Basics of Information Operations 4/4

This is the part 4/4 of full paper! Based on this part there is also a paper with name: "Protecting national assets against Information Operations in Post-modern world" which was published in 2nd BCS International IT Conference 2014.

4. NATIONAL DEFENCE AGAINST INFORMATION OPERATIONS

4.1 Analyses of adversary’s possibilities and force projection logic

Next picture is showing some principles of aggressor decision making process when estimating profitability of information operation. Aggressor analyses level of operational executionability with accessibility and vulnerability. When this function is having a driver of motivation and it is balanced below line with profits gained from this operation, it is surely considered by aggressor’s decision makers.

Picture 27: Aggressors equation for information force projection

Information Operations execution needs longer time to build up capabilities but with globally connected vulnerable information systems and at least western population’s sensitivity to propaganda makes IO tools easy to utilize and they have good penetration ability through media and network of devices. Effect on target may not be as clear, but information criminal operations are giving good reference on taking advantage of vulnerabilities both at human and technology.

Adversary is analysing opponent as a system of systems network with nodes, their interrelations and components depicted in next picture. There is always five components that can be affected in a node of network: human being, information, processing, shelter and environment. Between nodes there are interactions that can be affected like communications links between processing, data transaction between information storages, social interaction between people and shelter dependence of its environment. Adversary is analysing what tools they can utilize with minimum unwanted collateral effects and how good their accessibility is through defence. They assess what effects may be caused and how they may be further proliferated within system of systems network. 

Picture 28: Example of IO targeting against inter-relations of and human-technology system of systems

Adversary is optimizing their tools to meet maximum effect, thus the interrelation topology is important for their intelligence and targeting analyses. Next series of topology pictures shows, how adversary is optimizing effect when disintegrating opponents network.

Picture 29: Example of how adversary might optimize effect with topological analyses of interconnections in system of systems structure

If interrelations topology is hierarchical, it might become more cost-effective to eliminate upper level nodes or links (leaders, command posts, information hubs or communications hubs) than mid- or low level nodes to disintegrate target structure to separate components. Human interrelations require trust to act fluently. If adversary ruins trust between co-operating parties or leaders self-assurance, he has hit most vulnerable and hardest mended asset in a social network. Chia Lin  defines quite extensively the measures that can be utilized against human social network as follows:

• "Entice away the enemy's best and wisest men, so that he may be left without counsellors”.
• Introduce traitors into his country so that the government policy may be rendered futile. 
• Foment intrigue and deceit, and thus sow dissension between the ruler and his ministers. 
• By means of every artful contrivance, cause deterioration amongst his men and waste of his treasure. 
• Corrupt his morals by insidious gifts leading him into excess. 
• Disturb and unsettle his mind by presenting him with lovely women." 

As defined in picture 28, human being still is one of the most vulnerable component in system of systems thus information operation in the end tries to effect on human attitude and behaviour. Or as Kevin Mitnick says, the most vulnerable piece of any information system is one credulous human being.  

Another very cost-efficient way to disintegrate system of systems is to attack on human trust on information integrity or service availability. Sun Tzu says that “all warfare is based on deception” and information is essential for leaders “Thus, what enables the wise sovereign and the good general to strike and conquer, and achieve things beyond the reach of ordinary men, is FOREKNOWLEDGE”.  If leader will lose trust on available information as a basis of one’s understanding and foresight, adversary has gained major advantage. Information may be attacked by deception or more cost-effectively various man-in-the-middle measures. Striking to opponent’s resource management information storage would disable their force building and rearranging both material and people. It may also hamper their ability to manage supply chain. If people and their leaders have not trained and practiced with their information systems, they tend to abandon their widgets in stressful situations if their availability lowers even temporarily. Thus denial of service attacks or using malevolent software attacks are fruitful in collapsing human trust to technical systems.

4.2 Nature of information confrontation

In basic confrontation model of two entities blue and red, Clausewitz  has defined three bases of ability: population of society, power of governance of society and force that society is able to harness to defend against adversary’s force projection. Each base is constructed of volume of personnel and matter and quality of their competence and will. This three node network is projecting force via multiple channels to create either kinetic or non-kinetic effects in adversary’s information, networks, understanding and will that is connected with military, social, economic and political structure around them.

Picture 30: Basic setting of confrontation and conflict where Information Operations are waged

If nation’s vital systems, information content and spirit are vulnerable to information operations, adversary will have temptations to attack in periods of interstate tension. Not only to affect nation’s capabilities, but just demonstrate to “audience” and other stake holders, that they have capability to do so. Information operations “playground” include also other entities and venues that can be used as “hired”, 3rd party or “neutral” forces. States may deny attacking with cyber means, but blame private hactivists for launching attacks like in situation of Bronze soldier between Russia and Estonia . Media can publish biased information like in situation, when Al Jazeera published old video footage as live on Egypt situation during summer 2013. National organizations may establish their computer network operations capabilities distributed all over Internet thus achieving force projection capability screened with anonymity like alleged North-Korean computer operations against USA infrastructure. 

Information operation can affect material assets as alleged STUX malevolent software attack against Iranian plutonium production program. Information may change the will of population in home front, have secondary effect on political decision making, which again effects military arms utilization in conventional area of operation. This happened in Vietnam War, where Vietcong Tet-operation was military failure, but originated a video footage, which was published in US television channels and changed U.S.A public opinion about Vietnam War and later affected political decision making. Similar thing happened in USSR where mothers of sons killed in Afghanistan together with economic situation aroused public opinion against the rule of communist party. Arab Spring movement was triggered by tragic news of young merchant driven to suicide together with stories of ruler’s luxurious lifestyle. The revolutionary spirit was carried on by social media and mobile phone messaging through North-African Arabic speaking nations.

As with conventional weapons Information Operation offensive forces may not be not cost-effectively disabled by pre-emptive attack since computer network tools might be already injected to target systems and are only triggered in action when needed. Information Operation Defence is the main strategy against information operation attacks unless there is capabilities of countering attack with some other arms. This is case in Russian doctrine referred in picture 3, where information attack may be countered with nuclear retaliation. This kind of extreme doctrine may be resulted of weak defence measures or it may tempt opponent to “call the bluff”. There are two main methods to prepare Information Operation Defence: Protection by Isolation or Habituate defined in next picture. Then there is U.S. Military way because they think that they cannot protect vast private sector function utilizing Internet and focus on building international structure of connection and content surveillance structure parallel with major and possibly pre-emptive computer network attack capabilities.   Similar but asymmetric is Russian strategy declaring that any defined Information Attack will be countered by nuclear strike.

Picture 31: Example of Information Operations strategies for national defence

China has been using Isolation strategy. Chinese government is protecting their information assets and citizens from attacks and international information sources by creating the “Great Fire Wall” to filter all connections and content over national boundaries and establishing national social media services, mobile access, etc. They state that: “within Chinese territory the Internet is under the jurisdiction of Chinese sovereignty. The Internet sovereignty of China should be respected and protected.” With this government has good control over malevolent content like pornography, viruses, spam and other unwanted online action. It is alleged that government is also filtering other content in the fields of political and social life. It has been also doubted that Chinese officials have hired a vast number of “online commenters” to promote “official” content and the Communist Party. This outer perimeter defence often leaves inner structure weaker but China as a big unified information and online market has also been able to get rights to produce their national version of Microsoft Operation System and Cisco IP-routers IOS-program thus being able to safeguard their basic Internet-structure inside as well as outside.

