Sponsored by Spectra Group
————————————————————————
11 Apr 24. DOD Employs Proactive Measures to Counter Cyber Threats. By pursuing integrated deterrence, including cyber, the Defense Department continues to be ready to fight and win the nation’s wars, said Ashley Manning, who testified yesterday before the House Subcommittee on Cyber, Information Technologies and Innovation regarding the fiscal year 2025 budget request for cyber.
Manning is performing the duties of assistant secretary of defense for cyber policy.
Cyber challenges, she said, include:
- China’s targeting of U.S. networks in prolonged campaigns of espionage and pre-positioning its cyber forces for future operations.
- Russia’s use of cyberspace to target critical infrastructure networks, enable its malign influence operations and disrupt defensive military operations against Ukraine.
- Iran’s use of cyberspace to create disruptions against Israel.
- For-profit cybercriminals who target a wide array of vulnerable sectors, conducting ransomware attacks that impact the daily lives of Americans.
In response, the department is implementing its 2023 DOD Cyber Strategy, investing in a talented workforce and capabilities and presenting options to the secretary of defense regarding ways to increase cyber readiness, she said.
This is being done in close partnership with U.S. Cyber Command, Manning added.
During his testimony, Air Force Gen. Timothy D. Haugh, commander of U.S. Cyber Command, echoed much of what Manning said.
China poses the greatest challenge, he said, due to its “advanced cyber capabilities, state-sponsored cyber operations around the globe, and a strategic focus on leveraging cyberspace for military, economic and political purposes.”
Also, Haugh pointed out that Russia’s cyber campaigns prioritize sensitive U.S. government and military infrastructure and information and spread disinformation campaigns to influence public opinion and undermine the democratic processes.
“I am confident Cyber Command is well postured to meet the ever-evolving challenges we face today, creating advantages for the department and the nation,” he said, citing his team’s work at “network hardening, threat hunting and information sharing to foil potential cyberattacks before they can materialize.” (Source: U.S. DoD)
08 Apr 24. BLOS Troposcatter Communications System Demonstrated. Meeting U.S. Army range requirements, Ultra Intelligence & Communications Archer troposcatter communications system successfully maintained a communications link beyond 185km Ultra Intelligence & Communications has launched its Archer.family of troposcatter communication system to the global defense market. The launch follows a recent demonstration where the beyond-line-of-sight (BLOS) platform successfully maintained a communications link beyond 185 kilometers. With the demo, the system met U.S. Army range requirements, providing a resilient, redundant layer of secure communications.
“Offering the Archer family of troposcatter systems to our global defense partners is a testament to our ability to invest, innovate and deliver on crucial capabilities, when our customers need it most,” said Chris Bishop, chief growth officer of Ultra Intelligence & Communications. “We pride ourselves on building solid, trusted, long-term customer partnerships – combining decades of functional and technical experience with an innate ability to innovate and deliver revolutionary advancements at speed and scale.”
“Troposcatter bridges the gap when satellite communications aren’t accessible due to jamming, location or other factors, making it a cost-effective way to move beyond line-of-sight relays,” said Faith Rhodes, vice president of programs for Ultra I&C’s Communications business. “This resilient layer of communications is becoming more important as we prepare for the potentiality of a day without SATCOM.”
Ultra I&C’s troposcatter technology is tested to be resilient in diverse operational environments, withstanding interference and jamming to deliver key communication links over vast distances where fixed communications face limitations.
The Archer family of systems allows for quick deployment and self-alignment of antennas, ensuring connectivity at mission speed.
(Source: https://www.defenseadvancement.com/)
11 Apr 24. Germany: New campaign underscores adoption of AI tools, heightened information security risks. On 10 April, the cyber security company Proofpoint reported that the financially motivated threat group ‘TA547’ targeted several German organisations with the ‘Rhadamanthys’ information stealer. The campaign uses invoice-related phishing emails to trick potential victims into engaging with a malicious ZIP file. Once opened, the malicious file triggers the download of the Rhadamanthys malware through a large language model (LLM)-generated PowerShell script. This campaign marks the group’s first adoption of LLM tools, underscoring the growing sophistication of its tactics, techniques and procedures (TTPs), including through the use of Artificial Intelligence (AI)-generated code. AI enables cyber criminal groups of varying capabilities to refine their techniques and to conduct more complex attacks, bolstering their success rates. Rhadamanthys was recently used in February 2024 in an information-stealing campaign targeting the oil and gas sector. We assess that the increased deployment and development of this malware will exacerbate the security and information-theft threats posed by financially motivated actors. (Source: Sibylline)
11 Apr 24. Armageddon days are here again. The US Space Force is shelling out up to $8bn on its Evolved Strategic Satellite Communications System (ESS). ESS is expected to supplement, and eventually replace, the existing Advanced Extremely High Frequency (AEHF) Satellite Communications (SATCOM) system. The AEHF is a key component of the United States’ Nuclear Command, Control and Communications (NC3) network. NC3 employs a myriad of communications links to move nuclear weapons command and control traffic. These links would carry any orders from the president to US strategic forces to use nuclear weapons.
