Cyber Security and Information Systems Information Analysis Center (CSIAC) is a United States Department of Defense (DoD) Information Analysis Center (IAC) sponsored by the Defense Technical Information Center (DTIC). The CSIAC is a consolidation of three predecessor IACs: the Data & Analysis Center for Software (DACS), the Information Assurance Technology IAC (IATAC) and the Modeling & Simulation IAC (MSIAC), with the addition of the Knowledge Management and Information Sharing technical area.[1]
CSIAC, one of three IACs sponsored by DTIC,[2] performs the Basic Center of Operations (BCO) functions necessary to fulfill the mission and objectives applicable to the DoD Research, Development, Test and Evaluation (RDT&E) and Acquisition communities’ needs.[3] These activities focus on the collection, analysis, synthesizing, processing and dissemination of Scientific and Technical Information (STI).
The BCO functions, specifically the collection and dissemination of STI, produce several valuable resources (e.g., reports, tool databases, data collections, etc.) in the CSIAC's core technology areas (Cybersecurity, Information Assurance, Software Engineering, Modeling & Simulation and Knowledge Management/Information Sharing).
CSIAC's mission is to provide the DoD with a central point of access for Information Assurance and Cybersecurity to include emerging technologies in system vulnerabilities, R&D, models and analysis to support the development and implementation of effective defense against information warfare attacks.[4]
The CSIAC is chartered to leverage best practices and expertise from government, industry and academia on cyber security and information technology.
The United States may be vulnerable to Information Warfare attacks due to the dependence of various infrastructures on timely and accurate information services. This is further complicated by the reliance of DoD information systems on commercial or proprietary networks that are accessible to both authorized users and potential adversaries. Identifying critical paths and vulnerabilities within the information infrastructure is a complex undertaking, and recent advances in information technology have made information systems easier to use, less expensive and more available to a wide spectrum of potential adversaries.
The security of the nation depends on the survivability, authenticity and continuity of DoD information systems. These systems are vulnerable to external attacks, due in part to their necessary dependence on commercial systems and the increased use of the Internet. The survivability, authenticity, and continuity of DoD information systems are crucial for the Warfighter. With the increasing amount of concern and Information Warfare activities requiring rapid responses, it is challenging to ensure that all appropriate agencies and organizations have the knowledge and tools to protect from, react to and defend against Information Warfare attacks. CSIAC has been established under the direction of the Defense Technical Information Center and the integrated sponsorship of the Assistant Secretary of Defense for Research and Engineering (ASDR&E); Assistant to Secretary of Defense/Networks and Information Integration; and the Joint Chiefs of Staff.[5]
CSIAC provides centralized Cyber Security vulnerability data, information, methodologies, models, and analyses of emerging technologies to support the survivability, authenticity, and continuity of operation of Information Systems critical to the nation's defense. It serves as a specialized subject focal point, supplementing DTIC services within DoD Directive 3200.12, DoD Scientific and Technical Information Program (STIP), dated February 11, 1998.[6]
The United States is vulnerable to Information Warfare attacks due to its reliance on timely and accurate information services and recent advances in technology have made it easier for potential adversaries to access critical infrastructure. The security of the nation depends on the survivability, authenticity and continuity of DoD information systems, which are vulnerable to external attacks. CSIAC provides centralized Cyber Security vulnerability data and support to ensure the continuity of critical Information Systems for the nation's defense.
To address these vulnerabilities and threats, the United States employs a multi-faceted approach that includes cybersecurity policies, defense strategies, threat intelligence sharing and investments in technology and personnel. Continuous vigilance, collaboration among government agencies, private sector cooperation and international partnerships are essential to protect against information warfare attacks and ensure national security.
Given the evolving Defense environment, as well as recent congressional guidance, the Defense Technical Information Center (DTIC) recognized an opportunity to reshape the IACs to better respond to DoD mission needs. As a result, DTIC is realigning and consolidating the IAC program structure to achieve several objectives:
To achieve these objectives, DTIC is forming new, consolidated IAC Basic Centers of Operation (BCOs). The BCOs are managed by both industry and academia. The DoD establishes IAC BCOs in areas of strategic importance, such as cyber security and information systems. An IAC BCO serves as the center for its technical community, and, as such, must maintain a connection with all of the key stakeholders within that community, to understand ongoing activities, current information, future strategies, and information needs.
