Cyber defense methods as refined by Air Force

Defense Systems:

The Air Force and private industry are refining new cyber techniques designed to anticipate and thwart enemy attacks before they happen.

IT management firm Robbins Gioia, a cyber security partner with the Air Force and other government entities, told Defense Systems about some cutting-edge methods currently used to examine code behind firewalls.

“We create an intelligence radar for upcoming threats” to allow them to detect and respond proactively, Andrew Robinson, CEO of Robbins Gioia, said in an interview.

These tactics are aimed at filtering through current systems to establish areas where cyber-attackers might seek to penetrate networks.

“Look behind the firewall and start to filter through current systems and determine where weaknesses in their code and structure exist,” Robinson explained.

Another element of this approach involves a thorough assessment of prior cyber-attacks on other government systems as a method of setting up a defense against them.

Robinson explained that, in some cases, porting data to different architecture, new blade servers or modernized firewalls can be part of the calculus for a so-called “active defense” posture.

The strategy is intended to leverage security data form multiple sources, including operating system logs, application logs, firewall log data, proxy logs, intrusion detection systems, host-based intrusion detection systems, identity management systems and dynamic malware execution environments, RG officials explained.

Robbins Gioia’s collaboration with the Air Force incorporates an approach called “cyber radar.” This is, as it sounds, a cyber-threat detection technique using a dashboard to assess risk and real-time vulnerability.
...

There is more.

They need to add active defense measures to their menu.   They should incorporate malware that will infect the attackers computer system and take it down.  They also need to be able to trace the source of the attack through any zombie systems used in the attacks.  They need to incorporate the principals of the HARM anti-radar missiles that the Air Force used to attack enemy radar as soon as it comes on.  A similar system would identify the intruder and zap his equipment.