Information Assessment Test Tool (IATT) for IO/IW Briefing by: Darrell L Quarles Program Director

1. Information Assessment Test Tool (IATT) for IO/IW Briefing by: Darrell L Quarles Program Director U.S. Army Threat Systems Management Office PEO STRI 256-876-9656 ext 268 (DSN: 746) darrell.quarles@tsmo.redstone.army.mil UNCLASSIFIED ARMY THREAT SYSTEMS PROGRAM NET 3 Conference & Exhibition 23 July 2003 UNCLASSIFIED

2. ARMY THREAT SYSTEMS PROGRAM AGENDA Program Background Program Description OTIA Methodology Concept of Operations Capabilities On-Going Development Tool Configuration Summary

3. UNCLASSIFIED ARMY THREAT SYSTEMS PROGRAM Background • This program was developed to supply Information Assurance Analysis to the Intelligence Electronic Warfare Test Directorate (IEWTD) of ATEC/OTC for Operational Testing UNCLASSIFIED

4. ARMY THREAT SYSTEMS PROGRAM Program Background (Cont’d) Program was started in FY 01. Task joins the capabilities of two Contractors: Dynetics and General Dynamics (GD) Test Methodology, Threat Definition, and Scenario Development is provided by Dynetics IATT development and IA threat integration by GD

5. ARMY THREAT SYSTEMS PROGRAM Program Description A multi-step Operational Test Information Assurance (OTIA) Assessment Methodology Identification and certification of the IA related DIA validated threat A test tool that can perform penetration testing on the System under Operational test This project consists of three tasks to aid in the Information Assurance Assessment:

6. ARMY THREAT SYSTEMS PROGRAM OTIA Methodology • System IS/IA Analysis: • System SSAA • Previous IS/IA Analysis • System Documentation • -Topology • -Information Flow • Vulnerability Analysis • IS/IA System Scan • Conducted to: • Verify IS/IA goals met • Identify additional • Routes of Intrusion • Determine OS and • Hardware/Software • Configuration • Create an Internal &External Port Map • System IS/IA Risk/ • Impact Matrix: • Identifies Operational • risks of IS/IA Configuration • Confirms ISSA goals are met • Assessment of System IS/IA Status 5 1 2 • Penetration AnalysisConducted to determine if IS/IA System: • Identified penetration • attacks • Stopped penetration • attacks • Impact of Penetration • on Mission IS/IA System Penetration Test conducted to: Stress System IS/IA (Penetration Tailored to System) Penetrate and Mark 4 3

7. UNCLASSIFIED ARMY THREAT SYSTEMS PROGRAM IATT Concept of Operations IATT is an easily transportable IA threat launch platform. IATT is to be populated with a DIA validated set of IA Threats that are specific to the target system/test Configuration. IATT is to provide ATEC-OTC and test community the capability to measure the IA health of systems against actual IA threats exercised in realistic scenarios. UNCLASSIFIED

8. UNCLASSIFIED ARMY THREAT SYSTEMS PROGRAM IATT CAPABILITIES • Information Gathering • Stealthy and non-stealthy scanning of network assets to find a entry point vulnerability to exploit. • Network Monitoring • - Passive tools to map the network, steal critical communications. • Infiltration • Gain access to a local/remote system by exploiting a vulnerability in COTS software. • Password Guessing/Cracking • Guess common passwords / break systems password files. • Nefarious Data Manipulation • Intercept/inject mission data transmissions on the network. • Denial of Service • Prevent communications through computer service disruption or elimination. UNCLASSIFIED

9. UNCLASSIFIED ON-GOING DEVELOPMENTS • C2IATT/NOVA • Automated scenario execution across multiple IATT units for complex tests. • Counter-Counter Measure Development • Provides a more realistic approach of attack scenarios. • Automated Decision Aides • Develop capabilities to enhance users decision making process. • Wireless IA Capability • - Current information attack systems evaluate wired networks against random and intentional threats. The military requires a capability to test military wireless networks against the same types information attack threats. Knowing the susceptibility of military wireless networks to wireless information attack threats increases overall system security. Information assurance on all data links is essential to mission success, force protection, and information dominance. UNCLASSIFIED

10. Live Test Configuration Replicate Target Network in a Test Environment

11. Actively scans for hosts on target network Determines Operating System & Port Information Mass Scan

12. Passively detects hosts on target network Quantifies incoming and outgoing traffic Passive Detection

13. Identifies communication relationships between computers on the network Identifies data generators / receivers Target Relationship Tool

14. Singled out target on the network The impact of neutralizing the right target is immeasurable Demonstration Configuration IATT / Illuminate RWS V6 Simulated

15. Display results of scan for target Provides access to attacks for target System Operations – Information Panel

16. Collects network traffic in multiple protocols, ports, directions. Collects data to libcap files for review / analysis System Operations – Snoop

17. Conducts attack operations Standardized test configurations Attack status indicators System Operations – Attack

18. Scan Reports Network Reconnaissance logged for After Action Reviews (AAR)

19. Target Reports Every Activity Logged Against Every Target

20. Attack Reports Every Attack Characterized and Logged

21. Test / Scenario Conductor Threat Execution Threat Execution Threat Execution Threat Scenario Requirements

22. UNCLASSIFIED ARMY THREAT SYSTEMS PROGRAM SUMMARY The methodology and tools being developed is laying the ground work and the essential tools necessary for the T&E community to properly assess the Information Assurance issues associated with our digitized forces. Program foundation success for future development in IA. Program is on schedule. UNCLASSSIFIED

23. QUESTIONS?