"Offensive Cyber Security operations introduces and exercises a complete range of reverse engineering techniques and attack patterns. Students will also learn and exercise analysis of systems based on minimal information. This is a complete course in cyber attacks which enables students on successful completion to identify and test systems for vulnerabilities without full knowledge or direct access."As part of the ethics training for ANU IT students I offer a hypothetical on Cyber Warfare over the South China Sea.
Showing posts sorted by relevance for query offensive cyber. Sort by date Show all posts
Showing posts sorted by relevance for query offensive cyber. Sort by date Show all posts
Friday, May 11, 2018
Training for Australia's Offensive Cyber Capability
In the Australian Strategic Policy Institute paper "Australia's Offensive Cyber Capability" ( May 2018), Fergus Hanson an Tom Uren, ask how to build and use the capability. Part of this is simply having trained IT professionals, in and out of uniform available. As well as running courses in "Defensive Cyber Security Operations" (COMP3701), the Australian National University also offerers "Offensive Cyber Security Operations" (COMP3702):
Thursday, August 18, 2022
Expanding Defence Training via Mobile Devices
Reference
Worthington, Tom (2022): Designing for scale: How to use mobile devices to recruit, train and equip the extra 18,500 defence personnel. University of Melbourne. Media. https://doi.org/10.26188/20742451.v1
In July 2021, Ms. Kersti Eesmaa, Estonian Ambassador to Australia, talked at the ANU about how her nation was developing a sophisticated digital economy. Part of this was protecting government and civil infrastructure from cyber attacks. In April 2007 cyber-attacks were launched against Estonia, suspected to be from Russia. In response, NATO created a Cooperative Cyber Defence Center of Excellence (CCDCOE) in Tallinn, Estonia. CCDCOE now offers a comprehensive set of courses related to defensive and offensive cyberwarfare.
In March 2022 Ukraine's new Ambassador to Australia made an unscheduled speech at ANU on "Russia's Invasion of Ukraine". He said Ukraine destroyed the myth of Russian invincibility. Mr. Myroshnychenko pointed out he doesn't have a background in diplomacy, but in strategic communications, and co-founded Ukraine Crisis Media. Before coming to Australia he ran Information warfare for Ukraine. He pointed out US Starlink satellite communications system had been useful for both civilian and military communications in Ukraine. He also pointed out how Russia sought to manipulate public opinion using messages different for internal and external audiences. The Ambassador also suggested Australia could play a useful role in countering Russian propaganda in the Pacific.
Mr. Myroshnychenko referred to the use of talk shows by Russia, which manipulates emotions, modeled on those popularized in the USA. He then looked ahead to how difficult it will be to reeducate the people influenced by Russian messages. He pointed out how difficult this was, with people in Germany after WWII. But perhaps a better analogy today would be with those convinced by QAnon conspiracy theories.
The ADF will need personnel with very deep technical skills in how to protect our computer systems, and attack those of our enemies. They will also need a deep understanding of how to provide convincing information, directly online, and through the media.
In the 2022 Australian election campaign, the Australian Liberal Party has proposed an "Autonomous undersea warfare capability for Australia's navy" as part of its electoral platform (5 May 2022). The new Labor government is reported to have accelerated this program, with the first drone submarine to be built in Sydney in 2023 (Robotic submarines fast-tracked for build at a site on Sydney harbor to plug capability gap, Tory Shepard, SMH, 18 August 2022). These drones, at 30 m long, are larger than the midget submarines which attacked Sydney harbor in WWII. ADF personnel will need to know how to operate and maintain the drones.
In December 2020 I coached a team in the Navy Warfare Innovation Workshop 2020 (NWIW), at the Australian Defence Force Academy. Mixed teams of defence personnel from the Army, Navy, and Air Force, worked with civilian government personnel, and staff from defence companies, on ways to combat threats with new technology. My team came up with TIDE: Treat Identification Detection and Effects for dealing with swarms of RAS (Robotic Autonomous Systems). An important part of this exercise was having ADF personnel get used to working in diverse teams to come up with quick solutions.