Reports in February said that an ESS draft solicitation is expected to be published by the end of 2024. The three satellites expected to form the ESS space component could be launched in 2025. The advent of the Evolved Strategic SATCOM System is a welcome enhancement to the NC3 enterprise. As of January 2024, the Bulletin of the Atomic Scientists’ famous Doomsday Clock was at 90 seconds to midnight. Avoiding Armageddon depends on adversaries believing their opponent’s deterrent would not fail. Maintaining robust, survivable and capable strategic communications systems is intrinsic to the concept of a credible nuclear deterrent. US nuclear-armed NATO allies France and the United Kingdom must follow Washington’s lead in ensuring their nuclear communications systems are fit for purpose both now, and in the future. (Source: Armada)
09 Apr 24. Link Rays. The United States Space Development Agency’s embrace of Link-16 connectivity is gathering momentum greatly improving the tactical datalink’s geographical footprint.
Link-16 is a North Atlantic Treaty Organisation (NATO) and allied Tactical Datalink (TDL) protocol which mainly supports air operations. The TDL uses frequencies of 960 megahertz/MHz to 1.215 gigahertz/GHz to handle secure tactical voice and data traffic. Link-16 was developed in the 1970s and introduced from the 1980s onward. For most of its history, Link-16 has been a terrestrial tactical datalink, but this is changing.
Viasat and Blue Canyon collaborated on the development of the XVI spacecraft to demonstrate the feasibility of moving Link-16 traffic across satellites. The XVI cubesat was launched in 2023 and placed in a Low Earth Orbit (LEO). According to the US National Aeronautics and Space Administration, cubesats are classified as having a twelve cubic metre volume. LEO orbits do not exceed 1,080 nautical miles/nm (2,000 kilometres/km) altitude. As a TDL using Ultra High Frequency (UHF) wavebands, Link-16’s range is restricted to line-of-sight. Placing Link-16 terminals on a satellite permits a significant range increase: A LEO satellite at a 1,080nm altitude could have a potential intercontinental range of 3,146nm (5,826km).
Enlarging the footprint
“The geographic footprint of the battlespace for which Link-16 was designed has increased ten-fold,” the US Space Development Agency told Armada. Tomorrow’s wars are expected to be fought across vast theatres, such as in the far east and southeast Asian regions. It is in these areas where the People’s Republic of China and the US could come to blows during any future conflict. “Link-16 from space allows quicker reaction times for warfighters over a large area … In order for US forces to react to rapid and changing adversarial threats, the timeline of these reactions must be faster than ever before.” A key motivation for evolving Link-16 provision from space is the challenge presented by time-sensitive, beyond line-of-sight targets. Such threats are exemplified by hypersonic surface-to-surface missiles. Hypersonic weapons travel at velocities exceeding 3,333 knots (6,174 kilometres-per-hour). The Russian Air and Space Force’s Kh-47M2 Kinzhal (NATO reporting name AS-24 Killjoy) has a reported top speed of 6,666 knots (12,348km/h). The missile’s range is said to be circa 1,080nm which could be covered in nine minutes and 43 seconds.
SDA efforts
The SDA has picked up the baton and is helping to advance space-based Link-16 capabilities. On 14th February, the SDA launched 27 Tranche-0 Proliferated Warfighter Space Architecture satellites. Seven of the spacecraft include TDL payloads. York Space Systems, Lockheed Martin, SpaceX and L3Harris have all been involved in developing these Tranche-0 satellites. The Proliferated Warfighter Space Architecture “has successfully demonstrated the first ever Link-16 network entry through space to a ground connection located within a Five Eyes partner nation from low earth orbit,” the SDA told Armada. The Five Eyes nations comprise Australia, Canada, New Zealand, the United Kingdom and the United States. “This demonstration represents a capability never before possible for our warfighters.”
Link-16 connectivity testing is expected to continue throughout 2024: “Signal characterisation tests” are ongoing noted the SDA with “network loading and entry tests” then occurring. These evaluations will “be followed by adding additional Link-16 participants to provide empirical data on network loading, participant interactions and the tests required to lead up to certifications.” Crucially, the Link-16 terminals equipping the Tranche-0 satellites are fully compatible with Link-16 radios used throughout NATO and allied nations: “No modifications (to these radios) are required for interoperability,” said the SDA. (Source: Armada)
10 Apr 24. Proving the Design. The US Army’s new RT-2129 Combat Net Radio recently completed a significant testing programme at the Electronic Proving Ground, Fort Huachuca, Arizona.
The US Army’s Combat Net Radio takes an important step towards service entry as the system begins its first article testing phase.
The US Army’s Programme Executive Office for Tactical Command, Control and Communications (PEO C3T) announced in March that the Combat Net Radio (CNR) has entered its first article testing phase. Thales is providing the Very High Frequency (VHF: 30 megahertz/MHz to 512MHz) CNR. Designated as the RT-2129, the company won the ten-year contract to provide the radio in May 2022. The RT-2129 is based on Thales’s AN/PRC-148 Joint Tactical Radio System Enhanced Multiband Inter/Intra Team Radio. The AN/PRC-148 is a multiband (30MHz to 512MHz), multi-channel system intended for squad/team leaders. In contrast, the RT-2129 is a single-channel transceiver for subordinates. Thales’s contract could be worth up to $6bn and could see the delivery of circa 7,000 RT-2129 radios. The RT-2129 replaces the erstwhile L3Harris RT-1523 Single Channel Ground and Airborne Radio System (SINCGARS) VHF transceiver.