Iranian government is also utilizing Isolation strategy by building a “Halal internet”. Iranian YouTube equivalent Mehr was launched on December 2012 with government-approved videos. It is believed that national “Halal internet” grows gradually as more content and services from global Internet is being blocked. Together with shared language this approach will provide good border control over cyber and propaganda attacks from outside against Iran and Iranian people. There is no information on, how well Iranian network operators, broadcasters and citizens are protected against malevolent information and attacks launched within the nation. 

Sweden as a small nation is utilizing the Habituate strategy. While being 2nd in International Human Rights Rank Indicator , Sweden has strong screening of all Internet and telephone content going through their borders (executed by Forsvarets Radio Anstalt from 2008 ), but government do not isolate their citizens, ISP’s or private sector any other way. With exposure to ongoing Internet malevolence they harden their information sources and users; build culture for citizens to recognize misinformation by exposing them to all types; utilize all modern methods of cloud computing, information assurance and mobile access; empower public and private partnership networks to counter existing malevolent features in Internet. This can be seen in Global virus Map where Sweden is one of least infected but most networked nation in Europe. 

Information Operations present a wide field of asymmetric tactics that is utilized along all lines of operation (political, economic, social and military) without conventional arms restriction agreements, Geneva Conventions, international war legislation or other restrictions. Computer Network Operations and Electronic Countermeasures are still used quite straight forward and managed by conventional arms decision making. Operations that try to effect public opinion of target society or neutral parties are far complicated thus requiring understanding of complex social interrelation network flavoured with cultural priorities. This is main reason, why current U.S. officer training is changed to instruct more how to think than what to think in modern full spectrum operations.  

4.3 Possibilities for national defence against Information Operation attacks

Defending national cyber services and digital information assets is in most cases Joint effort with both public and private sector organizations utilizing together multi-layered security since many of the computer related services, mobile phone access and social media are provided by private companies. Defence measures include protecting national core Internet with name domain and lower level network services. User end should be maintained at high level in Information Assurance since eGovernance services are increasingly important for providing citizen’s basic wellbeing and information. Essential structures like energy production and delivery, finance, retail, health care and logistics are more information based and Just-On-Time functioning thus availability of information services is absolute to maintain citizen’s trust and society’s functionality. 

4.3.1 Defensive measures of Information Core

Defending national core Internet Service Providers (ISP) is a private and public partnership co-operation. Legislation should provide operators both right and responsibility to screen data flows that their core switches and routers transfer. They should be authorized to detect any malevolent software or attack pattern defined by governmental authority and to capture all those packets into cyber oblivion or quarantine. They should be authorized also to disconnect all “polluted” terminals in their network to stop BOTNET  activity and users should be liable to protect and clean their devices. All ISP’s operating within nation should be oblique to participate Computer Emergency Response Team (CERT) action. Government should define policies and architecture at Border Gateways within nation’s networks to balance vulnerabilities of different switching and routing operating systems. Core switches and routers should be managed out-of-band only. To make these measures more effective a regional coalition is the best solution. For example European wide co-operation provides best defence against man-in-the-middle and outside attacks for European Union.

4.3.2 Defensive measures of Information and application services

eGovernance services should be governed by computer architecture for all public sector organizations. All essential services should be distributed to parallelly available computer clouds of both private and public. National information should have preserving policy governing data storages maintained and provided from distributed sites. Information content should be checked with continuous process to prevent any one man manipulation against its integrity. All public and main private information providers should be using strong identity in provision points. All eGovernance services should require strong authentication from their users (something what they are, know and possess). Critical publication points should be distributed extending to different ISP’s and Domain Name Servers (DNS).

Defending national information driven infrastructure should include energy providers, finance organizations, logistics service providers and retail chains. Legislation and government co-operation should provide similar basis of security measures to all stake holders.  These measures should be audited by 3rd parties and neglect of remedy should be sanctioned.

Regular exercise of national public-private partnership computer defence should be arranged annually to hone co-operation skills and widen the understanding of possible scenarios and their effect. Government should also screen organizations providing critical services for their ownership, management, economic situation and long term investment to foresee any structural unbalance. 

4.3.3 Defending public competence in cyber environment

Defending national interests and creating better understanding against Information attacks requires participation of wider range of professional organizations. There should be academic level network for vulnerability studies; operational network with information security service providers; national CERT network providing information and education to citizens and users of digital services; education to information assurance professionals to be able to maintain their competence in changing environment; education started from elementary school to open adult courses on information assurance measures as a part of post-modern citizenship.

When information and communications technology is changing rapidly, there is continuous need to support citizens with multilevel support concerning information assurance issues. This is accomplished best at peer level support, where citizens can access to support provided by people of same age, culture and language from organizations in both private, public and voluntary sector. 

4.3.4 Defending public opinion and citizens spirit

Public opinion is widely distributed and volatile in post-modern western societies. Human perception is based on attitudes created in history and categorising first impresses to these “boxes of presumption”. Education should be focused more on how to think than what to think and to critical thinking capabilities in order to have competent citizens that understand disinformation both in crises and normal situations. Governmental and critical service provider’s public relations functions should be exercised to be fast and accurate in their communication. If adversary has opportunity to deliver disinformation first, it will be the base for first impression. Citizens will categorize first incoming information and there is major amount of additional communication and persuasion needed to have that first impression changed.

All information, which government and national critical organizations are communicating, should be as precise, fast and true as possible to maintain trust of citizens and stay as main information source for their needs. In the future this might need a strong identification of all users in social media and other discussion forums. After all, real world requires also personal identity when one is transacting officially.

4.3.5 Defending national political decision making capability

Political decision making is dependent on competency of politicians, quality of information they are supported with, co-operation of their subject matter support teams, durability of diplomatic relations and direct channels to their voters. All these links and abilities should be secured from both man-in-the-middle and outside attacks. There is no way for any politician to possess required thoughtfulness, insight and foresight to make decisions in crises situations, if it is not being exercised. Scenario analyses with war and role games should be normal routine for key politicians to practise decision making and co-operation between different shareholders both in home and abroad. 

Government should be able to gather information continuously from different sources and fuse it for better current situational picture. There should be collaboration services available and in use between politicians, public agencies and private organizations to create teams for analyses and planning on demand. There should be officials able to manage complex sense-making and planning projects. There should be body of officials to perceive, analyse and define future scenarios for both normal and crises situations. These scenarios should be planned further to detail and possible measures that can be executed on demand. As strategic surprise is most wanted situation for adversary, all leaders should be practising political-strategic level decision making to counter this possibility.

4.3.6 Defending national electromagnetic space and usage of frequencies

Defending national electromagnetic space requires national competency of electromagnetic authorities, co-operation with other countries in the area, capability to detect and locate intrusive transmissions both outside and inside nation’s borders and military measures to put out any transceiver within area of effect. Since private and other governmental functions have developed dependence on electromagnetic frequencies, adversary with some artificial intelligent transmitters or vast number of simple transmitters can interfere majorly all critical functions. Military is continuously training in interfered electromagnetic environment thus they master measures to counter effects. This is something that other agencies and private sector do not. There should be possibility to utilize several parallel channels for mobile access like 3G, 4G, WIFI, SATCOM, etc. for ensuring critical access. This roaming should be defined as base requirement for all mobile services utilized for critical functions. Thus single channel failure should not end up with entire service break down.

