An Cosantóir

www.military.ie THE DEFENCE FORCES MAGAZINE | 25 Dinos Anthony Kerigan-Kyrou coordinates and instructs on the 1st Joint Command & Staff Course cyber security module. He is an instructor on NATO's DEEP - Defence Education Enhancement Programme and is a co-author of the NATO / Partnership for Peace Consortium Cyber Security Curriculum. BY DINOS ANTHONY KERIGAN-KYROU THE INTERNET OF THINGS: T he Internet of Things (IoT) - the connection of devices across the internet - presents near limitless improvements for military equipment and defence capabilities. IoT collates data from weapons systems and platforms on land, sea, air, and from satellites, as well as directly from military personnel. For example, threats to Defence Forces, as well as threats to those we are protecting, can be more quickly and accurately identified with IoT enabled Intelligence, Surveillance, and Reconnaissance (ISR). Real-time medical information can be transmitted for rapid assessment via 'wearables' embedded into combat uniform. IoT will be increasingly used for navigation on land, at sea, and in the air. Moreover, IoT is becoming integral to vehicle control and operation systems includ- ing control consoles, electronic chart displays, automatic identifica- tion systems, navigation decision support, data recorders, automatic steering, autopilot, power management, loading, stability, alarms and safety systems - to name a just few. Likewise, access control to bases and facilities - cameras, barriers, swipe cards, biometric IDs - may be increasingly connected online. IoT utilising RFID tags will create a much more efficient military supply-chain. And functional operations on which we depend, such as heating and electricity, maybe soon controlled online by IoT. But IoT creates substantial cyber security concerns. Military IoT uses the same internet we all use every day; there is no 'super secure' internet for important things like government, military and critical infrastructure, and another for Facebook and WhatsApp. It's all the one internet. As US Col Pat Duggan, National Security Agency (NSA) Direc- tor for Cyber Security states: "By 2020 there's going to be over 50 billion connected devices... wearables, sensors, devices [are] going to be on us, around us, under us, and will be perpetually fuelled by declining cost, ever more powerful processing capabilities, and ever-growing availabil- ity. Everything that can be connected will be, creating unforeseen impli- cations...What do we do when our entire [defence] population becomes a wireless node, constantly emitting or receiving data from innumerable locations across countless devices for limitless reasons...?" Cyber security experts have been warning for some time of the substantial IoT security vulnerabilities which can be manipulated via a hack - for example, forcing a weapon or vehicle to operate in way unin- tended by its legitimate operator. Or hacking a 'smart' heating system on a base enabling a terrorist or other nefarious actor to remotely explode a boiler. IoT can also be used as a conduit by an adversary to spy on Defence Forces, the State and our allies via cameras and micro- phones, or by remotely monitoring the activities and movements of our equipment and personnel. Fortunately, at the strategic level, the State is working closely with our EU partners and NATO (Ireland is a member of NATO's 'Partner- ship for Peace'). National Cyber Security Centre Ireland works highly proactively with international organisations developing IoT security to protect Defence Forces and the State. But IoT - like all aspects of cyber security we've looked at in this three-part series - introduces responsibilities to every member of Defence Forces. These new re- sponsibilities may not fit particularly comfortably within a traditional military structure. The Internet of Things introduces so many potential 'ways in' for an adversary that we all need to become part of an alert system to identify possible breaches and vulnerabilities at the earliest possible opportunity. It doesn't matter what your rank is; the responsibil- ity involves everyone in every branch of Army, Air Corps, and Naval Service. If you notice anything unusual with equipment that may be connected online, raise the matter as quickly as possible with your CO or CIS Corps. Action at the strategic level isn't enough. As we increasingly move to an 'everything connected' IoT environment we all need to be empow- ered to be part of a single cyber secu- rity early warning system. The cyber security of the De- fence Forces - and ultimately of the State - depends on you.

• Cover