CDM-CYBER-DEFENSE-eMAGAZINE-March-2019

Operation Eligible Receiver - The Birth Place of
Cybersecurity: Configurations
More than twenty years ago, the National Security Agency conducted an exercise to test the
response capabilities of critical Department of Defense information systems in the case of a
breach. The exercise was named Operation Eligible Receiver 97, and it concluded with startling
results. Utilizing only hacking techniques available publicly, the NSA was able to completely
infiltrate the DoD network and gain super user access into high-priority devices; however, one of
the only known cases of prevention from the NSA reaching their targets occurred when a marine
noticed suspicious traffic on the network and immediately changed configuration settings to lock
down permissions.
After a two-year review of the exercise, recommendations were made for an increased focus on
configuration management for all entities. Though best practices were not formally codified, the
configuration management practices within compliance frameworks reflect the results of the
exercise. These frameworks include NIST 800-53 and Security Technical Implementation Guides
(STIGs).
Operation Eligible Receiver highlighted the importance of organizations understanding what
systems they have, how they are configured, what has changed, and who made changes. With
this knowledge security teams are better equipped to meet regulatory compliance and identify
configuration drift.
Today’s Common Mistakes
In order to improve security posture, organizations must understand what they have, and in doing
so, should conduct a reliable asset inventory. It is essential for security teams to know how their
network is configured and what has changed over time. When done manually, the process of
keeping track of configuration changes can take large amounts of time which many security
professionals do not have. A manual approach will typically rely on guesswork when answering