5. CONCLUSION

Information Operations have extended in post-modern world mainly because of pervasive information technology and information services both citizens, governments and private companies are dependent of.  But also because individuals and societies are more connected to each other and dependent on continuous flow of information. Since trust is imperative between both in men-to-men and men-to-machine relationships, it is possible target to both inborn and out-born effects projected by possible adversary. Cyber space has introduced totally new way to project effects on information and cognitive levels and as Internet of devices extends it will open channel to affect physical level as well. 

Nation can defend their freedom of Information and availability of Information and Communications Technology Services by either Isolation or Habituation, which are both applicable but require totally different structures, political culture and governance. Information Operations are not only state level measures, but can be utilized at very low levels and by small entities. Single terrorist cell can project its threat against whole nation by publishing videos of small scale physical violence, but effecting vast public attitude amplified by Internet. One man can reveal secrets of decades of work in building clandestine intelligence capabilities. One disconnected application service provider can take down major parts of Internet core switches capabilities with Denial of Service attacks. it requires multilevel preparations of defence executed together in public-private-voluntary sector alliance extending over national borders. Unlike conventional operations information operations are ongoing at strategic, operational and tactical levels even in peace time. If nation is not countering and preparing for these operations, it is an easy target in area of global confrontations and crises.

A Story of ICT management situation from 1997

By Juha Mattila, Col (ret), studying in Aalto University, Finland 7.3.2014

Contents

- Description of situation in the beginning
- Situation in Application development department
- Three possible courses of action was defined to overcome above mentioned challenges

    1. Isolate application developers from clients, apply more control but simultaneously   

        increase agility to be able to answer client’s requirements

    2. Let situation be as it is but gradually build better readiness to do firefighting
    3. To utilize strict line organization with more midlevel managers and specialized developers
- Summary

Description of situation in the beginning

In 1997 I was one member of the management team for newly assembled Centre of Information and Communications Technology of Finnish Defence Forces (CIS Centre of FinDef). It was the first time when FinDef tried to integrate telecommunications with information technology and to create common architecture with centralized development. There were four main departments in the 1997 started ICT-Centre: R&D, Applications, Infrastructure and Network Operations Centre. These departments were supported by small administrative unit of HR, Procurement, Security and Supplies functions. This paper is based on my subjective perceptions of that time and events as one department head. Thus this paper is not a study but might be used as a source of examples.

It was the time when FinDef Intranets were updated to IP-technology, Data connections reached n x 2 Mbps throughput, all garrisons were provided with Local Area Network, Applications were implemented each in their own server and different security domains were isolated with Virtual Private Network connections and physically separate servers, LAN connections and workstations. Almost all administrative departments/functions in FinDEf were either developing or using their own IT-systems like VAX/VMS/Oracle based application for material registry, MS SQL based application for enlisted HR, VAX/VMS/Oracle based application for reservist HR, UNIX/Oracle based application for C2 and NT/Lotus Notes based application for office automation. Additionally Centre was able to support VAX/VMS based subscriber database system for PABX-system, maintained two major PABX-systems (LME MD and ISDX) and vast network of PDH and SDH technology using both cables and microwave links. All this was managed from one network operation centre that controlled several CIS -units in provinces.

The original management group of CIS-Centre was trying to integrate the development and maintenance of Information and Communications Technology as much as possible, save man hours and introduce first centralized services to all users in Defence Forces. Before establishing the Centre management spend many hours in workshops trying to define main processes for centre to improve its productivity. It was recognized that one of the many problems was legacy attitude for client relations. Application development teams were functioning in isolated pipes with good relation with clients, but with no cooperation over team boundaries. This culture lost all synergy possibilities of utilizing same technology albeit in separate servers. Communications developers had more like command relationship to operator organizations in each military province. All development came from top to bottom and no-one was listening user needs nor their opinions of malfunctioning telephone services. Network operation centre was using very primitive Telecommunications Management Network -based processes but they were not extended to province centres, which were doing all configuration management.
 

Situation in Application development department

1. Functionally structured department

Application development department was a unit of about 50 experts in application development. They were structured in teams that were very close to process owning department like HR, Materiel, Finance, Readiness, Operations, etc. Together 8-10 teams were dedicated each to development of their process domain. It was almost impossible to rotate experts from one team to another when major implementation phase was done. Starting of a new project required always recruiting. At same time there was a trend, in which every department in Defence was trying to improve their functions by developing at least one information system of their own. This tendency was threatening to multiply the number of developers without clear business case or the return of investment calculations for each application initiative. Every system was developed around individual datamodel, so there was no way to automate datatransfer between systems cost-efficiently. End users were frustrated to retype simple information via each different interface and gradually databases were suppressed by many human based errors. Organization is depicted in following figure 1.

Figure 1: Status of organization in the beginning

Since most of work was done in projects, vendors were also utilized in stove pipe way. Cohesion of each project was good, but process owners were paying similar functions multiple times to same vendor. Information exchange between projects was rare and sometime even denied because of fabricated “confidentiality”. Vendors were more than eager to enforce this kind of ignorance within client organization, but were first to share information at key client relations management level.

2. No architecture or any other framework to guide development

Clients were developing their functions and processes without any framework that could have integrated either processes, functions or their supportive applications. Ideas poured and projects were started almost continuously. New tasks were mixed with existing tasks and often prioritized ahead. One implementation led often further development so small initiative might become a major program. In-house programming was gradually substituted by outsourced programming or tailored commercial of the shelf applications. 

3. Increased interrelated complexity and pace of changes within lifecycle created additional problems

Getting everything together for needs of 120 garrisons became harder each day, when more elements was introduced within same structure. When changes were introduced, the whole structure was in brink to come apart. Operating system update required always testing and usually either porting or reprogramming of the applications. Development of GUI and presenting new information required changes in database and datamodel. Changed components were integrated directly in operation without any order or serious system pretesting. This produced a lot of re-engineering, root cause analysis and reprogramming. 

4. No information sharing across team boundaries

Teams did not know what others were doing. There was no possibilities to learn from others since people socialized only within their domain. Working culture was competitive and team leaders urged their team members for better achievements compared to other teams. Problems reoccurred and feeling of unjust was easily expressed. Some individuals were irreplaceable for specific clients. One programmer did code the whole application and without proper documentation had an opportunity to “blackmail” both client and department head.

5. No unit spirit or identity as a Centre

R&D department tried to produce standards and “best practices” for development and programming but either people were too busy to really adapt them or were too “experts” to utilize anything but their own procedures. Process workshops presented hundreds of specific processes that were almost individual in nature. There was no unanimity over main processes since every team was praising their speciality and superiority over other teams. Overall the centre was a collection of very different and geographically isolated units, that had no feeling of creating anything together.

 

Three possible courses of action was defined to overcome above mentioned challenges

1. Isolate application developers from clients, apply more control but simultaneously increase agility to be able to answer client’s requirements

Basic concept was to put some distance in client-provider relation, increase common testing and prototyping, centralize vendor management and shorten the duration of delivery tasks. Main changes are presented in next figure 2.

Figure 2: Productivity by isolation and agility

1A. Build isolation between client and developer team without losing good relations

First challenge was how to loosen the relationship between IT-development project and process owner without creating too much friction to otherwise warm relations. A role of process/domain analyst was created to provide process owner more services and holistic information of possible solutions than single team was able to do. Since dedicated team was also restricted to few systems and few technical solutions, process owners soon noticed how much better service they were getting from more experienced and initiative analysts. 

