History Today, June 6: The role of signals intelligence or ‘ULTRA’ on D-Day

Source: National Security Agency NSA

The term D-Day was a shorthand expression first used in World War I to denote the date an operation was to be launched. In the earlier war, officers also used H-HOUR and M-MINUTE, but these were seldom used in World War II. Because of the scope of the 1944 operation and the momentous stakes, in common parlance, “D-Day” has come to refer primarily to the landings in Normandy.

The Germans had occupied France since 1940. When the Americans entered the war in December 1941, U.S. strategic thinking called for an immediate landing in France in conjunction with our British allies, followed by an advance to liberate the country and then press on to Berlin. Britain’s high command argued against this course of action, pointing out, correctly, that the Germans were well dug in, American forces lacked experience in combat against the powerful foe, and neither country had yet assembled the reserve of men and materiel such an effort required.

As a consequence, the Allies battled the Germans in North Africa, Sicily, and Italy – but by spring 1944, the time had come to land in France and carry the battle to the German homeland. Hundreds of thousands of American, British, and Canadian men readied to land on five beaches in Normandy, France, to face well-prepared German defensive positions.

The planning for this operation, codenamed OVERLORD, was complex, but the strategic planning staff had an important asset — SIGINT. This was ULTRA, the product of cryptanalysis of high-grade enemy cryptosystems such as the now-famous ENIGMA machine. Crucial information also was derived from decrypts of reports written by the Japanese ambassador to Germany, who had toured the beachfronts of France in the autumn of 1943.
Those who study intelligence know that ULTRA gave planners access to copious amounts of information about the German weaponry emplaced along the beaches, the order of battle of the defensive units, and the standing orders given to the defenders.

Less well known but no less important was the information on German defensive mines in the English Channel. This was a vital factor, since Britain and the United States were transporting their combat units across the channel in hundreds of ships.

ULTRA provided a great deal of data on German mine laying. Some of it came from communications of the boats actually creating the minefield, some of it came from instructions to German ships about cleared areas for their sailing. The information included types of mines used, as well as boundaries for closed and open channels.

This information allowed the Allies to select mine-free routes for the ships carrying the landing parties and identify areas where minesweeping actions would be a priority.

The official historian of British COMINT in World War II wrote, “Largely with the assistance of SIGINT, though not without much tedious analysis of it . . ., the programme was reconstructed in considerable detail — a fact which proved to be of considerable importance for the success of the landings.”

In addition to ULTRA, U.S. ground forces had tactical COMINT personnel who accompanied deployed troops and provided intelligence from low-level German or Japanese communications.

The U.S. Navy also had tactical COMINT teams aboard ships in the Mediterranean and European Theaters of War, called the Y Service, a term borrowed from British usage. One of the primary missions of these teams was to provide warning of enemy air attacks and to jam German radio-controlled bombs.

Initially, the U.S. Navy had to borrow intercept operators from the U.S. Army or the Royal Navy. In early 1944, the commander of U.S. naval forces in Northwest African waters asked the Chief of Naval Operations to send twenty-four men for training in Y Service operations. He noted that the candidates should be of good intelligence, without family ties in Axis countries, wholly trustworthy, and be thoroughly fluent in idiomatic German; if any had a knowledge of German shorthand, that would be especially desirable.

In March two officers and ten enlisted men were dispatched from the U.S. to Europe for Y Service training, which was to be provided by the British admiralty.

As Allied forces prepared for Operation NEPTUNE, the naval phase of the Normandy landings, seven naval Y teams were deployed. Three of the teams had only British personnel; the other teams had mixed U.S. and UK personnel. It was felt that training alone was insufficient for success; the U.S. had to overcome lack of experience by integration of personnel with its ally.

During the D-Day landings and afterward, the Y teams undertook twenty-four-hour coverage. This began on June 5 and continued through June 18. As one later report put it, “. . . [I]n the case of the Normandy Operation, Y service proved to be of little assistance because of the general lack of enemy aircraft and naval surface craft in the face of overwhelming Allied surface and air power.”

The Y Service teams were disbanded in January 1945. By this time, the German naval and air forces were no longer a threat to U.S. and British movement of troops and support for them from the British Isles to France.