Waveforms
Thales’ official literature says the CNR carries the SINCGARS waveform along with the HAVEQUICK-I/II 400MHz to 500MHz frequency-hopping waveform. Beyond SINCGARS and HAVEQUICK-I/II the radio accommodates the Integrated Waveform for satellite communications and Project-25 (APCO-25). The APCO-25 waveform is used throughout the US first responder community. CNR transceivers have a similar shape and size to the RT-1523 series. This will ease the retrofit of these new radios into legacy vehicles equipped with RT-1523s. As the new radios includes the SINCGARS waveform this will ensure interoperability with older transceivers. Given the timelines for CNR introduction, new and legacy radios will need to run side-by-side for some time.
Testing Times
According to the PEO C3T, the Combat Net Radio completed a “vendor-led excursion” at the Electronic Proving Ground (EPG) at Fort Huachuca, Arizona in February. With the completion of the vendor-led excursion, the RT-2129 now moves into first article testing. Lieutenant Colonel Brandon Motte, the PEO C3T’s waveforms product manager, told Armada that “the first article testing phase consists of environmental tests, lab-based tests and field-based tests.” Some of these environmental tests will occur at the vendor’s facilities and will be observed by the Defence Contract Management Agency (DCMA). The DCMA supervises and manages US defence contracts. These environmental tests will include ballistic, shock and temperature testing, Lt. Col. Motte explained. Government-led laboratory testing will occur in government-owned facilities and will entail “preliminary testing of the (radio’s) software, hardware, and functions of the equipment.” Field testing will occur at several army sites, including the EPG, and will see “additional performance testing while in an operational environment.”
Lt. Col. Motte said that the first article testing phase is expected to take between four and six weeks in June and July. Additional testing will follow in the form of an Operational User Assessment (OUA). The OUA is due to take place at the US Army’s Manoeuvre Battle Lab at Fort Moore, Georgia. “The purpose of the OUA is to gather soldier feedback on the new CNR variant” and will take place in October 2024. The first US Army units are expected to receive the CNR by the end of the year. (Source: Armada)
11 Apr 24. Seeking Guidance. In early March, the Ukrainian media announced that Russian forces are using an enhanced version of the Kometa GNSS receiver in the Ukrainian theatre.
The militarnyi website reported on 9th March that Russian air-to-surface ordnance equipped with the UMPK precision guidance kit are using a new variant of the Kometa system. UMPK kits are like the Boeing Joint Direct Attack Munition (JDAM) guidance system in use with US and allied militaries. Like JDAM, the UMPK kits adorn standard ‘dumb’ ordnance to improve precision. The guidance kits rely on Global Navigation Satellite System (GNSS) Position, Navigation and Timing (PNT) signals to improve precision. Russian sources say UPMK uses PNT signals transmitted by that country’s GLONASS GNSS constellation. GLONASS transmits PNT signals on frequencies of 1.201 gigahertz/GHz to 1.605GHz. Nonetheless, UMPK kits can probably use any GNSS signals transmitted on frequencies between 1.1GHz and 1.6GHz.
UPMK detects PNT signals with the target’s position being correlated with the bomb’s location as it flies. The guidance kit sends commands to a fin assembly mounted on the rear of the weapon. The fins move to correct the course of the weapon as it approaches the target. While UMPK helps to improve precision it can risk making a freefall weapon thus equipped vulnerable to jamming. GNSS PNT signals tend to be very weak by the time they have travelled from the satellites transmitting them to Earth. As previous articles have stated, the signals may be as weak as -127 decibels-per-milliwatt/dBm at the end of their journey. Comparatively weak jamming signals aimed at a UMPK kit maybe drown out the PNT signals used for guidance.
Kometa
Russian language technical papers discussing the baseline Kometa system, which the UMPK relies on, say the system provides ‘noise immunity’ to GNSS PNT jamming. Noise immunity levels of between 32 decibels/dB to 108dB are reportedly achievable with Kometa. It appears that Kometa detects abnormally high-power transmissions mimicking PNT signals using three radio receivers. These receivers detect and compare the spatial separation between the incoming PNT transmission and the more powerful jamming signal. Processing screens out the jamming based on its power levels and angle-of-arrival vis-à-vis the PNT signals. Weighing circa one kilogram (2.2 pounds), Kometa was designed to equip space-constrained platforms. Such attributes make it unsurprising that the apparatus has been employed in the UMPK equipment.
Kometa-M
The Ukrainian media reports in early March said Kometa has now been augmented with eight receivers with the new configuration known as Kometa-M. The addition of five PNT receivers is no doubt intended to improve the resistance of UMPK kits to jamming. By adding additional receivers, Kometa-M may be able to defeat more than three jamming sources. Additional radio receivers may improve the system’s discrimination between real and fake PNT transmissions. It is noteworthy that Kometa-M is also being used with Russian land forces tactical uninhabited aerial vehicles.
The enhancement of the baseline Kometa design shows that Ukrainian electronic warfare directed against Russian GNSS-dependent military systems is effective. It also shows that Russian electronic engineers can rapidly develop solutions to electromagnetically vulnerable systems. Expect similar innovations by both sides as the war continues. (Source: Armada)
10 Apr 24. April Radio Roundup. R-187 handheld V/UHF radios are in service with the Russian Army, but have they been deployed in sufficient numbers to support the invasion?
