Life-Cycle Management - Army Logistics University - U.S. Army

20
While the developers of this security framework readily
acknowledge the impossibility of knowing or foreseeing the universe
of potential assaults, UltraLog’s defense in depth provides
a significant bulwark against known threats.
few resources, without warning, and without regard to
geography. They can be originated by pranksters, by
adversaries, or by insiders acting either unintentionally
or with malice.
IW attacks are almost as varied as the human imagination.
However, they can be categorized by the
attacker’s intent—
• Destroy information system infrastructure or
data. Attackers physically destroy computing centers
or communications resources or introduce a virus to
destroy data.
• Intercept sensitive information. Intruders access
operational databases or intercept data moving
through the communications pipeline. An adversary,
for example, could exploit compromised logistics data
to determine a unit’s materiel condition, composition,
or disposition.
• Corrupt or manipulate logistics information.
Logistics transactions and data files are modified,
duplicated, erased, or misdirected, potentially disrupting
the supply chain and reducing user confidence
in the supply system.
• Disrupt service. An adversary floods the system
with spurious incoming messages in distributed
denial-of-service attacks. Such attacks are designed to
effectively paralyze the system by preventing legitimate
users from accessing and using the system as
intended. This could prevent the processing of logistics
transactions and the transmission of requisitions
and status information.
UltraLog Security Defenses
Over its 4-year development cycle, UltraLog has
evolved a complex matrix of commercial off-the-shelf
and uniquely designed security features that provide
substantial protection against cyberattack. While the
developers of this security framework readily
acknowledge the impossibility of knowing or foreseeing
the universe of potential assaults, UltraLog’s
defense in depth provides a significant bulwark against
known threats.
UltraLog’s security functionality is guided by two
overarching concepts: agent system segmentation and
dynamically reconfigurable, rule-based protective
countermeasures. First, because of its globally distributed
nature, UltraLog security is built on a unique
framework of distributed trust that segments the agent
society. Trust obstacles stand as sentinels between the
segments and act to cordon off compromised segments,
thus preventing damage from rolling unchecked
throughout the system. Second, UltraLog incorporates
a tight, policy-based security system. This system
comprises a set of rules that is distributed throughout
the system. Rules may be flexibly tailored to respond
to changes in threat and are strictly enforced.
Policies and rules govern how UltraLog functions
and control much of the interaction among agents.
Policy is set by subject-matter experts, based on doctrine,
and loaded into an UltraLog society. From a
logistics perspective, rules might govern stocking objectives
at different levels of the supply chain. On the
security side, rules might control how many times a
user can try to log on before being locked out. Part of
UltraLog’s strength is large sets of policies and rules
that allow the system to modify the rules that are in
effect in response to changing conditions.
Other UltraLog security features include—
• User access control service. This feature identifies
and authenticates users and protects UltraLog
from undesirable corruption caused by unauthorized
users accessing the system. A unique user name and
user-provided password serve to identify and authenticate
individuals seeking to access the system. Access
mediators decide whether to grant or deny the requested
access and enforce access-control policies
whenever someone attempts to enter the system. Once
a user is inside the system, access to specific system
features is strictly monitored and controlled.
• Message protection service. This mechanism
controls the flow of damaging communications by
mediating all outgoing and incoming transmissions. It
compares messages against policy, stops all disallowed
MARCH–APRIL 2005