Today is the 80th anniversary of D-Day, still the largest amphibious attack conducted in the face of an armed enemy. The sacrifice in life by British, Canadian, and American troops was heavy on this day in 1944, but the successful landings truly marked the beginning of the end for Adolph Hitler and Nazism.

NSA and Universities Partnering to Advance Cybersecurity Research

Source: National Security Agency NSA

NSA Research invited leading university research institutions across the country to the National Cryptologic Museum for a day-long event to tackle the ongoing challenge of securing critical cyber systems.
 
The Laboratory for Advanced Cybersecurity Research sponsored the Science of Security (SoS) Virtual Institute (VI) kick-off meeting earlier this year. It was aimed at advancing foundational research in three key areas: Trusted Systems, Artificial Intelligence and Cybersecurity, and Defensive Mechanisms.
 
These three VIs facilitate collaboration of industry and academic communities with NSA research liaisons, and align with the Research Directorate’s mission to anticipate technological advances, prevent disruptive technology surprise, and partner to transition research into operational outcomes, according to Dr. Rita Bush, chief of the Laboratory for Advanced Cybersecurity Research.
 
Bush provided opening remarks and expressed her admiration of the SoS partnerships with academia.
 
“I am truly honored to welcome the university researchers to our latest version of the Science of Security program. SoS has a long history of sponsoring innovative unclassified research at great universities,” Bush said. “I’m so pleased that we’ve been able to continue this program, and introduce a new generation of students to the kinds of cybersecurity challenges that we face in protecting National Security Systems.”
 
In 2012, the Research Directorate began funding academic “lablets” focused on the development of a broad, self-sustaining community effort to advance the science of security. The lablets were small multi-disciplinary labs at universities across the country that perform cybersecurity, to underpin advances in cyber defense.
 
“Building these relationships is so important because the foundational research and results of the projects will help drive improvements in cybersecurity,” SoS Program Manager Shavon D. said. “The students at these institutions are working on hard research problems that align with our Agency’s strategic goals and with the interests of the Government as a whole.”
 
This year, lablets were replaced by VIs, a new model that will continue in the spirit of foundational research they established while also allowing projects to be added or retired as the knowledge in various topic areas advances.
 
Research advancements from each VI will be extensively documented and widely distributed through the SoS Virtual Organization (SoS VO), an online unclassified repository for SoS community awareness, directed toward the maturing of the scientific basis for security.
 
This year, the SoS team hosted principal investigators (school representatives) from Arizona State University, the International Computer Science Institute, University of Kansas, Ohio State University, Towson University, and Vanderbilt University. Their presentations addressed wide-ranging technical topics from the VIs including “Improving Safety and Security of Neural Networks” (AI and Cybersecurity), “Advancing Security and Privacy of Bluetooth IoT” (Trusted Systems), and “Neurosymbolic Autonomous Agents for Cyber-Defense” (Defensive Mechanisms.) There are currently 11 funded VI projects this year, including projects with Carnegie Mellon University, which was awarded a contract after the kickoff meeting.
 
“Our research universities are a national treasure, and I want you to be aware of the impact of your work and the work of Science of Security,” said Dr. Glenn L., Acting Technical Director, Laboratory for Cybersecurity Research, during his closing remarks.
 
Glenn shared how one of the sections in the White House’s Office of Science, Technology, and Policy 4-year Cybersecurity R&D Strategy was influenced by a Science of Security project out-brief. “Your work can have outsized impact; impact in ways that we didn’t initially imagine, informing a broad range of cybersecurity research.”
 
For more information about the SoS initiative and to view this year’s SoS-VI projects, please visit http://www.sos-vo.org/research#lablets.


Interested in learning more about joining NSA’s mission? Visit NSA.gov/Careers for more information. 
 

Agency, Audiologist Solve Hearing Aid Security Concern, Get Needed Devices in NSA Spaces

Source: National Security Agency NSA

FORT MEADE, Md. – Joe K never had to worry about wearing his hearing aid to work at NSA buildings—until he upgraded his device a few years ago.