VR headsets, AR glasses, and handheld devices are increasingly used as the interface for modern weapons and equipment. This allows for integrated training, using the same equipment and interface as for operation. Increasingly this is using ruggedized consumer-derived equipment, rather than bespoke hardware. This also allows for lower-cost consumer devices to be used in training, even by the personnel at home.
An important military skill is working with others. This is where mobile devices can be as important as operating drones. Personnel will need to be able to distribute
information and make decisions, with military personnel from other services, and civilians. It will not be possible to bring everyone to a central location, instead decisions have to be made on the fly (literally). Working at the Department of Defence in the 1990s, I observed military conferences in offices, in the field, and at sea. These initially required a satellite dish several meters wide, & a room full of equipment. Later this was reduced to umbrella, and briefcase size. The same capability is available in a hand held-unit.
In addition to the Navy Warfare Innovation Workshop (NWIW), there were two defence sponsored hackerthons run by the Australian Computer Society ran in 2020. These used Slack, Zoom, and the usual collaboration tools. These had hundreds of participants and about 80 mentors. The Shockproof hackerthon on Secure Supply Chains for the Australian and NZ Defence Forces was unusual as it was aimed at defence force personnel, but open to anyone.
The first time I was a graduate university student, I had to fill in a paper form and hand it in at an office. The next time I filled in an online form, the university called me a few seconds later, to check something. The third time it was all done online: I never spoke to anyone from admin, before, or during, three years of study.
Members of a militia traditionally keep their rifles at hand to be ready to fight at any time. Members of Australia's reserve should treat their government security-approved smartphones the same way. Rather than having to muster at a military base, they should be able to train and fight, from wherever they are. This may be for only a few minutes at a time, in between a regular civilian job, over days, months, or years, of a conflict.
Pedram, Shiva, Evaluating Virtual Reality-based Training Programs for Mine Rescue Brigades in New South Wales (Australia), Doctor of Philosophy thesis, School of Computing and Information Technology, University of Wollongong, 2018. https://ro.uow.edu.au/theses1/441
Why Expand the Australian Defence Force?
On 10 March 2022, the then Prime Minister announced that the Australian Defence Force personnel will increase 30% by 2040, at for $38B. As the PM noted, “You can’t flick a switch to increase your army, navy and air force overnight, growing the type of people and skills we need to face the threats of the future takes time, so we must start now so critical skills can be taught and experience gained". While the government has changed since then, there is bipartisan support for a stronger military to meet increased challenges.
 |
| Volodymyr Zelenskyy speaking to ANU, 3 August 2022, (still image from ANU TV) |
Russia invaded Ukraine in February 2022. Volodymyr Zelenskyy, President of Ukraine, made an impassioned speech to staff and students of the Australian National University, on 3 August, via video. He acknowledged Australia's contribution as the largest non-NATO provider of military assistance to his country. That assistance included not only Australian-made armored vehicles, but training in cyber defence.
On 4 August 2022 China commenced air and naval exercises involving live fire, around Taiwan, including ballistic missiles fired over the island. Taiwan responded with its live-fire exercises on 7 August. Fortunately, the situation has not escalated, but tension remains.
On 3 August, the new Australian Prime Minister announced a review of Australia's Defence posture and structure, to report by March 2023, for mobilization needs in 2032-33. An interim report is to be provided, but no deadline for this has been made public. While the review documentation mentions infrastructure, estate, disposition, logistics, and nuclear-powered submarines, the skills required of the members of the ADF, and the people who support them, are not mentioned.
What New Skills Will Defence Personnel Need?