This mission remains unchanged in the new IAC structure. However, what the new approach brings is expanded scope, increased focus on technical information needs, and enhanced agility, as the Defense environment continues to evolve.
BCOs will still analyze and synthesize scientific and technical information (STI). However, they are also to take on an expanded role in program analysis and integration by assessing and shaping nearly $6 billion in Technical Area Tasks (TATs). TATs are a companion offering of the IAC Program, through which DTIC leverages industry and academia's best and brightest to conduct research and analysis, developing innovative solutions to the most challenging requirements. IAC BCOs will ensure consistency with and reduce duplication of prior or other ongoing work by helping to ensure TATs are more responsive both to customer needs and broader DoD imperatives. BCOs are also required to ensure that TAT results are properly documented and made available for broad dissemination. This approach both achieves cost savings and reduces risks, ensuring that in this time of shrinking budgets and evolving requirements, the Defense community leverages all available knowledge to identify and implement innovative solutions.
The CSIAC BCO represents the first awarded BCO under the new DTIC structure. As its name suggests, CSIAC's main technical focus is on Cyber Security and Information Systems. CSIAC merges the software engineering technology area of the DACS, the modeling & simulation technology area of the MSIAC, and the information assurance technology area of the IATAC together. It will also address two new technology focus areas: knowledge management and information sharing. Additionally, CSIAC will expand into other areas of importance and closely monitor new technologies as they emerge.[8]
CSIAC operates under the direction of our Government Steering Committee. The committee is made up of 19 individuals from the Government, DoD, and the research and development (R&D) communities, including representation from the Defense Information Assurance Program (DIAP), Joint Task Force for Global Network Operations (JTF-GNO), National Security Agency (NSA), Naval Postgraduate School (NPS), Office of the Secretary of Defense (OSD), and the Navy Information Operations Command - Norfolk, to name a few. The steering committee meets once a year and provides input and feedback to CSIAC's operations, particularly our information collection and dissemination efforts. Additionally, the topics of the technical reports that CSIAC authors write are dictated by the Steering Committee.
The Cyber Security and Information Systems Information Analysis Center (CSIAC) is a U.S. Department of Defense Information Analysis Center (IAC) sponsored by the Defense Technical Information Center (DTIC), and Assistant Secretary of Defense for Research and Engineering (ASDR&E). CSIAC is hosted by Quanterion Solutions Incorporated.
The CSIAC team members consist of a BCO, Tier 1 team members, and Tier 2 team members.
Quanterion Solutions Incorporated, a small business in Utica, New York was awarded the CSIAC contract in fall of 2012.[9]
In addition to the Tier One team members, the CSIAC team includes Tier Two organizations, that provide reach-back support with subject matter experts (SMEs) that assist with technical inquiries, State-of-the-Art reports (SOARs), and core Analysis Tasks (CATs). The Tier 2 organizations of the CSIAC team include:
CSIAC's strategy to address the broadened scopes of the three IACs (DACS, IATAC, MSIAC), as well as the new areas of knowledge management and information sharing is to build and facilitate a Community of Practice (CoP) for the cyber security and information systems community.
The CSIAC website (www.thecsiac.com) provides the infrastructure for the CoP and serves as the catalyst. The CSIAC website is member driven and encourages participation from the CSIAC community supported by CSIAC resources and activities. The website emphasizes unifying CSIAC resources and its members by supporting conversions and collaborations.
The CoP supports the entire operation of the CSIAC, including information collection, analysis, and dissemination.
CSIAC's Subject Matter Expert (SME) Network is one of the most valuable resources to the user community. They provide a wealth of knowledge and information to the center through a variety of means. For example, SMEs are the main contributors of journal articles and webinar presentations. They are also available to respond to inquiries, assist with State-of-the-Art reports (SOARs), and perform research and analysis to support Core Analysis Tasks (CATs).[15]
CSIAC SMEs are those individuals who are considered to be experts in the fields that fall within the CSIAC's technical domain (i.e., cybersecurity, information assurance, software engineering, Modeling & Simulation, and Knowledge Management/Information Sharing). No single criterion provides the basis for being considered an expert, but instead it is based on a combination of factors, including an individual's:
The database consists of a wide range of SMEs from various backgrounds. Among those are members of the CSIAC's technical staff, key individuals from team member organizations, retired senior military leaders, leading academic researchers, and industry executives.