Joe, who is now the People with Disabilities Employee Resource Group (PWD ERG) Deaf and Hard of Hearing Subcommittee (DHHSC) chair, formerly used an analog hearing aid, which didn’t present a security risk. When he upgraded, he didn’t realize it was a problem until he was approached by a colleague wondering about the process for his new device to be approved by NSA Security & Counterintelligence (S&CI).

 “Using hearing aids can be second nature, like putting your glasses on. Sometimes you don’t think about the technology behind it,” Joe said. “Many of us [deaf and hard of hearing affiliates] weren’t aware of the security requirements to bring them in NSA buildings.”

Starting in 2019, hearing aids began incorporating “hands-free calling,” a two-way audio Bluetooth technology. The new technology, however, presented an increased security threat to NSA — the potential for the transmission of classified conversations outside of a Sensitive Compartmented Information Facility (SCIF).

The issue with hearing aid technological improvements eventually brought together a number of stakeholders — including NSA Security & Counterintelligence (S&CI), NSA Research, and a Walter Reed Medical Center audiologist with close ties to the Veterans Administration (VA). The goal was to figure out how the deaf and hard of hearing community could take advantage of the new technology without compromising security.

 “The reason manufacturers are putting two-way audio Bluetooth in hearing aids is because it improves audio quality. It allows people to hear and speak through phone calls more clearly without holding the phone up to their ear and mouth,” said Jason B, technology officer for the PWD ERG DHHSC. “In the past, many hearing aids included a one-way Bluetooth feature which did not pose a threat. But lately, the two-way audio Bluetooth feature is being added as standard in all hearing aids, and that is where it became pretty problematic.”

Some jobs at NSA specifically require keen hearing to listen to and translate audio samples. Without the support of a hearing aid, some affiliates would be unable to perform their jobs successfully, Jason explained.

“I met with the chief of S&CI to brief him on the importance of hearing aids and how they allow members of the DHH community to do our jobs,” Jason said. “Mitigating security risks of modern hearing aid devices is essential because there are currently thousands of NSA employees with both diagnosed and undiagnosed hearing loss, and potentially thousands more that could be impacted in the future.”

S&CI’s Office of Physical Security conducted some initial testing of devices equipped with this new two-way audio Bluetooth technology and determined the new hands-free calling feature would, in fact, introduce a wireless microphone into a SCIF, presenting a big security challenge.

“Mitigations were being considered to address the new challenge but the COVID pandemic intervened,” said Heather J, technical director in S&CI’s Office of Physical Security. “We were working hard because we knew this was important, but we couldn’t rush something that could have such serious implications.”

As denials of hearing aid applications began to pile up, some of the Agency ERGs stepped in to advocate on behalf of the affected workforce, according to Jason. The American Veterans ERG (AV ERG) raised the recurring denial concerns to the PWD ERG.

Around the same time as the spike in hearing aid denials at NSA, an audiologist from Walter Reed Medical Center noticed a large number of her VA patients were returning new devices she had prescribed due to their inability to wear them at work. The audiologist contacted S&CI to gain insight into the problem, and S&CI engaged Research’s Laboratory for Advanced Cybersecurity Research (LACR) to help find a solution.

One of the biggest challenges with assessing medical devices with two-way audio Bluetooth is that most of the information about the devices is proprietary, according to Stephanie P, Internet of Things (IoT) Security team lead for LACR’s Trust Mechanisms office.

“We were really fortunate that the audiologist worked closely with Veterans Affairs and had connections with the six major companies that manufacture hearing aids,” Heather said. “She was able to provide context to them on the hands-free Bluetooth feature, share the challenges it presented to employers, and discuss potential solutions.”

When a new hearing aid needed to be evaluated, the LACR team was there with its tailored test scenarios, Stephanie explained.

“We provided detailed testing reports and vulnerability analysis, empowering senior leadership to make informed decisions on which devices to allow into our secured spaces,” she said. “One of the largest hearing aid manufacturers offered a disablement mitigation,” by programming software into its devices that would allow only the audiologist to deactivate the two-way audio Bluetooth feature. The user would still have the benefit of streaming the audio, one-way, directly into their hearing aid without external transmission.