New Millimetric Wave Module
Peraso unveiled its new PRM2136 millimetric wave module to support secure tactical communications in March. A company data sheet said that the PRM2136 uses a 57 gigahertz/GHz to 60 gigahertz/GHz waveband providing 2.16GHz of channel bandwidth. The latter helps the system avoid interference from other signals. Directional beamforming is provided using a phased array antenna which steers signals in azimuth and elevation. Automatic Encryption Standard 128 (AES-128) data encryption is also supported. Peraso told Armada that the PRM2136 “has a USB 3.0 interface” adding that “it can connect directly to a host device, or with an Etherwave adapter, which enables smart power management when connected to Android devices such as smartphones and tablets.” The company said that data rates of between 400 megabits-per-second and 1.7 gigabits-per-second are achievable with the PRM2136. Development of the module is complete. It is “in mass production (and) has been adopted for consumer products and is in development for tactical applications.”
Peraso’s new PRM2136 millimetric wave module provides secure communications which can achieve data rates of up to 1.7 gigabits-per-second.
Satcom Direct Secures Blanking Agreement
Satcom Direct’s government subsidiary concluded an aeronautical blanking agreement with the US Department of Defence (DOD) for global Satellite Communications (SATCOM) connectivity in March. The news was announced via a company press release. The five-year agreement will provide the DOD with voice and data connectivity for US military and government aircraft. The contract is worth $240 m. Specifically, the agreement allows those users to access several SATCOM services offered by Viasat. Satcom Direct told Armada that the SATCOM service it offers “can be accessed through existing equipment (furnishing aircraft) as well as Satcom Direct’s growing portfolio of hardware.” The satellite communications services users can access will flow through Satcom Direct’s facilities in Melbourne, Florida. (Source: Armada)
10 Apr 24. Secretive US cyber force deployed 22 times to aid foreign governments. U.S. cyber specialists toiled in more than a dozen countries last year as part of a push to fortify networks and expose tools used by hackers, according to the leader of Cyber Command and the National Security Agency.
The so-called hunt-forward missions, conducted by CYBERCOM’s elite Cyber National Mission Force, or CNMF, totaled 22 deployments, with some happening simultaneously across the world, Air Force Gen. Timothy Haugh said in testimony submitted to the Senate Armed Services Committee on April 10.
“Enhancing the security of government, private sector and critical infrastructure systems grows ever more imperative,” said Haugh, who took the helm at CYBERCOM and NSA in February. “Foreign adversaries continuously update how they operate, and frequently work through American-owned networks and devices.”
Hunt-forward missions are executed at the invitation of a foreign government and are not always disclosed. They’re part of CYBERCOM’s persistent engagement strategy — a means of being in constant contact with adversaries and ensuring proactive, not reactive, moves are made.
Haugh’s disclosure offers a rare look at the CNMF workload, which is often nebulous, as some countries prefer to keep quiet the digital cooperation.
The mission force has in the past worked with Ukraine, ahead of Russia’s invasion; Albania, on the heels of Iranian cyberattacks; and Latvia, where malware was unearthed. Other previous deployments included Estonia, Croatia, Lithuania, Montenegro and North Macedonia.
The Defense Department sought $14.5 bn for cyber activities in fiscal 2025. The figure is about $1 bn more than the Biden administration’s previous ask. It is also up from FY23, when it sought $11.2 bn.
“We work every day against capable and determined cyber actors, many of them serving adversary military and intelligence services,” Haugh said. “Our operational experience reinforces the importance of campaigning globally in and through cyberspace across the conditions of competition, crisis and armed conflict.” (Source: C4ISR & Networks)
10 Apr 24. Global: Patched zero-day vulnerabilities underscore threats posed by financially motivated actors. On 9 April, the software company Microsoft revealed that two zero-day vulnerabilities (CVE-2024-26234 and CVE-2024-29988) were actively exploited by threat actors prior to the release of patches. One vulnerability (CVE-2024-26234) was exploited to inject a malicious file into targeted systems; this allowed the threat actors to install a backdoor and remotely access sensitive data. The second vulnerability (CVE-2024-29988) was exploited in conjunction with a SmartScreen software vulnerability discovered in February 2024; this enabled the threat actors to bypass security checks, as well as to access the compromised system remotely and to deploy additional malicious code. The financially motivated group ‘Water Hydra’ exploited both vulnerabilities in December 2023 to target Forex trading forums and Telegram channels for illicit profit. The incident highlights the growing sophistication of cyber criminals’ tactics, techniques and procedures (TTPs), which now include the exploitation of zero-day vulnerabilities. The increased use of zero-day vulnerabilities in criminal operations further underscores the elevated security and financial threats posed by cyber criminal actors. (Source: Sibylline)
10 Apr 24. Thales and Intel enable advanced protection for the Google Cloud ecosystem.
- Enables persistent protection of the most sensitive enterprise workloads in the cloud through customer-controlled data security, not observable by non-authorized parties
- Protects against malicious actors accessing code and data at rest, in transit and while in use
Thales, the leading global technology and security provider, today announced a collaboration leveraging its CipherTrust Data Security Platform (CDSP) to support End-To-End Data Protection (E2EDP) on Google Cloud, using Confidential Computing (CC) from Google Cloud and trusted cloud independent attestation provided by Intel Trust Authority (ITA).