The CSIAC provides up to four hours of free technical inquiry research to answer users’ most pressing technical questions. Technical inquiries submitted online are sent directly to an analyst who identifies the staff member, CSIAC team member, or Subject Matter Expert (SME) that is best suited to answer the question. The completed response will be sent to the user, and can take up to 10 working days; though they are typically delivered sooner.[16]
Challenging technical problems that are beyond the scope of a basic inquiry (i.e., require more than four hours of research) can be solved by initiating a Core Analysis Task (CAT). CATs are separately funded work efforts over and above basic CSIAC products and services. Through the CAT program, the CSIAC can be utilized as a contracting vehicle, enabling the DoD to obtain specialized support for specific projects. These projects, however, must be within the CSIAC's technical domain (cybersecurity, Information Assurance, Software Engineering, Modeling & Simulation, and Knowledge Management/Information Sharing).[17]
Some of the advantages of the IAC CAT program include:
CSIAC collects IA/DIO related STI to share with the DoD, other federal agencies, their contractors, and the research and engineering (R&E) community. The STI program is governed by DoD Directive 3200.12, DoD STI Program.[18]
CSIAC has thousands of IA/DIO-related documents in their technical repository.[19] This collection is a combination of both classified and unclassified material. All of CSIAC's documents are uploaded to DTIC Online Access Control (DOAC), which is an online repository of STI from all of DTIC's IAC's.[20]
CSIAC's library facilitates knowledge sharing between diverse groups and organizations, and all STI is readily accessible to the IA/DIO community within the classification and secondary distribution instructions.[21]
All STI collected by CSIAC is relevant to IA/CS research, development, engineering, testing, evaluation, production, operation, use, or maintenance. STI is collected in many forms including text-based documents, multimedia, and rich media files. Some topic areas include: Biometrics, Computer Network Attack, Computer Network Defense, Cyber Terrorism, Hacking, Information Warfare, Network-centric Warfare, Malicious Code, Product Evaluations, among others. CSIAC collects unclassified submissions from across all of the IA/CS community.
The CSIAC maintains an online calendar of events related to the interests of its members. The Events Calendar is also available as an RSS feed or a HTML viewable from the CSIAC website.[22]
Software & Systems Cost & Performance Analysis Toolkit (S2CPAT) is a web-based toolkit with the goal of capturing and analyzing software engineering data from completed software projects that can be used to improve:
S2CPAT currently allows users to search for similar software projects and use the data to support:
The S2CPAT repository contains Software Resources Data Report (SRDR) data provided by the US Air Force. This data has been sanitized for public release by DoD and validated by a DoD-funded academic research team.[23]
CSIAC publishes three types of reports on current Cyber Security and Information Systems topics:
CSIAC's Journal of Cyber Security & Information Systems is a quarterly technical journal written from a DoD perspective and contains the following: synopses and critiques of significant, newly acquired reports and/or journal articles; summaries of the initiation of new R&D programs; listing or calendar of future conferences, symposia, etc.; and summaries of significant technological breakthroughs and significant new technological applications and highlights of any other outstanding developments. News from various DoD CSIAC programs that would be of interest to other DoD organizations may also be included. The journal is distributed in print and electronic format to registered CSIAC subscribers free of charge and is available for viewing and download from the CSIAC website.
Journal sources are direct invitations, publishing "Call for Papers", and unsolicited submissions. Direct invites are the most common method, usually by contacting conference presenters and asking if they could write something based on their presentation. Authors are solicited for their expertise or experience relative to the theme of the journal issue.
The CSIAC's Information Assurance (IA) Digest is a semi-weekly news summary for information assurance and software reliability professionals protecting the Global Information Grid (GIG). It is transmitted in an HTML-formatted email and provides links to articles and news summaries across a spectrum of cyber security, information assurance, and information systems topics.[30]