through their ongoing voices.

“Thank you for everything you’ve done,” said Ms. Noble, further recognizing Borza’s tireless work to help memorialize those who lost their lives 23 years ago.
 
Borza replied tearfully, “I did it for her.”
 
Before the afternoon concluded, Ms. Noble gave Borza her personal coin.
 
Borza recalls how the trip to the Agency to see the final piece of her daughter’s memorial was a fulfilling culmination to an emotional week, and before leaving Borza told the crowd, “Some people say ‘Never Forget,’ I like to say, ‘Remember.’ I know for sure, Deora’s very happy.”

History Today, June 6: The role of signals intelligence or ‘ULTRA’ on D-Day

Source: National Security Agency NSA

The term D-Day was a shorthand expression first used in World War I to denote the date an operation was to be launched. In the earlier war, officers also used H-HOUR and M-MINUTE, but these were seldom used in World War II. Because of the scope of the 1944 operation and the momentous stakes, in common parlance, “D-Day” has come to refer primarily to the landings in Normandy.

The Germans had occupied France since 1940. When the Americans entered the war in December 1941, U.S. strategic thinking called for an immediate landing in France in conjunction with our British allies, followed by an advance to liberate the country and then press on to Berlin. Britain’s high command argued against this course of action, pointing out, correctly, that the Germans were well dug in, American forces lacked experience in combat against the powerful foe, and neither country had yet assembled the reserve of men and materiel such an effort required.

As a consequence, the Allies battled the Germans in North Africa, Sicily, and Italy – but by spring 1944, the time had come to land in France and carry the battle to the German homeland. Hundreds of thousands of American, British, and Canadian men readied to land on five beaches in Normandy, France, to face well-prepared German defensive positions.

The planning for this operation, codenamed OVERLORD, was complex, but the strategic planning staff had an important asset — SIGINT. This was ULTRA, the product of cryptanalysis of high-grade enemy cryptosystems such as the now-famous ENIGMA machine. Crucial information also was derived from decrypts of reports written by the Japanese ambassador to Germany, who had toured the beachfronts of France in the autumn of 1943.
Those who study intelligence know that ULTRA gave planners access to copious amounts of information about the German weaponry emplaced along the beaches, the order of battle of the defensive units, and the standing orders given to the defenders.

Less well known but no less important was the information on German defensive mines in the English Channel. This was a vital factor, since Britain and the United States were transporting their combat units across the channel in hundreds of ships.

ULTRA provided a great deal of data on German mine laying. Some of it came from communications of the boats actually creating the minefield, some of it came from instructions to German ships about cleared areas for their sailing. The information included types of mines used, as well as boundaries for closed and open channels.

This information allowed the Allies to select mine-free routes for the ships carrying the landing parties and identify areas where minesweeping actions would be a priority.

The official historian of British COMINT in World War II wrote, “Largely with the assistance of SIGINT, though not without much tedious analysis of it . . ., the programme was reconstructed in considerable detail — a fact which proved to be of considerable importance for the success of the landings.”

In addition to ULTRA, U.S. ground forces had tactical COMINT personnel who accompanied deployed troops and provided intelligence from low-level German or Japanese communications.

The U.S. Navy also had tactical COMINT teams aboard ships in the Mediterranean and European Theaters of War, called the Y Service, a term borrowed from British usage. One of the primary missions of these teams was to provide warning of enemy air attacks and to jam German radio-controlled bombs.

Initially, the U.S. Navy had to borrow intercept operators from the U.S. Army or the Royal Navy. In early 1944, the commander of U.S. naval forces in Northwest African waters asked the Chief of Naval Operations to send twenty-four men for training in Y Service operations. He noted that the candidates should be of good intelligence, without family ties in Axis countries, wholly trustworthy, and be thoroughly fluent in idiomatic German; if any had a knowledge of German shorthand, that would be especially desirable.

In March two officers and ten enlisted men were dispatched from the U.S. to Europe for Y Service training, which was to be provided by the British admiralty.

As Allied forces prepared for Operation NEPTUNE, the naval phase of the Normandy landings, seven naval Y teams were deployed. Three of the teams had only British personnel; the other teams had mixed U.S. and UK personnel. It was felt that training alone was insufficient for success; the U.S. had to overcome lack of experience by integration of personnel with its ally.

During the D-Day landings and afterward, the Y teams undertook twenty-four-hour coverage. This began on June 5 and continued through June 18. As one later report put it, “. . . [I]n the case of the Normandy Operation, Y service proved to be of little assistance because of the general lack of enemy aircraft and naval surface craft in the face of overwhelming Allied surface and air power.”

