全球智库信息集成服务系统

Critical Areas in Which to Enhance the Ability to Detect Corrupted Data

• The detection must be sufficiently prompt. Promptness results from a combination of individuals detecting and reporting corrupted data quickly and detecting corrupted data early in the chain of custody.
• Highly automated processes — in which humans do not see the data during normal operations — present a significant challenge for detection. Automation requires special mechanisms to assist in detecting corruption.
• Detection of corrupted data is most critical during wartime, yet anomalies are less evident during wartime than during peacetime because wartime itself is an anomaly. Mechanisms are needed to adjust detection mechanisms from peacetime to wartime conditions.
• For workers (airmen, civilians, and contractors) to detect anomalous data, they all need to be trained to understand the expected baseline and need to be continuously vigilant when examining data.
• Leadership must create an environment that encourages workers to report suspected anomalous data.

Logistics operations depend on accurate information. Even relatively small errors in support systems can, in some circumstances, have large effects on operations. But errors are inevitable, so logistics operations should be robust to errors, whether they are a random occurrence or the result of a deliberate, targeted cyber attack. The U.S. Air Force asked RAND Project AIR FORCE to determine where it is most fruitful to focus effort in making changes to tactics, techniques, and procedures to improve an airman's ability to detect, evaluate, and mitigate significant corruption of logistics data. The goal is to respond to errors in data before they have a significant negative effect on combat operations.

Highly automated processes — in which humans do not see the data during normal operations — present a significant challenge for detection. Detection of corrupted data is most critical during wartime, yet anomalies are less evident during wartime than during peacetime because wartime itself is an anomaly. Therefore, mechanisms are needed to adjust detection mechanisms from peacetime to wartime conditions. For workers (airmen, civilians, and contractors) to detect anomalous data, they all must be trained to understand the expected baseline and must be continuously vigilant when examining data. Leadership must also create an environment that encourages workers to report suspected anomalous data.

Recommendations include defining, within logistics policy, what measures the logistics community should take in response to each information operations condition level and creating a new central body (perhaps within an existing organization) — the Global Data Integrity Cell — that would receive all reports of suspected data anomalies to enable enterprise-wide situational awareness.

• Chapter One

  Approaching the Problem

• Chapter Two

  The Challenges of Detection

• Chapter Three

  Recommendations for Improving Detection

• Chapter Four

  Evaluation

• Chapter Five

  Prioritizing the Effort

• Chapter Six

  Discussion and Conclusions