The effort is a step forward in data security, giving enterprises additional controls to protect their data at rest, in transit, and in use.
“As more enterprises migrate their data and workloads to the cloud, there is an increasing demand to safeguard the privacy and integrity of the data, especially those sensitive workloads that include intellectual property, AI models and valuable personal information. This collaboration enables enterprises to protect and control their data at rest, in transit and in use with fully verifiable attestation. Our close collaboration with Google Cloud and Intel increases our customers’ trust in their cloud migration,” said Todd Moore, Vice President of Data Security Products at Thales.
A majority of the 2023 Thales Cloud Security Study respondents reported having a significant amount of sensitive data stored and in use in the cloud. Consequently, safeguarding sensitive data and associated workloads when stored or in use, is an increasing priority, especially for highly regulated industries such as financial services and healthcare. Thales’s collaboration with Intel and Google Cloud provides certifiable controls for enterprises to fully protect their data end-to-end.
Purnam Sheth, Vice President and General Manager: Trust and Security Products, SATG at Intel: “Creating this groundbreaking, seamless data security platform in Google Cloud meets customers’ complex requirements for data protection, controlled access and security, and adherence to compliance for data at rest, in transit and in use. Foundational Intel® Trust Domain Extensions Confidential Compute and Intel® Trust Authority gives enterprises assurance of the integrity of their workloads and guards at all stages of data management. This valuable collaboration between Thales, Google Cloud and Intel makes this possible.”
This security platform is based on the principle of separation of duties, where the customer remains in control of the encryption keys and their location. This approach enhances trust by holding each stakeholder responsible for their respective roles and reduces the ability for a malicious actor to access code and data at rest, in transit and while being executed.
Customers can migrate existing workloads with sensitive data or create new workloads needing zero trust, confidential computing and Confidential AI to this security platform in Google Cloud to broaden data security, attestation and set the right authorizations. With end-to-end data protection, multiple parties can securely collaborate on various use cases, such as Confidential AI datasets and models as needed while preserving privacy, confidentiality, and compliance with privacy regulations.
The Thales CipherTrust Data Security Platform uses Intel Trust Authority as a zero-trust, independent attestation service for advanced security and scalable confidential computing. Consistent attestation to Trusted Execution Environments (TEE) that are based on Intel Trust Domain Extensions. This single, consistent attestation process provides assurance to any relying party that the TEE and any data and workloads running within it have not been compromised.
Brian Roddy, VP, Product Management, Google Cloud: “Google Cloud is committed to providing our customers secure, private and reliable environments for their workloads, and our Confidential Computing portfolio plays a critical role in this effort. Offering our customers solutions like Thales’ encryption key management expertise, combined with Intel’s Trust Authority attestation, enables the choice of even stronger privacy controls.
The collaboration comes as Thales is recognized for its achievements in the Google Cloud ecosystem. For the second year in a row, Thales has received the 2024 Google Cloud Technology Partner of the Year Award for Security – Data Protection.
10 Apr 24. Comtech (NASDAQ: CMTL) (the “Company”), a global technology leader, in partnership with the Arizona Department of Administrations (“ADOA”), today announced the successful completion of a statewide transition to Comtech’s Next Generation 911 (“NG911”) services. Arizona’s new statewide NG911 infrastructure is designed to significantly enhance the ability of first responders and public safety answering points (“PSAPs”) to respond faster to emergencies and provide more comprehensive and reliable 911 services to Arizona residents.
In less than two years, Comtech and the ADOA successfully migrated the state’s legacy 911 system to the new infrastructure. The Arizona NG911 program modernizes the state’s emergency response capabilities and enhances the efficiency, effectiveness and reliability of 911 services, while enabling new capabilities such as geospatial location routing and improved redundancy, as well as the implementation of a new Emergency Service IP Network (“ESiNET”).
“We are honored to partner with the State of Arizona to deploy one of the nation’s most robust NG911 infrastructures,” said John Ratigan, Interim CEO of Comtech. “With this statewide deployment, Arizona residents benefit from a much higher rate of call reliability and new multi-media and location services, which can save critical time during emergencies. Comtech has worked closely with the ADOA and state leaders to integrate multiple legacy networks to create a new unified NG911 infrastructure, and we are confident this transition helps ensure residents get the help they need when seconds matter most.”
“The efficiency of this deployment can serve as a model for the rest of the United States, and we are pleased to work with Comtech to roll out these lifesaving NG911 services to better protect Arizona residents,” said Travis Jensen, Program Administrator of the ADOA 911 Program. “We look forward to continuing our partnership and bringing new capabilities to residents as they become available.”
The Arizona NG911 statewide transition involved upgrading and integrating a wide range of 911 technologies, including call handling, dispatch, mapping and database systems. It also required implementing new protocols and standards to ensure interoperability and compatibility with other systems and networks.
As one of the most trusted providers of public safety technologies, Comtech is continuing to expand its NG911 offerings for governments and emergency response providers around the world. The Company’s NG911 systems are designed to adapt and continuously evolve over time to meet the needs of emerging use cases as well as future applications.
08 Apr 24. Frontier Technology Inc. Announces SaaS and Perpetual Licensing Options for Its Proven Cortex Military Data Integration Platform.