The Y Service teams were disbanded in January 1945. By this time, the German naval and air forces were no longer a threat to U.S. and British movement of troops and support for them from the British Isles to France.

Today is the 80th anniversary of D-Day, still the largest amphibious attack conducted in the face of an armed enemy. The sacrifice in life by British, Canadian, and American troops was heavy on this day in 1944, but the successful landings truly marked the beginning of the end for Adolph Hitler and Nazism.

NSA and Universities Partnering to Advance Cybersecurity Research

Source: National Security Agency NSA

NSA Research invited leading university research institutions across the country to the National Cryptologic Museum for a day-long event to tackle the ongoing challenge of securing critical cyber systems.
 
The Laboratory for Advanced Cybersecurity Research sponsored the Science of Security (SoS) Virtual Institute (VI) kick-off meeting earlier this year. It was aimed at advancing foundational research in three key areas: Trusted Systems, Artificial Intelligence and Cybersecurity, and Defensive Mechanisms.
 
These three VIs facilitate collaboration of industry and academic communities with NSA research liaisons, and align with the Research Directorate’s mission to anticipate technological advances, prevent disruptive technology surprise, and partner to transition research into operational outcomes, according to Dr. Rita Bush, chief of the Laboratory for Advanced Cybersecurity Research.
 
Bush provided opening remarks and expressed her admiration of the SoS partnerships with academia.
 
“I am truly honored to welcome the university researchers to our latest version of the Science of Security program. SoS has a long history of sponsoring innovative unclassified research at great universities,” Bush said. “I’m so pleased that we’ve been able to continue this program, and introduce a new generation of students to the kinds of cybersecurity challenges that we face in protecting National Security Systems.”
 
In 2012, the Research Directorate began funding academic “lablets” focused on the development of a broad, self-sustaining community effort to advance the science of security. The lablets were small multi-disciplinary labs at universities across the country that perform cybersecurity, to underpin advances in cyber defense.
 
“Building these relationships is so important because the foundational research and results of the projects will help drive improvements in cybersecurity,” SoS Program Manager Shavon D. said. “The students at these institutions are working on hard research problems that align with our Agency’s strategic goals and with the interests of the Government as a whole.”
 
This year, lablets were replaced by VIs, a new model that will continue in the spirit of foundational research they established while also allowing projects to be added or retired as the knowledge in various topic areas advances.
 
Research advancements from each VI will be extensively documented and widely distributed through the SoS Virtual Organization (SoS VO), an online unclassified repository for SoS community awareness, directed toward the maturing of the scientific basis for security.
 
This year, the SoS team hosted principal investigators (school representatives) from Arizona State University, the International Computer Science Institute, University of Kansas, Ohio State University, Towson University, and Vanderbilt University. Their presentations addressed wide-ranging technical topics from the VIs including “Improving Safety and Security of Neural Networks” (AI and Cybersecurity), “Advancing Security and Privacy of Bluetooth IoT” (Trusted Systems), and “Neurosymbolic Autonomous Agents for Cyber-Defense” (Defensive Mechanisms.) There are currently 11 funded VI projects this year, including projects with Carnegie Mellon University, which was awarded a contract after the kickoff meeting.
 
“Our research universities are a national treasure, and I want you to be aware of the impact of your work and the work of Science of Security,” said Dr. Glenn L., Acting Technical Director, Laboratory for Cybersecurity Research, during his closing remarks.
 
Glenn shared how one of the sections in the White House’s Office of Science, Technology, and Policy 4-year Cybersecurity R&D Strategy was influenced by a Science of Security project out-brief. “Your work can have outsized impact; impact in ways that we didn’t initially imagine, informing a broad range of cybersecurity research.”
 
For more information about the SoS initiative and to view this year’s SoS-VI projects, please visit http://www.sos-vo.org/research#lablets.


Interested in learning more about joining NSA’s mission? Visit NSA.gov/Careers for more information. 
 

Agency, Audiologist Solve Hearing Aid Security Concern, Get Needed Devices in NSA Spaces

Source: National Security Agency NSA

FORT MEADE, Md. – Joe K never had to worry about wearing his hearing aid to work at NSA buildings—until he upgraded his device a few years ago.

Joe, who is now the People with Disabilities Employee Resource Group (PWD ERG) Deaf and Hard of Hearing Subcommittee (DHHSC) chair, formerly used an analog hearing aid, which didn’t present a security risk. When he upgraded, he didn’t realize it was a problem until he was approached by a colleague wondering about the process for his new device to be approved by NSA Security & Counterintelligence (S&CI).

