Defense Stalwarts Building Cybersecurity CSI

Network World — Northrop Grumman has become the latest defense contractor to go whole hog into cyber threat monitoring and detection. The defense giant said it has opened cyber threat detection and response center staffed around-the-clock, providing security monitoring for more than 105,000 clients and 10,000 servers worldwide.

The company joins other defense giants such as Lockheed, Boeing and Raytheon to create their own cybersecurity technology and services. Such companies have been hiring network security staff or buying up smaller security firms to augment their own credentials.

"Everybody smells money here," Stephen Kent, chief scientist at BBN Communications, told Network World in a recent article. "The size of the business could be enormous."

20 useful IT security Web sites

10 of the Worst Moments in Network Security History

Indeed, a recent Market Research Media report showed government cybersecurity spending growing at 6.2% per year to a total of $55 billion over the next six years. Other published estimates put that spending at $11 billion to $13 billion in 2013 alone.

At Northrop, the company’s Cyber Security Operations Center is a 6,300 square foot facility equipped with a large classified conference facility and secure connectivity to numerous customer networks. The heart of the CSOC is the security operations center floor, where analysts use customized tools to monitor and process more than 1.5 billion daily cyber events that occur on the Northrop Grumman network, the company stated.

"Advanced technology is key to defending any network, but it is the experience and curiosity of our analysts that allow us to proactively identify cybersecurity vulnerabilities," said Tim McKnight, vice president and chief information security officer of Northrop Grumman Information Systems in a statement. "They keep our network resilient and secure by constantly trying to make connections, determine if events are random or not. It's like a cyber 'CSI'."

At the CSOC, incident handlers respond to suspected security incidents; computer forensic examiners collect and analyze evidence from digital media; a technical team develops and deploys solutions and systems used within the CSOC; intelligence operators analyze and report on internal and external threats; and computer network defense experts design and develop security capabilities that can identify advanced threats.

Indeed many defense contractors that have worked on classified security projects before are familiar with the unique threats that states pose to the US government that differ from the kinds of threats that corporations generally face. These contractors have expertise that is a natural fit for protecting the government networks most likely to be targeted, such as those in military and intelligence agencies, Kent says.