FTI Cortex integrates complex and disparate systems, applications and data types, and enables powerful analysis, visualizations and predictive modeling for DoD customers. Frontier Technology Inc. (FTI), a leading provider of deep data expertise and mission-tailored services and solutions to the United States Department of Defense (DoD) and Intelligence Community, today announced SaaS and perpetual licensing options for its Cortex data integration platform. Previously, FTI Cortex was only available as part of the company’s technology-enabled services offerings.
FTI Cortex is a powerful, proven cloud-based platform that leverages AI/ML to enable DoD users to quickly gain the insights they need from their data to make the fastest, best decisions possible for their missions.
Cortex is designed to break down silos that often limit the potential of DoD data. It integrates complex and disparate systems, applications and data types, and enables powerful analysis, visualizations and predictive modeling that empowers users to dive deep into their data, providing a clear path to the insights they need. With a selection of native visualizations that allow users to quickly identify key relationships between data sources, Cortex offers rapid analysis capabilities right out of the box.
Cortex isn’t disruptive to current customer environments, and works with virtually all systems, data types, and virtually all commercial and open source applications including Grafana, Tableau, PowerBI and Qlik.
Schedule a demonstration or request more information:
The FTI Difference: Speed to Solution, Cost, Compatibility, Ease of Use – Customers continue to own their own data
The FTI Cortex platform can be operational in weeks or months, versus years, at a fraction of the cost of alternatives. Cortex is easy to use, yet serves a wide range of users, from those with basic skills to highly technical professionals. It is scalable to the enterprise and FTI customers continue to own their own data.
“The U.S. Department of Defense and Intelligence Community need to make critical decisions fast, but often spend too much of their time analyzing overwhelming volumes of data from disparate sources that don’t talk to each other,” said Jose Hidalgo, President, Frontier Technology Inc. “FTI Cortex addresses that challenge with automated data integration, normalization and standardization that empowers real-time analysis, visualization and predictive modeling to enable our warfighters to make the fastest and best mission-critical decisions possible.”
FTI Cortex is Now Available via SaaS and Perpetual Licensing
Delivery via SaaS
FTI Cortex is now available via a Software as a Service (SaaS) model. Subscription pricing allows fast and predictable adaptation to changing customer demands, ensuring new capabilities, data ingestion and integration requirements, and scalability can be delivered as fast as they are needed. Additionally, Cortex’s throughput-based approach is designed to meet a wide range of needs, from maintaining current systems to deploying enterprise-scale solutions across multiple Program Executive Offices (PEOs) or large-scale operations. Cortex is highly flexible, enabling tailored support for a diverse range of requirements, from straightforward updates to complex, cloud-based installations for extensive user communities. The demand signal from the customer defines the volume of data and how quickly it must be ingested.
Perpetual Licensing Option
FTI’s new perpetual licensing model for on-premise implementations is designed for both new and existing customers seeking both affordability and predictability. This approach also provides an opportunity to secure continuous support, regular capability enhancements, critical security updates, and the latest ATO and environmental certifications, keeping your operations not just running, but running securely. Designed and built with flexibility at the forefront, our licensing model ensures customers can leverage the full power of Cortex at an affordable price point. Customers can choose to license Cortex independently or in combination with our expert technical services, ensuring seamless integration and maintenance across various environments.
“FTI is adjusting our business to meet the DoD leadership vision of procuring ongoing continued developments vs continuous logistical sustainment costs.”, said Lincoln Hudson, COO, Frontier Technology Inc. “FTI’s new SaaS and License purchase models give our customers in the DoD a range of flexible new options for accessing the powerful integration capabilities of Cortex for untangling the volume, complexity and velocity of their data, and unlocking its true potential for better decision-making.”
FTI’s Full Capabilities
FTI offers a broad, integrated and seamless data analytic ecosystem, with capabilities including data integration, data analytics, modeling and defensive/resilient cyber technologies and services to enable the U.S. DoD, Intelligence Community and Federal Government to make the best decisions possible for their missions.
FTI’s extensive library of IP and technologies leverage more than $200M of U.S. Government and FTI R&D investment.
FTI’s data analytics solutions and services are built around the Cortex Integration Platform which leverages artificial intelligence/machine learning (AI/ML) to deliver a wide range of analytic and visualization capabilities for acquisition and operational decision support across DevSecOps, enterprise architecture analysis, enhanced data visualizations, model-based systems engineering, digital transformation and system performance analysis.
FTI’s modeling solutions and services help our customers better track, visualize, simulate and analyze trends and underlying mission drivers across wargaming, logistics analysis and visualization, system performance modeling, synthetic systems and data generation support.
FTI’s defensive/resilient cyber solutions offer a portfolio of advanced technologies and services to help maintain and optimize cyber defense, including mission cyber risk analysis, supply chain Illumination, blue and gray space analysis, penetration testing, RF analysis, and cyber-enhanced threat intelligence analysis.