 “Using hearing aids can be second nature, like putting your glasses on. Sometimes you don’t think about the technology behind it,” Joe said. “Many of us [deaf and hard of hearing affiliates] weren’t aware of the security requirements to bring them in NSA buildings.”

Starting in 2019, hearing aids began incorporating “hands-free calling,” a two-way audio Bluetooth technology. The new technology, however, presented an increased security threat to NSA — the potential for the transmission of classified conversations outside of a Sensitive Compartmented Information Facility (SCIF).

The issue with hearing aid technological improvements eventually brought together a number of stakeholders — including NSA Security & Counterintelligence (S&CI), NSA Research, and a Walter Reed Medical Center audiologist with close ties to the Veterans Administration (VA). The goal was to figure out how the deaf and hard of hearing community could take advantage of the new technology without compromising security.

 “The reason manufacturers are putting two-way audio Bluetooth in hearing aids is because it improves audio quality. It allows people to hear and speak through phone calls more clearly without holding the phone up to their ear and mouth,” said Jason B, technology officer for the PWD ERG DHHSC. “In the past, many hearing aids included a one-way Bluetooth feature which did not pose a threat. But lately, the two-way audio Bluetooth feature is being added as standard in all hearing aids, and that is where it became pretty problematic.”

Some jobs at NSA specifically require keen hearing to listen to and translate audio samples. Without the support of a hearing aid, some affiliates would be unable to perform their jobs successfully, Jason explained.

“I met with the chief of S&CI to brief him on the importance of hearing aids and how they allow members of the DHH community to do our jobs,” Jason said. “Mitigating security risks of modern hearing aid devices is essential because there are currently thousands of NSA employees with both diagnosed and undiagnosed hearing loss, and potentially thousands more that could be impacted in the future.”

S&CI’s Office of Physical Security conducted some initial testing of devices equipped with this new two-way audio Bluetooth technology and determined the new hands-free calling feature would, in fact, introduce a wireless microphone into a SCIF, presenting a big security challenge.

“Mitigations were being considered to address the new challenge but the COVID pandemic intervened,” said Heather J, technical director in S&CI’s Office of Physical Security. “We were working hard because we knew this was important, but we couldn’t rush something that could have such serious implications.”

As denials of hearing aid applications began to pile up, some of the Agency ERGs stepped in to advocate on behalf of the affected workforce, according to Jason. The American Veterans ERG (AV ERG) raised the recurring denial concerns to the PWD ERG.

Around the same time as the spike in hearing aid denials at NSA, an audiologist from Walter Reed Medical Center noticed a large number of her VA patients were returning new devices she had prescribed due to their inability to wear them at work. The audiologist contacted S&CI to gain insight into the problem, and S&CI engaged Research’s Laboratory for Advanced Cybersecurity Research (LACR) to help find a solution.

One of the biggest challenges with assessing medical devices with two-way audio Bluetooth is that most of the information about the devices is proprietary, according to Stephanie P, Internet of Things (IoT) Security team lead for LACR’s Trust Mechanisms office.

“We were really fortunate that the audiologist worked closely with Veterans Affairs and had connections with the six major companies that manufacture hearing aids,” Heather said. “She was able to provide context to them on the hands-free Bluetooth feature, share the challenges it presented to employers, and discuss potential solutions.”

When a new hearing aid needed to be evaluated, the LACR team was there with its tailored test scenarios, Stephanie explained.

“We provided detailed testing reports and vulnerability analysis, empowering senior leadership to make informed decisions on which devices to allow into our secured spaces,” she said. “One of the largest hearing aid manufacturers offered a disablement mitigation,” by programming software into its devices that would allow only the audiologist to deactivate the two-way audio Bluetooth feature. The user would still have the benefit of streaming the audio, one-way, directly into their hearing aid without external transmission.

“This viable mitigation was a monumental first step in ensuring NSA affiliates could have access to the latest advances in smart medical technology while at work,” said Stephanie, explaining Research doesn’t normally do this type of work but was pulled in to lead the Bluetooth assessment because of its expertise in IoT security.

In early 2023, the Agency announced it would allow this company’s Bluetooth hearing aids in SCIFs after going through the approval process.
The challenge of these two-way audio Bluetooth medical devices isn’t limited to NSA, according to Heather, who has been partnering with Office of the Director of National Intelligence (ODNI) to address concerns across the Intelligence Community.

“I wrote the current [NSA hearing aid Bluetooth mitigation] policy and am currently working with ODNI to write the medical device policy, which will apply to the entire Intelligence Community,” Heather said.