“This viable mitigation was a monumental first step in ensuring NSA affiliates could have access to the latest advances in smart medical technology while at work,” said Stephanie, explaining Research doesn’t normally do this type of work but was pulled in to lead the Bluetooth assessment because of its expertise in IoT security.

In early 2023, the Agency announced it would allow this company’s Bluetooth hearing aids in SCIFs after going through the approval process.
The challenge of these two-way audio Bluetooth medical devices isn’t limited to NSA, according to Heather, who has been partnering with Office of the Director of National Intelligence (ODNI) to address concerns across the Intelligence Community.

“I wrote the current [NSA hearing aid Bluetooth mitigation] policy and am currently working with ODNI to write the medical device policy, which will apply to the entire Intelligence Community,” Heather said.

Both Heather and Stephanie are thrilled at the progress that has been made.

“I am extremely happy and proud that I was able to play a part in allowing certain Bluetooth enabled hearing aids into NSA SCIFs,” Stephanie said. “It is fantastic that this work is enabling employees with hearing loss to be able to take advantage of the latest advancements in hearing aid technology while they’re at work.”

“Balancing the needs of our workforce with the security of our facilities is getting harder as technologies get more advanced,” Heather agreed. “We’re really excited to have a way forward for this hearing aid feature, and we’re continuing to look at novel ways to mitigate new and emerging technical threats to maximize our ability to permit the latest and greatest in technology without compromising our missions.”


NSA Media Relations
MediaRelations@nsa.gov
443-634-0721

Small Defense Contractors Share How NSA Gives Them a Boost

Source: National Security Agency NSA

FORT MEADE, Md. – A buzz is reverberating throughout the Defense Industrial Base (DIB) about the National Security Agency (NSA).

Word has spread that the Agency’s new Cybersecurity Collaboration Center (CCC) offers no-cost cybersecurity services, and businesses are signing up in growing numbers, according to CCC Chief Morgan Adamski: “Companies see the value not just for their bottom line, but also for national security.”

Established in 2020, the CCC embraces one of NSA’s primary strategies for cybersecurity: scaling public-private partnerships empowered by insights derived from foreign signals intelligence.

To date, more than 1,000 industry partners have signed up for CCC services. These companies have broad and deep reach, ranging from major service providers that can harden billions of endpoints to small businesses that provide critical components to the nation’s most sensitive systems.

Working together with the CCC as the bridge, NSA and its partners are sharing insights and building a comprehensive threat picture that is mutually beneficial.

Small businesses make up the majority of the DIB supply chain (70%). These small businesses have access to sensitive Department of Defense (DoD) information, but often don’t have the technical expertise or other resources to defend their networks against a sophisticated nation state threat, said Bailey Bickley, NSA’s DIB Defense Chief.

“These companies are an attractive target for our adversaries who are seeking to steal U.S. intellectual property in order to build their own military capabilities and economies,” said Bickley. “We don’t expect small businesses to defend against nation-state threats alone. It’s in NSA’s and DoD’s best interests to help.” 

‘Seamless’ Integration in 15 Minutes

Mike T. is the founder and owner of a small defense contractor that manufactures critical components for national security systems. When he recently learned that his company’s network contained slight misconfigurations, he jumped on the issue and reached out to NSA for help.

“We don’t want people finding a backdoor and stealing drawings and next thing you know, we are on the hook,” he said.

Analysts at the CCC were able to enroll Mike’s company in NSA’s DIB Cybersecurity as a Service (CSaaS) offerings. As a result, the company received technical assistance to help improve his company’s network security. This included enrollment in a Protective Domain Name System (PDNS) service, which blocks users from connecting to known malicious or suspicious domains by running them through a filter —composed of commercial threat feeds and a unique threat feed provided by NSA — prior to resolving them. The integration was “seamless” and took 15 minutes, he said.

Further, the networks for Mike’s company are now hardened against malicious nation-state actors who could steal its intellectual property, putting the nation’s insights and investments at risk.

“As a small business, we don’t have the unlimited resources that the big players have, so we appreciate anything that gives us an edge,” said Mike, whose workforce numbers between 8 and 32 people depending on production cycles. “It is one less thing to think about, one less expense, and one less worry.”

NSA also benefits by receiving DNS data that the CCC is able to run custom analytics over to better understand ways nation-state actors are targeting the DIB, and then, defend against them.

