USBs are no longer keys to unlock military networks

Day by day, modern society is becoming more reliant on digital technologies, and this is as true for the military as it is for any private individual or corporation. As this trend gathers pace, the potential impact of any failure in IT infrastructure becomes greater, so cybersecurity should be at the top of the agenda in the defence industry.

The sensitive nature of data in military IT systems makes it a key target for malware. Any unauthorised access and any compromised files can lead to breaches of national security or the loss of strategic advantage. Something as simple as an infected USB drive can wreak havoc, as the US military discovered in 2008 when a drive containing malware spread malicious code into a network run by the US Central Command.

For the past seven years, Swedish company Hunna has been working on a solution to prevent such an event from happening again.

“There was a need to exchange information between nations using USB sticks in a military context and we were asked to develop a prototype to handle the problem,” says Jonas Engfors, COO at Hunna. “We developed proof of concept that led our armed forces to want a real product for its new command and control system for international missions.

“We take the unknown source that could be manipulated at a hardware level or at a software level and we filter the files for malware before copying the information to a new USB stick over which the organisation has control,” Engfors adds. “From unknown hardware with unknown information, we transfer sanitised information to known hardware.”

A tank for top-level security

The company started out supplying the Swedish armed forces, which uses fully air-gapped military IT systems, creating the need to transfer large amounts of data on USBs. Since then, Hunna has started selling its hardware to governmental agencies, private companies and operators of critical infrastructure around the globe. Having proved the performance of its technology at the highest level by successfully sanitising top secret military files, Hunna is now able to customise its offering to handle any level of security classification.

“We started at the top of the pyramid and now we make simpler and cheaper versions for organisations with lower IT security demands,” says Christopher Ekström, senior consultant at Hunna. “Not all organisations need a tank, some need a Volvo. We built the tank and now we are looking to make the Volvo version.

“In every case, we have layers of filters,” he adds. “For example, we use anti-virus software and content disarm and reconstruct (CDR) software from UK company Glasswall, so we can take out most kinds of threats, even zeroday attacks.”

Honing in on CDR

Instead of focusing on known malware, CDR cuts out the possibility of running malware in different kinds of files by looking at the manufacturer’s specification for each file, such as a Word document or a PDF, to identify anything that does not belong in that file. It can, for instance, deactivate macros that do not belong.

“Antivirus software is like a drug treatment and CDR is like a vaccine,” explains Ekström. “It can be tweaked to the highest level of protection and, for example, only allow certain file types through the device. In any application, all you have to do is put the USB stick in the source port and put another in the target port, then the device does everything and tells you when it is ready.”

Simple in principle and easy to use, Hunna’s system is tuned to the highest standards. It is certified for Nato’s Tempest Level A, which ensures that any electromagnetic signals from the USB cannot be intercepted and analysed.

“It is technically possible to listen in to electromagnetic signals from a monitor display with the right equipment, and this is a big threat in the military context,” explains Engfors. “Our solution prevents that.”

“Globally, there are a handful of solutions out there that compete with us at a lower level,” he adds, “but when it comes to building a tank that can handle top secret information, we are the only solution provider.”