Analysts introduced other developer teams and their products to client, which in the end served better client, but also shared work over developer team boundaries. Both productivity and effectivity of IT-development department improved with this change.

The change required that best people was appointed to analyst roles and they were involved in all solution and technology improvement processes. Also their understanding of processes was improved with training and visits to client’s exercises and facilities. In the end it came down to personal relationship between client representative, analyst and leader of legacy team. If there was misunderstanding, power struggle or otherwise wrong attitude, the relationship was neither productive nor effective. In order to settle these wrinkles, department head had bi-annual client meetings, where all issues were tackled.

1B. Add control but utilize shorted iterative periods to deliver

Second challenge of long projects and inflexibility was resolved by introducing shorter periods to produce a required service. Annual projects were gradually divided into smaller windows: half a year – quarterly – monthly. This enabled department to utilize resources more flexible, because development teams were able to execute other tasks while their primary client was busy elsewhere. Some idle team members were also “rented” temporarily to other teams that had periodical pressures. This enhanced load balancing and in longer term helped to lower some boundaries between legacy teams.

Prototyping and modelling was also introduced in application development to improve understanding of requirements in one hand and to produce possible solutions on other hand. This procedure created the first iterative approaches that were well received by clients especially in user interface development.

Some teams were unable to adapt to shorter “sprints” and they went behind their process owner to get support to their special and untouchable status. This was mitigated by long discussions with client and increasing transparency of team’s work.

1C. Intensify shared testing, prototyping and integration

Since infrastructure and middleware development was outsourced to another department, there was a big change in testing and integration procedures. Infrastructure department provided an updated platform with connectivity, operating systems, database applications and necessary middleware like session encryption. Today this is called platform as a service (PaaS), but in those days it was just rationalizing technical maintenance and development by dividing responsibility where it was reasonable. Infrastructure department hosted laboratories where application department went to execute integration tests and functional tests. Late 1990’s interdependence started to affect in IC-technology and gradually system of system testing was mandatory to sustain availability of integrated ICT-systems.

Sometimes vendors were invited to demonstrate their new technology and solutions side by side with existing technology, so experts were able to capture direct information on new developments. Later this was extended to wider demonstration exercises with multiple vendors on site same time.

Infrastructure department was forced to establish fixed delivery timings for changes in operational systems, which introduced natural change and release management. This was good also to application development teams since they had series of change windows to integrate, to get approved and to have released their new versions.

Some application teams were unable to utilize common platform. They were saying that their system is too tailored to run over standard and security hardened platform or that their system is so confidential that no one else should have any information of their configuration. All this was mainly signs of misunderstanding or unwillingness to adapt new procedures. Some unprofessionalism and quality failures also surfaced during these testing sessions. 

1D. Have common control over vendor utilization

A separate acquisition department was created to take care of all procurements and purchases. Fortunately this department included also best overall understanding of markets and different services vendors were providing. This enabled close cooperation between development department and acquisition department without normal friction caused by power struggle, unclear process or different language. 

Procurement process was improved both in speed and quality. Individual licences were bundled together and new enterprise license agreements were negotiated.  Mass products like desktop applications were standardised, all units under ministry of defence was taken under the same license agreement, which brought both agility in application usage and savings in total costs of desktop applications.

Some teams were too close with their “royal” provider to be able to utilize improved vendor management. They were saying that only current vendor was able to provide their “special” needs. This is normal to human societies as social relations are sometimes stronger than logical realism.

1E. Stick change with new measures

There is always human behaviour behind all processes and procedures. A manager with strong will and authority may be able to sustain new processes but if they are not adapted as every day behaviour, old habits will return when authority vanishes. New behaviour has to be rewarded and old behaviour has to be sanctioned in visible ways or else old habits will emerge again. 

Annual service contracts between development department and process owners was introduced to give both short and long term goals to everyday work. Annual team member award was given to experts that had been both socially and professionally productive members of their basic team but also in supporting other teams.

Best way to stick change is to utilize continuous improvement measures (LEAN management), where both individual, team and unit situation is displayed to all stake holders. This transparent measurement should not be used only to drive throughput, but more to drive initiatives to improve processes and methods of work.

After transformational leader was rotated to another positions some of the teams returned to their old habits, because no one was requiring any more new procedures. A mere transactional manager is not enough to stick changes if they have not been adapted as part of normal behaviour.

2. Let situation be as it is but gradually build better readiness to do firefighting

This course of action is not after major changes but rather supporting continuous development and evolutionary approach to allow people, organizations and processes to gradually improve their productivity. This approach may be utilized when people and culture of organization are not ripe for major changes. The structure of this kind of organization is depicted in following figure 3.

Figure 3: Productivity by enabling gradual improvement

If there is no way to prevent adhoc tasks coming from process owners directly to developers, one might be able to improve teams “fire fighting” capabilities. On the other hand major projects should be also executed, so agility is needed to get both adhoc and long term tasks done. Sometimes organization culture is unable to change because of deep habits of functional silos or earlier attempts of change have created spirit of failure and fear. These situations needs very small steps, that people do not see them fearful or unsecure and series of visible quick wins to build courage for advance.

2A. Backoffice support to gain from centre of excellence effects

If teams are too deep in their “fox holes” to change, it might be possible to create small backoffice team of several experts to support others. This backoffice team may be only a pool of high skilled resources that are employed to support other teams when load is overbearing. Better situation would be that backoffice is a real team, that can outperform the legacy teams and show to individual workers an example of new behaviour. Recognized teamwork may tempt frustrated but good workers to join and gradually culture starts to change. If backoffice workers are best experts, they will also gradually start cooperation over team boundaries by spreading ideas with peer-to-peer relations. Some legacy team leaders may recognize from this, that with sharing and cooperating they gain better results. Some legacy leaders will perceive this hostile action and initiate some countermeasures to sustain their power.

2B. Add cooperation by utilizing infrastructure department and their integration environment

Bringing experts together to solve their shared problems also enables transformation of siloed culture. In this case infrastructure department build and maintained laboratories for full ICT-structure and all application were forced to be tested before delivery to operation. In controlled testing environment teams were forced to co-work with infrastructure teams and gradually with their “competitive” application development teams. If testing was not controlled, there was possibility to create more confusion and frustration than productive cooperation. This required expertize from line managers and maturity from their development change management process.

Keeping development team responsible through the whole fielding time of their products integration and quality, helped teams and their members to understand their liability and learn to improve their programming and testing processes.

2C. To enable agile teaming with added situational awareness by task boards and change metrics for rewarding people

To tackle the lack of awareness, a task board was introduced. This tasks board was structured to present ongoing development tasks and their status. Teams were responsible, in Kanban style, to update board and task proceedings each day. In the end of each week team heads and department management gathered around boards to review situation. These sessions included minimizing Work-In-Process (WIP) by allocating backoffice resources and by redirecting tasks over domain barriers. Gradually this increased awareness within the whole department, introduced skilled people over team boundaries and created more spirit as a development unit.

Within teams this enabled change of responsibility from individuals to teams, when all members saw situation and workload. There was no need to ask or require help, since everyone available saw who is needing help at time. Human Resources key performance indicator were also changed to focus more on team outcome than individual results. When helping others improved everyone’s performance appraisal, team work seemed more fruitful even to most competitive programmers.

3. To utilize strict line organization with more midlevel managers and specialized developers

This course of action is relying on traditional line organization with functional units and authoritative managers. It will create control when situation is almost chaos like. It will also add administrative marginal and kill some initiative and responsibility at expert level. The structure of this organization is depicted in following figure 4.