The service is processing 70 million DNS queries a day and has blocked billions of malicious queries to date, including ransomware activity and known nation-state spear phishing, malware, and botnets, according to statistics compiled by the Cybersecurity Directorate’s DNS provider.

PDNS is just one part of the CCC’s suite of services offered to the DIB that the DoD funds. Other core services provided by the DIB Defense Team are Attack Surface Management — gaining an adversarial view of a company’s network and then finding and fixing issues — and Threat Intelligence Collaboration — staying ahead of the adversary by receiving non-public, DIB-specific NSA threat intelligence.
 
Attack Surface Management helps customers prioritize patching by providing an inventory of internet-facing assets, running vulnerability scans across those assets to determine where they may be vulnerable, then prioritizing results based off which vulnerabilities are under active exploitation.
 
Two newer authorities, delegated by the Secretary of Defense and the DoD Chief Information Officer, underpin the CCC’s ability to engage in bilateral information sharing with companies: the 2019 National Defense Authorization Act Section 1642b, and the 2020 DIB Delegation of Authorities.

Companies with active DoD contracts are encouraged to learn more about the CCC and enroll in NSA’s DIB Cybersecurity services. Get started by filling out a Cybersecurity Services Contact Form.


NSA Media Relations
MediaRelations@nsa.gov
443-634-0721

U.S. Military Academy Wins First Place at the 2024 NSA Cyber Exercise

Source: National Security Agency NSA

FORT MEADE, Md. – After months of preparation and three days of elaborate and challenging cyber operations, the U.S. Military Academy has emerged as the champion of the sixth annual NSA Cyber Exercise (NCX).
 
The battle for the coveted NCX trophy included participants from the U.S. service academies and senior military colleges, who competed alongside individuals from multiple NSA professional development programs. A team from USCYBERCOM’s Cyber National Mission Force (CNMF) participated in a For Exhibition Only (FEO) status. All team members rose to the challenge, applying their technical, collaborative, and critical thinking skills to simulated scenarios they can expect to encounter throughout their cyber careers.
 
“Agility and adaptability have been and will continue to be keys to our success,” Maj Gen Matteo Martemucci, deputy chief of the Central Security Service said during his welcome message “Remain alert, focused, and trust your training. This is what we prepare for.”
 
The U.S. Air Force Academy placed second, while the University of North Georgia finished third, beating out the U.S. Coast Guard Academy, the U.S. Naval Academy, and the senior military colleges, including Norwich University, Texas A&M University, The Citadel, Virginia Military Institute, and Virginia Tech. NSA’s Cybersecurity Operations Development Program (CSODP took first amongst the development programs.
 
This year’s NCX was the first hybrid competition since the COVID-19 pandemic, allowing institutions to participate in person or virtually.
 
Teams engaged in offensive cyber activities against a fictional adversary that attacked a satellite downlink. Exercises focused on active attack and malware, software development, and cybersecurity policy. These, along with the final attack-and-defend cyber combat exercise, challenged participants to use their creativity and collaboration skills to prevail against complex cyber threats.
 
“The competition is more than a trophy,” said Kenneth Allison, associate director of the Hollingsworth Center for Ethical Leadership at Texas A&M University, whose team competed in this year’s contest. “The additional knowledge and exposure to real-world challenges, the opportunities to ask questions, build confidence, and meet people that you may work with in the future – that’s what makes the NCX such a valuable part of our academic program.”

Martemucci awarded West Point’s cyber competition team members with the NCX trophy after edging out their competition in the tournament.
 
“Congratulations to the U.S. Military Academy,” Martemucci said during the closing ceremony. “We hope that this simulation not only deepened your understanding of the current threat environment, but also inspired you to continue to hone your skills and talents to help protect our Nation, whether in uniform, academia, government, or industry.”

This three-day, unclassified cyber competition is the culmination of the Agency’s effort to advance strategic goals by developing and testing the skills, teamwork, planning, and decision-making of future cybersecurity professionals.

 “The most exciting part for me is witnessing our future leaders put their skills to use,” said NCX Program Manager Kelley Welch. “Throughout the year, and especially during the competition, planting the seeds giving students firsthand insight into the vast cyber career opportunities within NSA’s mission, and how they can apply their passions and skills to help secure our Nation’s future.”
 
