Re:Securing your own assets (Score 1)

This was all done by contractors, mind you, and it got done because we liked what we were doing, took pride in doing a good job of it, and we had support from the squadron commander.

Once the MAJCOM started taking control of the security stuff, our defensive posture went to crap.

I have to say that the aggressor squadron teams that'd come in and attack the network knew their stuff. And of course they were able to break in every time.

Most importantly, make it clear that their job is security, and not paper pushing.

Exactly, exactly. I find it hard to believe that Gen. Lord is not aware of this, so I have to assume that the answers are of the 'PR Filtered" variety.

Also, I'm not sure how he can say "Certainly the balance between having access to do our mission and having robust security is an issue where not everyone agrees on just how much to restrict or how much to allow." Someone needs to read up on his regs:

http://iase.disa.mil/stigs/checklist/index.html

http://iase.disa.mil/stigs/stig/index.html

http://www.nsa.gov/snac/

Etc. The issue is not that it's "not everyone agrees on how much to restrict." I think the regs and best practices out there are pretty clear. It's a issue of "how much do we want to comply with restricted access methodolgies and regulations." So basically, Cyber Command will be just a repackaged example of base network security that you described above, except this time it's not going to be an AFSPC base, or an AMC/ACC, it going to be a huge target called 'Cyber Command"....