Figure 4: Productivity by control, functional centralization and management

More authoritative approach is working in situations where people have lost trust to others, culture of the workplace is more like “kill or be killed” or personal approach is more like “I am great, but others are not”. In military environment especially this line organization approach is in very core of the culture and adapted behaviour. Biggest challenge is to choose leaders that really know what teams are doing and possess also some social intelligence to cope with different people. This is especially difficult in expert organization. For people this is the easiest and comfortable structure since they are not responsible but their own behaviour. Superior takes responsibility of tasks, processes, quality and outcome. 

3A. All tasks are controlled via line managers, no individual is allowed to receive tasks directly

Line managers took all responsibilities to communicate both with clients, vendors and other units. All tasks were given by managers and control was strict for both individual behaviour and contribution. This did stabilize situation and improved productivity of simple tasks. The negative side is that it also made individuals more passive and unable to execute complex tasks in adhoc situations without constant control by manager. So team silos were taken down but the spirit for teamwork was also lost. Some of the previous team leaders resigned because of lost status and authority. Experience and client relations was lost with them. Most negative situation was created if client hired former team leaders as their consultants since ex-leaders had either very negative approach to former department or had intentions to regain their team lead status as the project lead assigned by client. When handpicked initial line managers are being rotated, whole unit might fall into non-productive phase since drive was based on leaders personality and expertize.

3B. Everyone is reporting by hours, tasks and outcomes to management system

To improve managers control over tasks and individual contribution, a reporting systems was introduced where each worker noted their tasks, hours spent and output delivered. This enabled managers to get quantitative information and give both positive and negative feedback. Workers felt that this reporting was violating their earlier freedom and increasing unnecessary administration. A scoreboard of executed tasks was introduced to give direct feedback and enable social pressure. This improved competition amongst some workers, increased stress to some workers and was utilized untruthful way by some workers. Scoreboard did not have same effect as Kanban board nor was it a best base for Lean development but it initiated a controlled change of behaviour.

3C. With more specialized developers their throughput is increased thus productivity increased

Within bigger units some experts gained peer appreciation by executing more tasks with better quality. When managers were both recognizing their improvement and giving them more challenging tasks, their well-being within working society improved and they become new role models for other developers. As original Taylorism has proved, direct feedback to developer increased his productivity and specialization increased throughput. If rewarding was not positive and meeting individual expectations, a hard working developer become stressed, frustrated and was finally seeking other jobs. 

Through recognized individuals there was better situation to start building team work than when work society is in chaos and there is no trust between people. Team work beats individual based productivity especially in initiative intensive and agile working conditions.

3D. To utilize lean methods to increase productivity

Managers were trained to divide projects to smaller tasks and introduce them independently to developers. This increased integration problems which was managed by both adding overall integration team and by defining development tasks per singular tread of capability. Shorter task duration introduced new kind of flexibility, since line managers were able to reprioritize more frequently the resource utilization of their unit. It also helped to balance workload more evenly among developers although there was and remained to be different productivity levels within development teams. 

Since productivity remains to be both personal, social and expertize issue, a gradual key performance indicator structure was set to drive developers towards initiative and cost-effective solutions rather than continuous patching or reproduction of old code.

Summary

Since there is no one best practice to solve such large variety of challenges, we ended up to utilize all above explained courses of action tailored to each situation, unit and client. This was because teams were at different maturity level, there was no unified working culture and projects were in different phases of development. Neither was transformation planned but rather a series of trial, error and final success steps. Leaders were also different since others were more technical experts than leaders and some more transactional than transformational. With tight cooperation the management team was able to adjust transformation as it was implemented in parallel with balancing essential ongoing development work and building future capabilities.

Later all emerging capability was destroyed by more traditional military management which took over when transformational leaders were rotated to other tasks. They did not feel secure with ongoing transformation but implemented basic line organization supported by staff. They thought that a staff could manage all planning, client relations and vendor management with another feature of Taylorism – central planning. They killed all initiative from developer level and gathered responsibilities from lower level to unprofessional staff level. They withheld all decision at upper level and supressed middle level manager’s initiative and responsibility. In one year’s time the productivity of whole centre was down to half from previous year. Process owners were unsatisfied and starting their own application development projects leaning heavily on vendors capabilities. Garrisons were forced to increase their own IT personnel to fix availability and integration problems. Shareholders were starting to see Centre more as burden in budget rather than value adding organization. All this happened because new management was not educated enough to client – provider – subcontractor value chain management. They did not understand the difference or management between stable functional production and producing one time solutions in to complex systems environment with high expertise team work of both in-house and outhouse resources.

Some thoughts on vulnerabilities of information and communication technology

Situation

As information technology has become more intelligent, Internet of Things is extending as we speak and major part of ICT-production has gone after cheap labour and vast investments in Asia, there is again hype to talk about hidden backdoors in foreign manufactured devices. USA government has criticized Huawei being too close to Government of China, Russian papers are telling tales of spying chips in Chinese made household devices, alleged backdoor has been found in U.S. manufactured router, Smart TV from South-Korea has been sending user information to Internet, U.S studies have proved that manipulation of IC-production can effect random generators quality. 

This reminds of times when everybody was worried when MS NT operating system was trying to contact Internet from closed network, everybody new that U.S. Military Foreign Sales devices included downgraded encryption and backdoors, there was story of backdoor in French missile that was utilized in first Gulf war. At that time military procurement was requiring to have source code of a product to check any malevolent behaviour. 

The fact remains that no single producer system is 100% proof against vulnerabilities, weaknesses or malfunctioning parts, whether they are intentional or happenstance. Only way to be more certain of integrity of systems is to do them oneself with huge risk of unintentional vulnerabilities or utilize open source code and hope that enough experts have been playing with code to find major problems. If this is not possible one can mix different products together to balance their individual weaknesses and require as open management, synchronizing or signalling interfaces as possible. For military user it is not problem if single device is malfunctioning but a catastrophe if whole fleet of devices is not available when needed. One should cut these single vendor chains if possible and sometimes do that even at cost of more arduous maintenance or operation.

What to do

There are some things one can do to help mitigate risks as follows:

Create reference environment, a small world of every device configuration found in actual operative system of systems. 

• With this reference environment one can do number of tests to find out how each device is behaving in abnormal situations.
• Every update or new product should undergo vigorous testing before they are delivered in to operative environment.
• Some wireless devices should be tested in Faraday’s cache in case of unintentional transmissions and find any undefined transmissions in echoless room.

Conformance or type testing to find out any anomalies differing from specification:

• Test linearity of device against some references. This is to find any anomalies between input and output compared to other similar devices.
• Test with overload to find out behaviour in asymmetric circumstances
• Test with changed inputs in all ports to find unspecified behaviour
• Test with exposure to electromagnetic radiation to find level of immunity to outside fields
• Test with High Powered Microwave to find out vulnerability to excess radiation
• Protocol testing to find behaviour with other devices that are assumed to follow standard.

Mix system structures of different providers. Since no ICT –product or provider is 100% trusted through whole life cycle, it is advised to utilize devices of different vendors together:

• At physical layer one can utilize different fibres, links or wires to balance any singular weakness
• At link layer one should rely on open standards and mix different manufacturers devices if possible or utilize parallel mediums with different links together to provide maximum availability
• At network layer mixture of routing or switching devices may be combined but problem may arise with end-to-end management or with proprietary functions
• Cyber defence in depth requires always multiple structures at higher layers. These structures mix different operating systems, different databases, different middleware and even different programming together with domains of cyber defence. One should try to cut any session at least once.

