State of the IA Art
Written by Harrison Donnelly
Information Assurance Center provides
DoD a central point of access to information
on cybersecurity and network defense.
The release earlier this year of a report on the critical topic of measuring the effectiveness of cybersecurity programs has again highlighted the role of the Department of Defense’s Information Assurance Technology Analysis Center (IATAC) as a “super library” of expertise on IA and defensive information operations.
The report, titled “Measuring Cyber Security and Information Assurance,” was one of a series of “state-ofthe- art reports” issued by the 11-year-old center. Given the increasing attention paid to cybersecurity by DoD, the center’s products—from newsletters and research reports to a database of expert “graybeards” on specific IA topics—are likely to continue to grow as an important resource in the defense of the nation’s networks.
Perhaps most prominently for DoD and other federal employees, the IATAC regularly provides up to four hours of free research for any inquiries of specific topics, and does so scores of times each month.
As one of 10 information analysis centers (IACs) sponsored by DoD and managed by the Defense Technical Information Center (DTIC), which provides a “one-stop” access point to DoD scientific, research and engineering information, IATAC’s basic services include collecting, analyzing, synthesizing, producing and disseminating IA scientific and technical information; responding to user inquiries; database operations; current awareness activities; and publishing critical review and technology assessments reports and stateof- the-art reports. All 10 IACs perform these tasks within their functional areas.
IATAC is operated for DoD on a contractual basis by Booz Allen Hamilton (BAH). The center’s director, Gene Tyler, is a BAH senior associate who, in his last military assignment, served on the OSD staff as director of the Defensewide Information Assurance Program office.
“IATAC’s mission is to provide DoD a central point of access to information on IA and cybersecurity, emerging technologies and system vulnerabilities, research and development, modeling and analysis to support implementation of effective defense against information warfare attacks,” Tyler said. “One of our major roles is synchronizing the IA area across government, academia and industry. If you look at our core mission as being a key repository for IA and cybersecurity, it would make sense to make sure that anything that comes out within that mission area is managed at a particular place and made available for reuse across the federal government.
“We’re a ‘super library,’ or a center of excellence,” Tyler continued. “Frankly, a number of our clients have written to us and said we really are a center of excellence, because we can get information across a broad range of topics within IA. If we don’t solve their problem immediately, we point them in the right direction.”
As a type of government/industry hybrid, IATAC offers a mix of fee and service arrangements. In addition to no-charge initial assistance, it does contract research for organizations, such as the Defense Information Systems Agency (DISA). But the results of that research then go into a database available to other agencies. “If you’re an authorized user—defined as any federal employee or a person from academia or industry who is registered with DTIC—you can ask us a question, and we’re obligated to spend up to four hours researching that,” Tyler explained.
The center receives an average of 60 to 65 requests for information a month, Tyler said, as well as 120 or so requests for documents, all of which are provided free of charge to authorized users.
CURRENT-AWARENESS PROGRAMS
The center has a variety of current-awareness programs, including campaigns to make sure those in the field are aware of recent targeted research. It also has a newsletter, in which most of the articles are written by outside subject matter experts (SMEs), as well as a twice-weekly online digest of links to IA news and analysis. Again, authorized users receive these products at no cost to them.
In addition to receiving guidance from DTIC, the center is steered by a committee of IA experts from across the government, who meet once a year to help determine the emerging technologies and issues that should be worked. “We prepare a list of some of the hot-button issues for DoD, and they generally select one topic for us to work. Then we assign a researcher to develop it, working in collaboration with DTIC, the 55th Contracting Squadron, which manages our contract, our steering committee of SMEs, and an adviser,” Tyler said.
Based on that input, the topics of the center’s state-of-the-art reports offer an excellent window into the issues facing IA specialists every day. Currently, the most popular report, with some 490,000 electronic and printed copies in general circulation, addresses software security assurance.
In addition to this year’s report on IA measurement, other recent studies have focused on insider threats, and a possible study focused on security of the software supply chain is under consideration. IATAC has a small staff, which includes a chief scientist and a specialist on academic integration. But it also has access to a range of outside expertise.
While the center makes use of Booz Allen Hamilton and its experts, it also works with other firms, academia and government to maintain a database of SMEs. “We rely on the resources of Booz Allen, but we don’t want this to be just a Booz Allen-centric solution, but an IA community and government-centric one,” said Tyler.
Indeed, the center devotes considerable effort to identifying and evaluating SMEs, with strict criteria for professional achievement and a panel that reviews qualifications. In addition, it has a list of some 150 “super experts” or “graybeards.”
DTIC’s Website, www.dtic.mil/dtic/iac, offers more information about its work, while more information about IATAC or any of the other nine IACs is available at http://iac.dtic. mil. ♦