Both Heather and Stephanie are thrilled at the progress that has been made.

“I am extremely happy and proud that I was able to play a part in allowing certain Bluetooth enabled hearing aids into NSA SCIFs,” Stephanie said. “It is fantastic that this work is enabling employees with hearing loss to be able to take advantage of the latest advancements in hearing aid technology while they’re at work.”

“Balancing the needs of our workforce with the security of our facilities is getting harder as technologies get more advanced,” Heather agreed. “We’re really excited to have a way forward for this hearing aid feature, and we’re continuing to look at novel ways to mitigate new and emerging technical threats to maximize our ability to permit the latest and greatest in technology without compromising our missions.”


NSA Media Relations
MediaRelations@nsa.gov
443-634-0721

Small Defense Contractors Share How NSA Gives Them a Boost

Source: National Security Agency NSA

FORT MEADE, Md. – A buzz is reverberating throughout the Defense Industrial Base (DIB) about the National Security Agency (NSA).

Word has spread that the Agency’s new Cybersecurity Collaboration Center (CCC) offers no-cost cybersecurity services, and businesses are signing up in growing numbers, according to CCC Chief Morgan Adamski: “Companies see the value not just for their bottom line, but also for national security.”

Established in 2020, the CCC embraces one of NSA’s primary strategies for cybersecurity: scaling public-private partnerships empowered by insights derived from foreign signals intelligence.

To date, more than 1,000 industry partners have signed up for CCC services. These companies have broad and deep reach, ranging from major service providers that can harden billions of endpoints to small businesses that provide critical components to the nation’s most sensitive systems.

Working together with the CCC as the bridge, NSA and its partners are sharing insights and building a comprehensive threat picture that is mutually beneficial.

Small businesses make up the majority of the DIB supply chain (70%). These small businesses have access to sensitive Department of Defense (DoD) information, but often don’t have the technical expertise or other resources to defend their networks against a sophisticated nation state threat, said Bailey Bickley, NSA’s DIB Defense Chief.

“These companies are an attractive target for our adversaries who are seeking to steal U.S. intellectual property in order to build their own military capabilities and economies,” said Bickley. “We don’t expect small businesses to defend against nation-state threats alone. It’s in NSA’s and DoD’s best interests to help.” 

‘Seamless’ Integration in 15 Minutes

Mike T. is the founder and owner of a small defense contractor that manufactures critical components for national security systems. When he recently learned that his company’s network contained slight misconfigurations, he jumped on the issue and reached out to NSA for help.

“We don’t want people finding a backdoor and stealing drawings and next thing you know, we are on the hook,” he said.

Analysts at the CCC were able to enroll Mike’s company in NSA’s DIB Cybersecurity as a Service (CSaaS) offerings. As a result, the company received technical assistance to help improve his company’s network security. This included enrollment in a Protective Domain Name System (PDNS) service, which blocks users from connecting to known malicious or suspicious domains by running them through a filter —composed of commercial threat feeds and a unique threat feed provided by NSA — prior to resolving them. The integration was “seamless” and took 15 minutes, he said.

Further, the networks for Mike’s company are now hardened against malicious nation-state actors who could steal its intellectual property, putting the nation’s insights and investments at risk.

“As a small business, we don’t have the unlimited resources that the big players have, so we appreciate anything that gives us an edge,” said Mike, whose workforce numbers between 8 and 32 people depending on production cycles. “It is one less thing to think about, one less expense, and one less worry.”

NSA also benefits by receiving DNS data that the CCC is able to run custom analytics over to better understand ways nation-state actors are targeting the DIB, and then, defend against them.

The service is processing 70 million DNS queries a day and has blocked billions of malicious queries to date, including ransomware activity and known nation-state spear phishing, malware, and botnets, according to statistics compiled by the Cybersecurity Directorate’s DNS provider.

PDNS is just one part of the CCC’s suite of services offered to the DIB that the DoD funds. Other core services provided by the DIB Defense Team are Attack Surface Management — gaining an adversarial view of a company’s network and then finding and fixing issues — and Threat Intelligence Collaboration — staying ahead of the adversary by receiving non-public, DIB-specific NSA threat intelligence.
 
Attack Surface Management helps customers prioritize patching by providing an inventory of internet-facing assets, running vulnerability scans across those assets to determine where they may be vulnerable, then prioritizing results based off which vulnerabilities are under active exploitation.
 
Two newer authorities, delegated by the Secretary of Defense and the DoD Chief Information Officer, underpin the CCC’s ability to engage in bilateral information sharing with companies: the 2019 National Defense Authorization Act Section 1642b, and the 2020 DIB Delegation of Authorities.