The final cyber combat exercise required participants to work collaboratively as they applied their cybersecurity knowledge to exploit and extract data from a physical device. Strong coordination, planning, communication, teamwork, and decision-making skills were essential to each team’s success.
 
 “I was a little intimidated at first because I assumed that we would only interact with our team members during the event,” said Joselyn Cordova-Flores, a junior at Norwich University and first-time NCX participant. “Instead, I had a chance to engage with people from NSA and different teams while working on other activities. The collaborative environment not only showed me that I have what it takes to be successful in this field, but also solidified NSA as my No. 1 career choice after graduation.”
 
Fostering connections across the cyber defense community in a conducive learning environment is what LT Ryan Quarry, instructor for the U.S. Coast Guard Academy, finds most rewarding about the NCX.
 
“This is a unique opportunity for students to network with their peers in other service academies, and other like-minded individuals who can help them reach their career goals,” he said. “In addition, the real-world scenarios give them immediate insight into their strengths and areas for development. These are two of many factors which make the NCX a premiere event for the U.S. Coast Guard Academy and a critical component of its cyber education programs.” 
 
For more information on the NSA Cyber Exercise, visit https://www.nsa.gov/Cybersecurity/NSA-Cyber-Exercise/


NSA Media Relations
MediaRelations@nsa.gov
443-634-0721

NSA/CSS Employees Donate More Than $2M for 2023 Combined Federal Campaign

Source: National Security Agency NSA

The 2023 Combined Federal Campaign (CFC) concluded on January 12, 2024, with National Security Agency (NSA)/Central Security Service (CSS) affiliate contributions exceeded NSA’s goal of $1.9 million with over $2 million donated to 1,398 charities.

The CFC, led by the U.S. Office of Personnel Management (OPM), enables federal employees and retirees to support people and communities in need across the country and around the world.

It is the world’s largest and most successful annual workplace charity campaign, according to Barry Boseman, chief of State and Local Affairs.
NSA led donations in the mid-Atlantic region, which includes four states, Washington D.C., and 1,200 participating government agencies, Boseman said. The Department of Defense (DoD) total for the 2023 CFC was over $8.5 million, of which NSA contributed over 20%, and the nationwide total was $68.3 million.

“I’m incredibly proud of the contributions that our workforce made during this year’s campaign,” said Gen. Tim Haugh, Commander, USCYBERCOM, Director, NSA/Chief, CSS. “NSA remains committed to giving back to our local communities during the CFC and beyond.”

“The theme for the 2023 CFC was ‘Give Happy,’ as the CFC connected giving with happiness, showing that when federal employees give together, they are happier,” said Veronica Maylish Beckenstrater, NSA’s CFC program manager for the 2023 campaign.

William “Roy” Surrett, NSA’s lead CFC senior advocate, agreed. “Thank you again for ‘giving happy’ to important causes like helping communities recover from disasters, supporting military families, ensuring education for all, and more,” he said. “There is no better feeling than to help those in need here in our local area, across our Nation, and around the world.”

“The workforce’s dedication was vital to the success of the campaign and will bring help and hope to thousands of people as monetary and volunteer pledges go to support the missions of participating charities,” Maylish Beckenstrater said.

Keyworkers and senior advocates distributed marketing materials, spoke at town halls, and hosted events, including charity fairs, chili cook-offs, pet contests, painting parties, and bingo games to encourage the workforce to donate to causes that mean the most to them, she explained.

“It was innovative ideas like these that helped NSA exceed its goal this year and to show the community we care,” Maylish Beckenstrater added. “I can’t wait to see our workforce band together for next year’s campaign.”


Interested in learning more about joining NSA’s mission? Visit NSA.gov/Careers for more information. 
 

Georgia Tech Wins NSA’s Codebreaker Challenge for Third Consecutive Year

Source: National Security Agency NSA

FORT MEADE, Md. – For the third consecutive year, the Georgia Institute of Technology (Georgia Tech) took first place in the National Security Agency (NSA) sponsored Codebreaker Challenge (CBC).