About FTI
FTI provides deep data expertise, technology and services that enhance the ability of the DoD, Intelligence Community and other agencies of the Federal Government to make the best decisions possible. Drawing on nearly four decades of innovation, FTI’s extensive portfolio of intellectual property and operational technologies has been augmented by more than $200 m of U.S. government and FTI R&D investment, and solutions can often be mission-ready in a matter of weeks at a fraction of the cost of alternatives. Headquartered in Beavercreek, Ohio, FTI operates in 34 states, works at all levels of classification, and offers seven facilities of varying clearance levels nationwide. More at www.ftidefense.com. (Source: BUSINESS WIRE)
05 Apr 24. US Army picks Akamai for prototype battlefield zero trust project: T-ICAM. The civilian internet firm will build prototype software for Tactical Identity Credential & Access Management, a critical step in bringing “zero trust” cybersecurity to battlefield networks. The Army picked cloud and edge-computing giant Akamai to develop prototype cybersecurity software for its combat units, the service announced today. The project, known as T-ICAM, or Tactical Identity Credential & Access Management, aims to bring modern “zero trust” cybersecurity techniques to the networks used by Army forces in the field. Combat units will field test early prototypes later this year and provide feedback for rapid upgrades, the service said, with a larger rollout in 2025.
Akamai isn’t a traditional defense contractor and this isn’t a traditional acquisition program, the Army pointedly noted in its release about the April 4 award. Instead, using the streamlined Software Acquisition Pathway and a flexible Other Transaction Authority contract, the Army aims to leverage Akamai’s quarter-century of experience accelerating internet connections for civilian consumers and Fortune 500 businesses.
The Army’s portion of the Pentagon’s all-encompassing approach to information age command-and-control, CJADC2, requires major upgrades to already extensive tactical networks. But that creates an ever-greater challenge to keep all those devices and wireless links secure — especially if a soldier’s digital radio, militarized smartphone, or tablet full of battle plans is captured, stolen, lost, or hacked.
Traditional cybersecurity deals with such threats, in essence, through perimeter defense. Users log in with a unique ID and password and, in more secure systems, must also physically insert an ID card into a reader, such as the military’s much-hated CAC, the Common Access Card. Once a user logs in, however, they typically have access to everything on the network — a potential bonanza for both turncoat insiders and outside hackers able to steal or fake credentials.
To stop such threats, modern “zero trust” cybersecurity assumes the perimeter is going to be breached and keeps track of users’ activity once they’re logged on, granting each individual user access only to what they personally need for their particular role. For example, it might require additional checks to access important data or use AI to detect anomalous behavior by seemingly legitimate users. This monitoring, however, only works if the cybersecurity software knows which user is doing what and what they’re actually authorized to do — a process known as Identity, Credential, & Access Management.
“ICAM provides critical insight to the Army on exactly who and what is operating on the tactical network and what data they are accessing,” said Lt. Col. Keith Jordan, the Army’s product manager for tactical cyber & network operations, in the service’s release. “This unprecedented level of insight and visibility has never existed on the tactical network.”
That’s because ICAM is much easier to implement in the Pentagon or on a military base than on handheld digital radios and other ruggedized devices that a soldier has to take to the field, which must endure not only a physical beating but bad network connections caused by enemy jamming, hacking, or simple physical interference.
So the Army looked first at ICAM for its “enterprise” (on base and back-office) systems, then moved on to study vulnerabilities in its tactical (battlefield) networks, explained Col. Michael Smith, the service’s zero-trust director, in an August interview with Federal News Network.
“We’re really in the beginning stages of just piloting with some tactical formations,” Smith said then. “[It’s] a nascent effort … to get away from Common Access Cards in a tactical space, and use something that’s more simpler and faster for soldiers in specific roles to use.”
Now, seven months later, the Army has announced this contract to prototype Tactical ICAM software, awarded to Akamai, a company with little military experience but a lengthy track record on civilian networks. The goal, the press release says, is “to demonstrate the technical and operational feasibility of extending commercial ICAM capabilities — including Army Enterprise (E)-ICAM capabilities such as authoritative identity directories — to tactical units in denied, disconnected, intermittent, and limited bandwidth (DDIL) operational environments.”
“We have to assume that malicious cyber-attacks and degraded network environments will be a constant threat in future Large Scale Combat Operations,” said Mark Kitz, the Army’s Pogram Executive Officer for tactical command, control, & communications (PEO-C3T), in the service’s release. “Tactical-ICAM will enhance our defenses by more securely and effectively providing network and specific data access only to authorized users, devices, applications and services, even in the harshest operational environments.” (Source: Breaking Defense.com)
05 Apr 24. Netherlands seeks systems integrator for Foxtrot programme. The Netherlands Ministry of Defence (MoD) is looking for a systems integrator to assist with running the Foxtrot tactical digitisation programme, Janes learnt. Foxtrot is a major digitisation modernisation programme that aims to support the Netherlands Armed Forces transition to an information-driven, integrated force. Key to this is the replacement of legacy communication systems and the enhancement of its battlefield management systems. According to industry sources who spoke to Janes at the SAE Group’s Future Soldier Technology conference held between 11 and 13 March, L3Harris Technologies is one of the companies bidding to be the systems integrator. (Source: Janes)
05 Apr 24. Cyber Update Key points.
- A newly discovered vulnerability in Linux software points to information-theft risks via the software supply chain (see Sibylline Cyber Daily Analytical Update – 2 April 2024 and our Technical analysis below).
- An emergent malware distribution campaign signals growing security and financial threats posed by financially-motivated threat groups (see Sibylline Cyber Daily Analytical Update – 3 April 2024 and our Technical analysis below).
- New ransomware operation targeting VMware software highlights sustained security, financial and reputational risks from vulnerable software (see Sibylline Cyber Daily Analytical Update – 4 April 2024).