Conduct Cyberwarfare
 |
| Eesmaa Public Lecture, ANU, 30 July 2021 |
Coordinate Information Warfare
 | |
| Mr. Myroshnychenko, speaking in the ANU Moot Court. Photo by Tom Worthington, CC-BY 30 March 2022 |
_-_Logo.png){kind=logo} |
| Information Warfare Division, Australian Department of Defence |
The day after the Minister's speech, the Australian Government announced a doubling of the staff of the Australian Signals Directorate, and an expansion of offensive cyber operations. However, there was no mention of increasing the staff of the ADF Information Warfare Division.
The ADF will need personnel with very deep technical skills in how to protect our computer systems, and attack those of our enemies. They will also need a deep understanding of how to provide convincing information, directly online, and through the media.
Operate Large Armed Air, Sea & Land Drones
In the 2022 Australian election campaign, the Australian Liberal Party has proposed an "Autonomous undersea warfare capability for Australia's navy" as part of its electoral platform (5 May 2022). The new Labor government is reported to have accelerated this program, with the first drone submarine to be built in Sydney in 2023 (Robotic submarines fast-tracked for build at a site on Sydney harbor to plug capability gap, Tory Shepard, SMH, 18 August 2022). These drones, at 30 m long, are larger than the midget submarines which attacked Sydney harbor in WWII. ADF personnel will need to know how to operate and maintain the drones.
 |
| Loyal Wingman supersonic fighter UAV |
Work is also progressing on a high-performance pilot-less aircraft for the air force, the Loyal Wingman, to be built in Queensland. As well as operators, the ADF will need personnel to understand the complexities of the AI software used, and how the aircraft will operate alongside crewed aircraft. The operators may use VR headsets to fly the aircraft, while on the ground personnel would use wrist-mounted controllers.
Work with Industry
 |
| Event canvas from NWIW 2020 by Paul Telling |
How Can Mobile Devices Help With Skills?
VT to Learn to Drive the Drones
 |
| ANU Defence Industry Workshop on XR, 5 November. 2019 |
The ANU College of Engineering and Computer Science hosted a Defence Industry Workshop on XR, 5 November. 2019 as part of a national Extended Reality Cooperative Research Center (XR-CRC) bid.
Learn to Work Together Using a Smartphone
 |
| Robert Lester sending a report from K95 |
An important military skill is working with others. This is where mobile devices can be as important as operating drones. Personnel will need to be able to distribute
.jpg) |
| Tom Worthington at TT97 |
Promote Reserve Defence Careers via Mobile Devices
 | ||
|
Australia can't afford to pay for all of the personnel needed with advanced technical skills to be employed full-time in the ADF. This requires expansion of reserve part-time personnel. This provides the opportunity to use mobile devices to train, and coordinate part-time recruits. Traditional war planning assumes that reserve personnel will be mobilized when required. However, the fast tempo of modern warfare may not permit reserves to be called up in time to be of use. Also, there are likely to be months, or years, of "grey-zone" operations, which do not meet the criteria for all out-war. In these situations, it would be useful to be able to call on reserves, for a few minutes or hours of work, much like the gig economy. These people need not leave their usual workplace but instead, work via a secure mobile device.
The ADF tends to use advertising promoting an outdoors active dynamic lifestyle to attract recruits. However, something more like Open Universities Australia's marketing of online university courses may be more appropriate for STEM reserve recruits. In the TV ad, the student is shown leaping from place to place but then ends with them sitting studying on a smartphone. The message is that this is something that can fit into everyday life.
Hackathons for Recruitment and Training
In addition to the Navy Warfare Innovation Workshop (NWIW), there were two defence sponsored hackerthons run by the Australian Computer Society ran in 2020. These used Slack, Zoom, and the usual collaboration tools. These had hundreds of participants and about 80 mentors. The Shockproof hackerthon on Secure Supply Chains for the Australian and NZ Defence Forces was unusual as it was aimed at defence force personnel, but open to anyone.