The CBC is designed to develop and test students’ skills in reverse engineering, computer programming, forensics, and vulnerability analysis with increasingly difficult mission-oriented scenarios that mirror some of the technical and analytic challenges specific to NSA.

This year’s CBC involved a signal with an unknown origin identified by the U.S. Coast Guard and presented the students with a series of nine tasks to locate and analyze what produced the signal, discover an active collection operation tasked by a rogue server, and subvert the rogue server to stop the collection device.

Each task in the challenge was weighted with a certain number of points and increased in difficulty as students advanced through the tasks. Once the challenge was completed, the points were awarded to the student’s school.

Holly Mayne, NSA’s CBC academic lead, noted that Georgia Tech had the largest student participation in the challenge, with 223 students completing the first task, and the most points awarded across all nine tasks.

“They are so excited to bring home another CBC trophy, their fourth win since 2013,” Mayne said about Georgia Tech’s win. “They are looking forward to the official NSA celebration on campus in the coming months.”

One student from the University of California, Santa Cruz, broke a CBC record this year, completing all nine tasks of the challenge in just five days — cutting the former record in half, according to CBC lead developer Akil Booker.

The University of North Georgia placed second in the challenge, and SANS Technology Institute finished third. Other top schools included the University of California, Santa Cruz; Dakota State University; and Strayer University. Students who completed the challenge will receive a special CBC medallion and certificate signed by Gen. Timothy Haugh, Director, National Security Agency.

Ten years ago, a group of NSA employees launched the CBC with five participating schools, growing with each successive iteration. This year’s challenge had 5,057 participants registered from 450 U.S.-based academic institutions, according to Mayne.

“For the past 10 years, the CBC has given students from all around the country a glimpse into real-world scenarios that emulate the Intelligence Community’s classified work environment,” she said.

Over time, the CBC has helped promote intercampus engagement, as well as the Agency’s engagement with the academic community, strengthen U.S. cyber-related education nationwide, and increase student interest in pursuing a career at NSA.

Eric Bryant, one of the original creators of the CBC, said that while the challenge originally started out as a fun puzzle, it continues to be a positive return on investment for the Agency.

“It is an excellent way to gauge and sharpen students’ proficiency and skills in cybersecurity and reverse engineering before they come to work here,” he said.

Students who perform well in the CBC are encouraged to apply to the Agency, with many receiving conditional job offers. Owen Parkins, one of the few student solvers from the 2018 CBC and current researcher at NSA, noted how his participation and completion of this challenge piqued the Agency’s interest in hiring him to work for NSA.

“I love my job and love coming to work every day,” Parkins said. “I really wanted what NSA had. I wanted to [get after the adversary] and do things that you can’t do anywhere else. And that has been fulfilled beyond my imagination.”

Since 2013, students like Parkins have grown to learn more about NSA and have a better understanding of its national security concerns and priorities through their participation in the CBC, Mayne said.

“CBC helps prepare and attract the next generation of cyber talent here at the Agency,” she said.
 


NSA Media Relations
MediaRelations@nsa.gov
443-634-0721

NSA Releases Top Ten Cloud Security Mitigation Strategies

Source: National Security Agency NSA

FORT MEADE, Md. – The National Security Agency (NSA) is releasing “Top Ten Cloud Security Mitigation Strategies” to inform cloud customers about important security practices as they shift their data to cloud environments. The report is a compilation of ten Cybersecurity Information Sheets (CSIs), each on a different strategy. The Cybersecurity and Infrastructure Security Agency (CISA) joins NSA as a partner on six of the ten strategies.
 
The ten strategies are covered in the following reports:

  1. Uphold the cloud shared responsibility model

  2. Use secure cloud identity and access management practices (Joint with CISA)

  3. Use secure cloud key management practices (Joint with CISA)

  4. Implement network segmentation and encryption in cloud environments (Joint with CISA)

  5. Secure data in the cloud (Joint with CISA)

  6. Defending continuous integration/continuous delivery environments (Joint with CISA)

  7. Enforce secure automated deployment practices through infrastructure as code

  8. Account for complexities introduced by hybrid cloud and multi-cloud environments

  9. Mitigate risks from managed service providers in cloud environments (Joint with CISA)

  10. Manage cloud logs for effective threat hunting

“Using the cloud can make IT more efficient and more secure, but only if it is implemented right,” said Rob Joyce, NSA’s Director of Cybersecurity.  “Unfortunately, the aggregation of critical data makes cloud services an attractive target for adversaries.  This series provides foundational advice every cloud customer should follow to ensure they don’t become a victim.”