Companies with active DoD contracts are encouraged to learn more about the CCC and enroll in NSA’s DIB Cybersecurity services. Get started by filling out a Cybersecurity Services Contact Form.


NSA Media Relations
MediaRelations@nsa.gov
443-634-0721

U.S. Military Academy Wins First Place at the 2024 NSA Cyber Exercise

Source: National Security Agency NSA

FORT MEADE, Md. – After months of preparation and three days of elaborate and challenging cyber operations, the U.S. Military Academy has emerged as the champion of the sixth annual NSA Cyber Exercise (NCX).
 
The battle for the coveted NCX trophy included participants from the U.S. service academies and senior military colleges, who competed alongside individuals from multiple NSA professional development programs. A team from USCYBERCOM’s Cyber National Mission Force (CNMF) participated in a For Exhibition Only (FEO) status. All team members rose to the challenge, applying their technical, collaborative, and critical thinking skills to simulated scenarios they can expect to encounter throughout their cyber careers.
 
“Agility and adaptability have been and will continue to be keys to our success,” Maj Gen Matteo Martemucci, deputy chief of the Central Security Service said during his welcome message “Remain alert, focused, and trust your training. This is what we prepare for.”
 
The U.S. Air Force Academy placed second, while the University of North Georgia finished third, beating out the U.S. Coast Guard Academy, the U.S. Naval Academy, and the senior military colleges, including Norwich University, Texas A&M University, The Citadel, Virginia Military Institute, and Virginia Tech. NSA’s Cybersecurity Operations Development Program (CSODP took first amongst the development programs.
 
This year’s NCX was the first hybrid competition since the COVID-19 pandemic, allowing institutions to participate in person or virtually.
 
Teams engaged in offensive cyber activities against a fictional adversary that attacked a satellite downlink. Exercises focused on active attack and malware, software development, and cybersecurity policy. These, along with the final attack-and-defend cyber combat exercise, challenged participants to use their creativity and collaboration skills to prevail against complex cyber threats.
 
“The competition is more than a trophy,” said Kenneth Allison, associate director of the Hollingsworth Center for Ethical Leadership at Texas A&M University, whose team competed in this year’s contest. “The additional knowledge and exposure to real-world challenges, the opportunities to ask questions, build confidence, and meet people that you may work with in the future – that’s what makes the NCX such a valuable part of our academic program.”

Martemucci awarded West Point’s cyber competition team members with the NCX trophy after edging out their competition in the tournament.
 
“Congratulations to the U.S. Military Academy,” Martemucci said during the closing ceremony. “We hope that this simulation not only deepened your understanding of the current threat environment, but also inspired you to continue to hone your skills and talents to help protect our Nation, whether in uniform, academia, government, or industry.”

This three-day, unclassified cyber competition is the culmination of the Agency’s effort to advance strategic goals by developing and testing the skills, teamwork, planning, and decision-making of future cybersecurity professionals.

 “The most exciting part for me is witnessing our future leaders put their skills to use,” said NCX Program Manager Kelley Welch. “Throughout the year, and especially during the competition, planting the seeds giving students firsthand insight into the vast cyber career opportunities within NSA’s mission, and how they can apply their passions and skills to help secure our Nation’s future.”
 
The final cyber combat exercise required participants to work collaboratively as they applied their cybersecurity knowledge to exploit and extract data from a physical device. Strong coordination, planning, communication, teamwork, and decision-making skills were essential to each team’s success.
 
 “I was a little intimidated at first because I assumed that we would only interact with our team members during the event,” said Joselyn Cordova-Flores, a junior at Norwich University and first-time NCX participant. “Instead, I had a chance to engage with people from NSA and different teams while working on other activities. The collaborative environment not only showed me that I have what it takes to be successful in this field, but also solidified NSA as my No. 1 career choice after graduation.”
 
Fostering connections across the cyber defense community in a conducive learning environment is what LT Ryan Quarry, instructor for the U.S. Coast Guard Academy, finds most rewarding about the NCX.
 
“This is a unique opportunity for students to network with their peers in other service academies, and other like-minded individuals who can help them reach their career goals,” he said. “In addition, the real-world scenarios give them immediate insight into their strengths and areas for development. These are two of many factors which make the NCX a premiere event for the U.S. Coast Guard Academy and a critical component of its cyber education programs.” 
 
For more information on the NSA Cyber Exercise, visit https://www.nsa.gov/Cybersecurity/NSA-Cyber-Exercise/


NSA Media Relations
MediaRelations@nsa.gov
443-634-0721