Build integrity with encryption. Sometimes implementing encryption at special ways may nullify backdoors that try to gather information.

• All media and links can be tapped so strong encryption is needed at bulk transfer level. It might be done at wavelength multiplexing level to enable high throughput or at link level to enable different manufacturers. 
• Network level encryption will protect from lower layers sniffers.
• Session level encryption is good when roaming among various access services. 
• Content based encryption is best to protect information itself but it does not protect systems from insiders, man-in-the-middle or backdoors.

Take care of all auxiliaries as well as main system.

• Management system is most obvious avenue for any logical attack so management systems should be checked and tested even better than actual nodes.
• Electricity is a proponent avenue for many effects or information gathering. Any power supply should be tested thoroughly and inbound electric wiring analysed for excess modulations.
• All wiring should be tested time to time for additional devices that have been installed during or after implementation of actual system.
• All AC, water, piping or drainage systems may be used as platform for malevolently behaving functions.

These are just some examples that can be done in mitigating single manufacturer risks in military ICT -environment.

Narratives of Life: fifties

When I reached fifties I took time and effort in changing and integrating cultures of my organization by gradually involving them into new challenges and offering mentoring and help tailored in their specific needs. I even fabricated some crises to weld people together by outside threat. I was also distributing projects so that there were always parallel paths in process. If one path was delayed, another path was advancing and I met my goals on time. I was able to deliver planned services with my organization but not successful in transforming them to capabilities.

Users were more keen on clinging existing tools and procedures than adapting any new ways of working. My technical level effort was not transformed to new procedures and further capabilities. I was using advanced technology, good practices and people to deliver world class information services, but my superiors were seeing me more an expense rather than enabler. Successes inside were not translated as achievements outside of my organization.

I tried to create examples. I asked Commander to act as an example, use new services himself and demand his subordinates to utilize them also. I was using collaboration tools weekly to manage my own distributed organization and thus create examples for my people to market to their organizations. I required my staff to utilize wiki to manage both current operations and planned issues. We were really flat and effective Information and Communications Technology (ICT) organization, but still users were shy to adopt new tools.

Together with other process owners we initiated process transformations: renewed fighting with Chief of Operations and inspectors of Infantry and Sappers utilizing battlefield management system; improved reconnaissance with head of Intelligence; enhanced artillery fires with inspector of artillery; standardizing the Command and Control processes with chief of readiness and maintenance of programmable electronics with head of Logistics.

We defined progressively advancing measures for each field exercise for troops and instructors to improve their new skills. We composed joint exercises to give meaning for co-operation and new tasks to benefit from new ICT-services. We produced concepts, guides, presentations and videos to utilize by instructors in their changed training. Every occasion was used to reward any behavior towards future model. We planned an information operation to get people and units to change their behavior and culture. This was possible only with shared understanding and unified effort to make change for bigger goals than any one unit or branch were able to accomplish.

Only after core business owners started transformations I was able to gain capabilities defined and my staff started to feel being a part of something bigger and doing meaningful work. I learnt that if you want to make a change, first you have to get people moving to be able to steer the movement.

Today I sometimes think that I know how world is running. For these occasions I have a wall paper titled Egocentricity. Human being has a tendency for being like this:

• Egocentric memory is a natural tendency to forget information that does not support the adopted line of thinking. 
•  Egocentric myopia refers to thinking within an overly narrow point of view. 
•  Egocentric righteousness is a tendency to feel superior based on the belief that one has actually figured out how the world works. 
•  Egocentric blindness is the natural tendency not to notice facts and evidence that contradict one’s beliefs or values.

After this reminder I continue humbly my journey and try harder to understand better how world is functioning, people behave, societies interact and technology develops towards more complex and integrated global system of systems. Remembering that even producing a simple toaster from A to Z is not possible for any one man alone.

Narratives of life - forties

When I was in my forties I thought that managing programs, making sense of everything, meeting people and telling stories of safe road and better future were the keys to make things to happen. I was managing programs of hundreds of millions euros, which were meant to change behavior of thousands of people. Since time table was really tight and I had to detach money from current operations to finance the change, I was forced to use a lot of outside help in planning and executing the transformation. I did manage change through the whole Doctrine, Organization, Training, Material, Leadership, Personnel, Facilities, Information and Integration sphere extending over four years. Transformation was done gradually and I did my best to walk my talk among people.

I was lucky to work with some bright and executive people so technical transformation went well according the time table partly also because it was supported strongly by outside experts. But I failed miserably with my own people. I was hoping of joint effort within integrated project teams. Wishful thinking! In planning phase my own people took role of auditing rather than co-planning. In design phase they adapted role of judgement and criticism rather than sharing information and gaining competence. In implementation phase they were good only to comment advance from seats of stand. In the operation phase they were not capable to take new systems under their administration as an organization, but I had to hand pick individuals and give them responsibility in operating new systems. Despite the time and money spend in my people, they were not ready to take new steps towards future and grow along program.

I had stumbled on the culture of workplace. I thought that people I had worked with were eager to make changes after some years of lower activity, but I was wrong. The culture and attitude had reversed from where I had left them four years earlier. They had lost their common spirit and were divided into small groups of “tribes” with different mindsets. Some people were almost aggressive in their reaction declaring that “world sucks and you are from deep behind with your talks”. Most were is status that “we have already tried that – it won’t work”. And some people were trying to shine more than actually doing something. As organization they were not ready to start any journey of transformation so they marginalized themselves to be audience rather than players in the field.

I lost those people. It was not enough to give people as clear technical concepts as possible. It was not enough to appoint capable managers to head projects. It was not enough to have talks with individuals and motivate them. Social structure, common spirit and adhered procedures kept good people from changing. I had to work around this group of people and just feel miserable of their situation.

Later I learnt about organizational cultures and their readiness for change. I studied social structures in workplaces, how culture eats systems for breakfast and challenges of tribal leadership.

To be continued...

Basics of Information Operations 3/4

This is part 3/4 of the whole paper

3. ABOUT INFORMATION DEFENCE OF GLOBALISED SOCIETY

In all military art of operation asymmetry, deception and unconventional execution is a basis of planning. No single dominance can only outperform asymmetric opponent for longer period. When human being is a part of system, he is almost always the weakest link or single point of failure that may be exploited by adversary. Even though sustaining military secrets and complexity of post-modern societies makes effective attacks difficult, the basic principles of human behaviour are mostly known and thus exploitable.  Defence of one’s information freedom does require asymmetric methods as well as attack and, since people believe the first information better than post-explanations, attack is often the best way of defence.

A very good example of asymmetry is the case with North Korea, who has been waging computer network attack against its opponents South Korea, Japan and USA for last four years. Although its own digitalization degree is very low, vulnerability for computer network attacks is diminutive and state propaganda machine has very strong grip of in-state information, they have built strong computer network attack arm that is launching information operations outside of their country. They infiltrate to information systems, inject malware in critical points utilizing zero day vulnerabilities and activate effects simultaneously like it was done on 20th of March 2013, when South Korean bank and media outlets were jammed and about 32 000 computers boot records were wiped out in ongoing operation called “DarkSeoul”. DarkSeoul operation is depicted in the following picture.