A Role for Universities in Research & Teaching ADF via Mobile Devices
The need to recruit and train an expanded Australian Defence Force in new technical areas will challenge the capacity of current trainers and techniques. This provides an opportunity for Australian university academics to assist, particularly using the skills and knowledge gained over the last two years of the COVID-19 pandemic. Australian universities have been forced to rapidly evolve from places that offered classroom teaching, to ones where most learning is now done online. In particular, the use of VR for training rescue (Pedram, 2018), and emergency medical personnel (Aiello, Sevigny, & Cochrane, 2021), can be directly applied to the ADF.
Some Ways to Scale
Mobile Recruiting
Recruiting, training, and managing more than ten thousand extra defence personnel is a daunting task. The technology can be used to help manage this. One way is to use mobile devices to provide potential recruits with information and guide them through the application process. Ideally, an applicant should be able to do this online with their phone in a couple of sessions, without needing to speak to anyone, unless they need to clarify something.The first time I was a graduate university student, I had to fill in a paper form and hand it in at an office. The next time I filled in an online form, the university called me a few seconds later, to check something. The third time it was all done online: I never spoke to anyone from admin, before, or during, three years of study.
Mobile Trainers
The military traditionally provides quality training for personnel. However, this can be at a high cost to the organisation, and also in terms of time for reservists. Mobile and online learning can allow personnel to train and be trained with the minimum of standing around waiting.
Industry Standard Training
A major incentive for personnel to join and remain in the military is free training. For this to be an effective inducement, the training needs to be well delivered, relevant, and recognized outside the Australian Defence Force. The military should adopt Australian civilian standards for qualifications of their trainers, and courses. Personnel should be formally trained in how to teach, particularly online, as part of leadership training. The students can also be trained in how to provide feedback online and assess fellow students, to reduce the need for specialist instructors. Students can be shown how to prepare an e-portfolio to showcase their skills. All of this will need to be done mindful of security requirements, as individual skills are a valuable source of information for potential enemies.
Uber War
 |
| Preparing reports from K95, 1995 |
Earlier I showed a photo of someone from the Australian Defence media unit, sending reports from Exercise Kangaroo 95. There is a companion photo, of me receiving the reports. But I was not at my desk in Headquarters Australian Defence Force. I happened to be on holiday, so I was receiving the reports via a pocket modem (this was last century), and adding them to the Department of Defence website, using a laptop computer. That could now all be done on a pocket-size smart device. Some personnel would require devices with higher levels of security, and which do not depend on public data networks.
References
Aiello, S., Sevigny, C., & Cochrane, T. (2021). The Affordances of Immersive Virtual Reality Clinical Simulation Within Healthcare Education: A Scoping Review Protocol.
Worthington, Tom (2022): Designing for scale: How to use mobile devices to recruit, train and equip the extra 18,500 defence personnel. University of Melbourne. Media. https://doi.org/10.26188/20742451.v1
Tuesday, September 6, 2022
Cyber-criminals as Modern State Sponsored Pirates
Professor Goldsmith asserted that Australian government doesn't have cyber-security capabilities, and has to rely on companies. I suggested that perhaps we needed the equivalent of a coastguard used to combat piracy, that is a force combining the features of military and police. Professor Goldsmith responded that to combat a network, you need your own network, but that having companies conducting offensive cyber-warfare was problematic. The solution, I suggest, is to have reserve ADF personnel, who are continually trained using educational technology, working for the companies. They can look for attacks in their civilian day job, and if an offensive response is needed, put on their uniform.
References
Egloff, F. (2018). Cybersecurity and non-state actors: a historical analogy with mercantile companies, privateers, and pirates [PhD thesis]. University of Oxford. https://ora.ox.ac.uk/objects/uuid:77eb9bad-ca00-48b3-abcf-d284c6d27571/
Saturday, June 2, 2018
Australian Government Digital Learning Design Standards
The Australian Public Service Commission (APSC) has issued nine draft Digital learning design standards for comment. The documents all start with a request
for feedback form and an overview of the standards.