The CSI for each strategy includes an executive summary providing background information and details about threat models. Additionally, each CSI concludes with best practices and additional guidance.   
 
Read the summary report here.

Visit our full library for more cybersecurity information and technical guidance.


NSA Media Relations
MediaRelations@nsa.gov
443-634-0721

NSA Releases Maturity Guidance for the Zero Trust Network and Environment Pillar

Source: National Security Agency NSA

FORT MEADE, Md. – The National Security Agency (NSA) is releasing a Cybersecurity Information Sheet (CSI) today that details curtailing adversarial lateral movement within an organization’s network to access sensitive data and critical systems. The CSI, entitled “Advancing Zero Trust Maturity Throughout the Network and Environment Pillar,” provides guidance on how to strengthen internal network control and contain network intrusions to a segmented portion of the network using Zero Trust principles.

“Organizations need to operate with a mindset that threats exist within the boundaries of their systems,” said NSA Cybersecurity Director Rob Joyce. “This guidance is intended to arm network owners and operators with the processes they need to vigilantly resist, detect, and respond to threats that exploit weaknesses or gaps in their enterprise architecture.”

The network and environment pillar–one of seven pillars that make up the Zero Trust framework–isolates critical resources from unauthorized access by defining network access, controlling network and data flows, segmenting applications and workloads, and using end-to-end encryption, according to the CSI.

The CSI outlines the key capabilities of the network and environment pillar, including data flow mapping, macro and micro segmentation, and software defined networking.

NSA is assisting DoD customers in piloting Zero Trust systems and is developing additional Zero Trust guidance for incorporating Zero Trust principles and designs into enterprise networks.

This guidance expands on NSA’s previously released CSIs, “Embracing a Zero Trust Security Model,” “Advancing Zero Trust Maturity Throughout the User Pillar,” and “Advancing Zero Trust Maturity Throughout the Device Pillar.”
 
Read the full report here.

Visit our full library for more cybersecurity information and technical guidance.


NSA Media Relations
MediaRelations@nsa.gov
443-634-0721

Russian Cyber Actors Use Compromised Routers to Facilitate Cyber Operations

Source: National Security Agency NSA

FORT MEADE, Md. – The National Security Agency (NSA) has joined the Federal Bureau of Investigation (FBI) and other co-sealers to publish a Cybersecurity Advisory (CSA), “Russian Cyber Actors Use Compromised Routers to Facilitate Cyber Operations,” outlining observed tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), and mitigation recommendations for EdgeRouter users and other network defenders.

The Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center, also known as APT28, Fancy Bear, and Forest Blizzard, has used compromised Ubiquiti EdgeRouters to harvest credentials, collect digests, proxy network traffic, and host spearphishing landing pages and custom tools. Academic and research institutions, embassies, defense contractors, and political parties are among the victims.

“No part of a system is immune to threats,” said Rob Joyce, NSA’s Director of Cybersecurity. “As we have seen, adversaries have exploited vulnerabilities in servers, in software, in devices that connect to systems, in user credentials, in any number of ways. Now, we see Russian state-sponsored cyber actors abusing compromised routers and we are joining this CSA to provide mitigation recommendations.”
 
Ubiquiti EdgeRouters have a user-friendly, Linux-based operating system that makes them popular among both consumers and malicious cyber actors. The devices often ship with default credentials and have limited firewall protections. Additionally, EdgeRouters will not automatically update their firmware unless configured by the consumer.
 
Recommended mitigations in the CSA include performing a hardware factory reset, upgrading to the latest firmware version, changing any default usernames and passwords, and implementing strategic firewall rules on WAN-side interfaces.
 
Read the full report here.

Visit our full library for more cybersecurity information and technical guidance.


NSA Media Relations
MediaRelations@nsa.gov
443-634-0721