Picture 19: Four years of DarkSeoul activity explained by Symantec.com

This is a typical asymmetric strategy, when attacking society itself is almost immune to IO, but their opponents are very vulnerable. Attacks are further disguised to come from different parts of Internet and it has taken long time from global security companies to gather factual evidences on North Korea malevolent actions. Attacker has also improved their attack profiles as defender has increased their countering capabilities. Both have learned from other similar operations elsewhere in Internet.

3.1 Information technology as target

Information technology itself is a very dynamic target. Processor capacity is doubling every 18 months according Moore’s law. Since software has become very complex interactive entities, there are more mistakes and possible vulnerabilities, thus software providers have to publish new versions every month or at least twice a year to patch their products. Amount of digital information in world is multiplied by 3.6 every year as shown in following picture by IDC.

Picture 20: IDC estimate on how volume of information will grow but number of IT professionals is not increasing in proportion

IT-architecture is changing roughly every 5 years. If one follows computing architectures during last 30 years there are following waves of change:

• Early computing before 1980's utilized centralized computer ending with mainframes with virtual structures. Users were using terminals i.e. only screen and keyboard and connected to mainframes by data communications when all processing was done in centralized computers.
• 1980 to 1990's integrated circuits and personal computing enabled distribution of processing and software. Even mainframe tasks were distributed by local servers usually serving only one function. Application development was driven by singular functions of administration or industrial process, which ended up having several information systems within enterprise doing each tiny bit of processing in isolated stovepipes.
• 2000's saw first attempts to integrate separate systems in to larger entities to cut down the amount of manual data re-typing and integration costs. Enterprise resources management started to centralize computing again with thinner clients using n-Tier -structured applications and cloud computing (new version of mainframe computing) was introduced in Internet domain. 
• 2010's is seeing cloud computing continuing strongly but new wave of distributed computing is being invented. Internet of devices is being defined and plenty of research is done in peer-to-peer communications and computing between different machines.
• 2020 might see IT-architecture extending to networked devices (to TV's, car's, wearable devices, domestic devices), knowledge improved industry, personal information management (digital real time diary) to name couple of examples. It is either more networked society between people and machines or the wave will change towards closed information societies. 

Although information and telecommunications technology is changing fast, hence it is more difficult to build lasting countermeasures, it opens also new avenues and vulnerabilities to be exploited by attacker. More complex interrelationships between people and machines create opportunities for attack and Internet becomes so integrated, big and important, that there is problems to patch vulnerabilities of the very core protocols and functions.

3.2 Information as an asset for industry, governance and military force

Information structures and containers have changed as well:

• From files in folders to documents in web pages
• From file downloads to live data streams
• From files to relation databases and further to web-service structured information services.

Information defence has a main problem with dynamic structure of the defended assets. Legislation and policies tend to be too late, because technology and utilization of information is changing so quickly, opening new possibilities for humans and machines to interact and process information. Information and ICT -systems are interconnected globally creating an entirely new space of cyberage. The Cyberspace without nationality, without international legislation, pervading to each part of living from human birth to death. This is making citizens, states, industry, economy and defence more dependent on ICT-technology and Information Assurance (Confidentiality, Integrity and Availability) than any time before.

Information Management has been the major enhancer of productivity in private enterprises and public organizations. The Information Technology structure has changed with technical innovations, but also with business integration requirements:

• During 1980 - 1990 Metaframe information processing was distributed to function specific servers and applications. Information was modelled within single function and stored in relational databases. Interoperability was done manually, mainly retyping information from papers or printouts to other systems. Information was processed mainly locally because connecting sites with high capacity networks was just happening. Security was accomplished mainly by physical and personal security measures in fixed locations.
• During 2000 function based data processing was integrated into branch, division or enterprise level systems. First Enterprise Resource Planning systems was implemented and extended internationally. Digital transactions (EDI..., X.400, ANSI X12) between companies were established to improve integrity of information and speed up interaction. Information models got complex and federated models was introduced. Information assets concentrated to big systems and their integrity and availability become issue. Information Assurance focused mainly on systems security and implementing security controls and devices. 
• During 2010 integration went further. Enterprise Resource Management Systems were built and networked with other enterprises by transaction broker services utilizing XML-structures (XML, SOAP). Information processing systems become n-Tier structured, strong identification and role based access was introduced. Users went mobile with mobile IP and roaming over multichannel access. Clients become thinner (browser) and personal terminals were multipurpose (business, pleasure, social media together in same device). Information process is faster allowing Business Intelligence kind of applications, which make information even more valuable for business.
• Towards 2020 integration of machines, enterprises and people to effective systems is a quest. Information is handled as a service with address, metadata and other features and issued as a service (Semantic web, SOAP). Business knowledge is defined with ontologies that create a bases for technical systems artificial intelligence. Information processing perceives all other technical systems. Information integration opens new possibilities in all levels of life.

Information and information processing has become an essential part of any business from agriculture to art. Information is a part of almost all products, information is needed in production phase and sometimes information is also raw material as seen in next picture.

Picture 21: Information and ICT has changed both business, governance and living within last three decades

Knowledge working in Information society supported by eGovernance and living provided by eCommerce are post-modern phenomena. Digital transactions between entities has become a standard. Strategic supply chain management of networked companies has become advantage in global markets. Almost every product includes information. This requires interagency, inter-enterprise and international agreements on how to exchange information between organizations in value adding chain depicted in next picture.

Picture 22: Networked society needs defined rules of information exchange between entities

These agreements are based on either standards or increasingly on "de facto" policies of:

• Architecture of datawarehouses, where all needed data is collected into huge base and structured with one data model. Or there might be virtual integration, where data remains where it is been stored originally and queried only just-on-time for different needs.
• how to connect gateways and do transaction brokering between entities
• what wrappers, containers or schemas to utilize when querying and transferring data
• how to protect data in between entities from man-in-the-middle intrusion
• how to agree and certify that data has been delivered and responsibility is handed over to other party according to contract
• copyrights, data ownership and responsibilities with coming with that, data integrity and non-repudiation policies between organizations.
• how to update appendixes of contract, service level agreements (SLA) or operator level agreements (OLA) with sanctions etc.

Co-operation between entities with different status and role ends up with weak value chains, where weakest link will define the sustainability of whole supply chain. Strengthening the chain against information operations requires common practices of:

• Security policies on how to manage secure information at same level of risk through whole chain of entities

1. Enforce similar policy (legislation or norms) for every participant of the chain. This is for example case in NATO and EU where same security levels and main requirements for each level is given to each nation by declarations. This gives national security authorities (NSA) the common criteria and authorization to approve and control security measures of both public and private sectors of that country.
2. Extend enterprise level information system of the hub of value chain with appropriate security to all partners, providers and stake holders of the network.
3. Have trust for each singular organizations own abilities to maintain security in technical, policy and cultural levels. One may also utilize third party auditors for sequential inspections to ensure of shared security level.

• Computer Emergency Response Team (CERT) practices on how to confront cyber crises when they appear and how to continue working around problem. All organization based CERT-teams should co-operate together in really flat matrix to be swiftly response to incidents or create synchronized proactive plan to tackle with existing vulnerabilities.
• Labelling information content similarly in every organization through the chain of value. Sometimes this is done nationally with national security legislation and agreed also internationally. If this is not the case, then agreement must be included into contract between all parties.
• Similar security labelling is a base for equal information assurance measures, where people have adapted common culture, especially in cross domain situations, when information is changed manually. Same labelling and categorization of information enable individuals continue information management at similar security level.
• Utilization of similar security measures and systems through whole chain of organizations or consortium to be able to maintain similar level of security. This is increasingly done by common application service provider or cloud service provider as depicted in following picture.