Exposure drafts for the learning design standard:
Exposure drafts for the learning design standard:
- User research
- Digital performance analysis
- Service design
- Agile delivery management
- Cyber security
- Digital foundations
- Product management
- Content design
Overview of Standards
Each standard contains a six page overview. This covers the Digital Transformation Agency's Digital Service Standard, the idea of using a multidisciplinary team, their jobs, roles and skills. While useful, this duplicated material might be better placed in a separate overview document.Pathways to cyber security
The Cyber security standard indicates that a pathway is an undergraduate IT degree followed by five or more years working in IT. What is not clear is if any specific qualifications, apart from an IT degree are required. Specialist qualification in this area are relatively recent, but the ANU has begun offering a Master of Cyber Security, Strategy and Risk Management from second semester 2018.
The Australian Strategic Policy Institute (ASPI) recently released
a national
cyberwarfare deterrence policy paper (Painter, 2018), advocating unilateral reciprocity for cyber-attacks on Australia. Civilian cyber security specialists working for the Australian Government may well find themselves involved in such operations. As part of the Masters the ANU offerers not only courses in Defensive Operations but also Offensive Security Operations.
Skills First Then Knowledge
One curious aspect is that the standards have a section on mapping them
to the Skills Framework for the Information Age (SFIA) (as used by the
ACS). However the APSC doesn't seem keen on SFIA. The Cyber Security standard says says:
"... SFIA does not address knowledge, which is the main scope of this Learning Design Standard. However, the following SFIA skills are common to cyber security professionals who would be exercising the knowledge specified in this standard"
This
is a curious criticism. I had no difficulty using SFIA in learning design. With top down design the skills come first and then the
knowledge required for those skills. The APSC appear to trying to do
things the wrong way around, with knowledge first.
Wednesday, March 30, 2022
Ukraine Destroyed the Myth of Russian Invincibility Says Ambassador Designate to Australia
| |
| Mr Myroshnychenko, speaking in the ANU Moot Court. Photo by Tom Worthington, CC-BY 30 March 2022 |
In answer to a question Mr Myroshnychenko said that the US Starlink satellite communications system had been useful for both civilian and military communications in the Ukraine. He also pointed out how Russia sought manipulate public opinion using messages different for internal and external audiences.
Mr Myroshnychenko referred to the use of talk shows by Russia, which manipulate emotions, modeled on those popularized in the USA. He then looked ahead to how difficult it will be to reeducate the people influenced by Russian messages. He pointed out how difficult this was, with people in Germany after WWII. But perhaps a better analogy today would be with those convinced by QAnon conspiracy theories.
Mr Myroshnychenko referred to the use of talk shows by Russia, which manipulate emotions, modeled on those popularized in the USA. He then looked ahead to how difficult it will be to reeducate the people influenced by Russian messages. He pointed out how difficult this was, with people in Germany after WWII. But perhaps a better analogy today would be with those convinced by QAnon conspiracy theories.
|
| Information Warfare Division, Australian Department of Defence |
In the Q&A I asked if Australian could learn from the information warfare situation in Europe. Mr Myroshnychenko replied that Australia could play a useful role countering Russian propaganda in the Pacific. Also Dr Robert Horvath, La Trobe University, suggested Australia could learn from Estonia's experience countering cyber attacks.
Monday, May 21, 2018
An Indo-Pacific Strategy for Australia
Professor Medcalf suggested there is an unspoken consensus between the Australian government and opposition that Australia should participate in China's Belt and Road projects, on a case by case basis. He argues that China find the term "indo-pacific" politically loaded against it. Professor Medcalf also pointed out that France had called for an "Indo-Pacific Axis". That might be an even more unfortunate term, given the extent to which China suffered from the Rome–Berlin–Tokyo Axis in WWII.
Subscribe to:
Posts (Atom)