- US-based entities face elevated security and disinformation risks from Chinese state actors as they increase the use of AI-generated media in election interference campaigns.
A new backdoor was discovered in the Linux open-source software, ‘liblzma’, commonly used by developers to compress and decompress release files. The malware affects servers hosting publicly-accessible Secure Shell (SSH) authentication processes, loading versions xz-5.6.0 or xz-5.6.1. A malicious script is initially executed after the compromised payload is downloaded from its repository. The script then looks for a specific set of conditions upon inspecting incoming SSH connection requests. This then loads additional malicious payloads which grant unauthenticated threat actors the ability to remotely execute code on the targeted system. Although the intent behind the deployment of this backdoor remains unknown, remote access is typically used to steal sensitive data, install malware, disrupt critical operations and/or launch further attacks. Most notably, the malicious payload is partially hidden in release test files, allowing for greater stealth and prolonged obfuscation. Consequently, the discovery of this new backdoor emphasises threat actors’ perseverance alongside the growing sophistication of their tactics, techniques and procedures (TTPs).
The financially-motivated threat group, ‘Water Curupira’, recently started distributing the ‘Pikabot’ trojan in a new campaign. The campaign starts with a phishing email containing either malicious zip files or a server message block (SMB) file-sharing link. The link exploits a bug which allows the threat actors to hijack existing email threads, thereby enhancing legitimacy. The malware then inserts itself in the targeted system, subsequently enabling the threat actors to collect sensitive data and remotely execute additional malicious code. Water Curupira typically exploits access to infected systems to deploy ‘Black Basta’ ransomware and garner illicit profit. Additionally, Pikabot checks for debugging and sandbox environments so as to remain undetected. Water Curupira uses a wide variety of file formats (such as Excel and JavaScript) to more effectively trick victims into engaging with the malicious files, while simultaneously evading automated detection tools. The group’s ability to bolster success rates and achieve prolonged persistence points to its knowledge of modern IT systems and growing sophistication of their TTPs.
Some non-exhaustive recommendations to mitigate against these threats include:
- Enforce strict security policies including regular software and password updates, as well as adequate network segmentation to prevent lateral movement following an infection.
- Monitor devices and networks for suspicious activity.
- Conduct cyber hygiene awareness and vigilance courses to enable users to recognise and report phishing and other types of social engineering attempts.
- Add available Indicators-of-Compromise (IoCs) to the organisation’s security detection systems to detect potentially malicious samples on the network.
- Ensure adequate security detection measures are in place, particularly behaviour-based end-point detection and response (EDR) solutions.
- Store regular data backups in external and secure locations to ensure data can be restored quickly and effectively in the event of a compromise.
Our cyber word(s) of the week: Wiper (Malware) (Source: Sibylline)
05 Apr 24. Finnish Ministry of Defence Decided on a Partnership Agreement with Bittium Wireless Ltd, a Subsidiary of Bittium Corporation. The Finnish Minister of Defence, Mr. Antti Häkkänen has authorized the Finnish Defence Forces to sign a partnership agreement with Bittium Wireless Ltd, a subsidiary of Bittium Corporation, for the years 2025–2036. The aim is to sign the agreement during the year 2024.
The basis for the partnership is the maintaining and development of defense readiness for the purposes of normal and emergency circumstances. The partnership agreement secures the availability, performance and usability of Bittium-supplied products and services critical for the Finnish Defence Forces in all conditions. The partnership agreement creates mechanisms for planning joint operation in emergency circumstances, which enables Bittium to plan and provide product manufacturing, servicing, repair, maintenance, and development related functions.
The partnership agreement covers command and control systems used by all branches of the Defence Forces, including Bittium’s tactical communications system and related products (Bittium Tactical Wireless IP Network™, Bittium Tough SDR™, Bittium Tough VoIP™). The aim of the agreement is that the partnership will become a fixed part of the comprehensive national defense.
“When realized, the partnership agreement will enable systematic planning and execution of cooperation in a cost-efficient manner that benefits both parties. Partnership with the Finnish Defence Forces would add the credibility as reliable partner also in the international markets”, says Johan Westermarck, CEO of Bittium Corporation.
The monetary value of the agreement will depend on the yearly armament needs and funding of the Finnish Defence Forces.
————————————————————————-
Spectra Group (UK) Ltd
Spectra Group (UK) Ltd, internationally renowned award-winning information security and communications specialist with a proven record of accomplishment.
Spectra is a dynamic, agile and security-accredited organisation that offers secure Hosted and Managed Solutions and Cyber Advisory Services with a track record of delivering on time, to spec and on budget.
With over 15 years of experience in delivering solutions for governments around the globe, elite militaries and private enterprises of all sizes, Spectra’s platinum and gold-level partnerships with third-party vendors ensure the supply of best value leading-edge technology.
Spectra was awarded the prestigious Queen’s Award for Enterprise (Innovation) in 2019 for SlingShot.
In November 2017, Spectra Group (UK) Ltd announced its listing as a Top 100 Government SME Supplier by the UK Crown Commercial Services.
Spectra’s CEO, Simon Davies, was awarded 2017 Businessman of the Year by Battlespace magazine.
Founded in 2002, the Company is based in Hereford, UK and holds ISO 9001:2015, ISO 27001:2013 and Cyber Essentials Plus accreditation.
————————————————————————-