Picture 23: This is showing the evolution of value chain’s ICT-services where autonomous organizations gradually integrate in supply chain and finally out-source their ICT to either hub organization of their chain or to third party like specialized ICT-service provider or cloud service provider.

• At national or global enterprise level these ICT-service providers are very important for continuation of main business and in governmental approach also main targets for malevolent functions since service downtimes will lose money and immaterial assets. Thus business continuation management should consider thoroughly all force majeure chapters of contracts with ICT-service or cloud providers. 

Information and other immaterial assets are more important to all functions of society. Some nations and coalitions have constructed common criteria and security auditing functions to build equally followed security culture. Still there is a need to include security chapters that are followed through value chain with common ability to conduct synchronized counter measures against any hostile or malevolent action.

3.3 Information Assurance of a virtual value chain

Information Assurance, IA and Business Continuation Management, BCM used to concentrate on triad of CIA (Confidentiality, Integrity and Availability) with emphasis on confidentiality and have simple seven measure approach  to protect these qualities with onion structure, where physical measures were main solutions. This approach is depicted in next picture.

Picture 24: Enterprise security and business continuation approach that focused on physical security.

Physical boundaries have been main base for almost all security measures. Different inter-limited areas have created clear zones of access and areas to manage confidential information. Military have especially utilized this to utmost with structures to prevent all kinds of emission to extend to outsiders (TEMPEST), minimizing all connections out from their camps, shred all their paper waste, grind their used data storage devices and prevent any cameras or electronic devices to be brought in premises for easy content capturing.

Value added networks, force integration and supply chains have made it impossible to sustain site centered onion security structure. While virtual value chain of entities at same maturity level will increase their joint value exponentially according Metcalf’s law, there is also the Beach’s law expressing that with unequal entities the vulnerability of chain is increasing also exponentially as number of entities is growing expressed in next picture. This makes it understandable to outsource Information Services to 3rd party and simultaneously equal all shareholders Information Assurance at same level. When one service provider is offering ICT-services from cloud i.e. shared platform and application structure, a question is risen of trust and crosstalk between different clients on the same platform.

Picture 25: Beach’s law of increasing vulnerability with growing number of entities in chain

Virtual value chain has risks in six qualities of information assurance which are confidentiality, possession, integrity, authenticity, availability and utility.  To achieve in sustaining these qualities the ISO/IEC 27002:2005 Code of practice for information security management recommends the following be examined during a risk assessment session: security policy, organization of information security, asset management, human resources security, physical and environmental security, communications and operations management, access control, information systems acquisition, development and maintenance, information security incident management, business continuity management, and regulatory compliance.

When integrated value chain is out-sourcing their ICT-services to cloud computing service provider, information assurance is implemented within one technical structure, but facilities, people, information content and procedure measures are still to be aligned. Cloud Computing security reference architecture points that there may be 3rd party auditor who inspects and analyses security, privacy and performance issues of each cloud provider or broker as seen in next picture.

Picture 26: Cloud Computing Security Reference Architecture according to NIST.

Furthermore it is important to understand that in cloud computing there is Main provider, a Hub, and then there are subcontractors or operators in a chain of ICT-service providers. Thus Cloud Brokering is essential to manage subcontracted services like communications services, information content services, transaction brokering services, etc. In this model ICT Hub is responsible of maintaining security and business continuation according contract with customer. If this co-operation network is intensive and defined as strategic then there are three qualities in value chain that are better in crises than basic contracted task. First there might be collective action that is intentionally developed and managed inter-organizational co-operation between stake holders in a value chain. Second there might be value driven management that is leading organizational values towards integration rather than fragmentation or differentiation of chain. Third there might be long history of practised co-operation along all levels of organizational interaction, which has amalgamated their behaviour and assumptions to a level of matrix co-operation culture that extends over all boundaries of hierarchical organizations.

Attacking against technical Cloud Structure might be done for example via software, hardware or physical avenues. The software attack is at most cost-efficient if program patching or version delivery can be misused to distribute malevolent patch or software update. This was the case in Iraq operation early 1990’s when malevolent software was distributed via virus detection fingerprint updates. Thus man-in-the-middle attack is most probable and service provider’s programmable electronics maintenance system should be audited and specially secured.

Hardware attack may be more costly and at best requires arrangements in advance. There are possibilities that some foreign sale integrated circuits do include back doors to provide access to manufacturer to prohibit use of IC. Other theories claim that by manipulating IC-production process, a change in thickness of lead inside circuit can affect random generator within each circuit. There has also been alleged misuse of hardware provider chain for Iranian nuclear plants in famous STUXNET-case, where retailer injected malevolent software to devices that were used in controlling centrifuges. Normally hardware attack is requiring resources and time not to be very cost-effective, but maybe security devices like encryption machines or key delivery systems might be valuable targets.

The physical destruction has been main measure in both operations of U.S. lead alliance attack against Iraq command and control of their defence systems. In operation Iraqi Freedom A-day deliveries more than 500 cruise missile strikes and about 700 aircraft strikes, carried out across Iraq, went after command and control, communications, and Republican Guard headquarters and facilities.  If computing and communications grid is not distributed enough, few nodes are fixed, recognisable and vulnerable targets not only directly but also indirectly through electricity, sewer or air conditioning systems.

To be continued...

Narratives of life - thirties

When I was in my thirties just out from General Staff College and active student of telecommunications technology, I thought that if I just make sense of every technical detail and interface them properly I would be able to build better world. I spend hours in making sense of complex C4I systems, designing better information and telecommunications structures and defining better processes for telecommunications network operations. I drafted orders that gave very detailed instructions on how to install routers and modems in telco facilities. I thought that strict project management was key to success. People and systems would bend to my will if they were just managed in a strictest way and controlled all the time.

By collaborating with my peers and subordinates I was successful in building technical systems but almost all attempts to change people processes were failing. I tried to build bridges between telecommunications and information technology people by showing them designs where telephone and PC were combined and describing them use cases where both network and session engineering was needed to make whole OSI-stack functioning. I had no success in bringing them closer. Not even placing their rooms close to each other made any changes in their confrontation. I tried to introduce common processes to improve their combined service production with no results. I was doing my best in sense making and designing systems. I spend numerous night in drawing logical charts on how process should be running. Although all logic was speaking towards change, people were afraid, not sharing same language and not trusting to each other. And I was not able to take them in to forest to overcome some difficulties.

I threw myself into studies of change management and iterative development. There I found my first understanding and tools to lead changes by using my personality and human social behaviour. I withdrew my previous requirements for big, one time change and went on with little steps. I invited people in exercises to share their problems and define combined solutions. I spoke with people, visited their working sites, listened to them and gave my appreciation to their skills and achievements.

Later I realized that I was educated to approach all subjects in systematic way. All the time in General Staff College and in University of Technology was preparing me to understand and design material and immaterial systems, not more complex systems that are a mixture of people and machines interrelations. I was given a lot of tools to change technical systems but non to make human being to leave his/her area of comfort. My communication based only on analytical and logical facts and they were not enough to move people from their comfort zones they had built in their history. I did not touched their feelings nor was I able to help them to process their fears of new and unclear things. My education was taking human being just a piece of machinery that followed technical procedures. With my logical explanations and demands I was perceived more as a threat than a leader that would take everyone along a safe route towards better future.

To be continued...