Michael Bruce Donley Biography

President George W. Bush today announced his intention to nominate and designate one individual to serve in his Administration. The President intends to nominate Michael Bruce Donley, of Virginia, to be Secretary of the Air Force and designate Acting.

Mr. Donley currently serves as Director of Administration and Management at the Department of Defense. Prior to this, he served as Senior Vice President at Hicks & Associates (a subsidiary of Science Applications International Corporation). Earlier in his career, he served as Assistant Secretary of the Air Force (Financial Management and Comptroller) and as Acting Secretary of the Air Force. Mr. Donley received his bachelor's degree and master's degree from the University of Southern California. # # #

For Immediate Release Office of the Press Secretary June 9, 2008

Biography{ Michael B. Donley Director of Administration and Management (OSD)

Mr. Michael B. Donley was appointed by the Secretary of Defense to serve as the Director of Administration and Management (DA&M) in May 9, 2005.

As the DA&M, Mr. Donley is the principal staff assistant to Secretary Robert Gates for Department of Defense (DoD) Organizational and Management Planning. He oversees the DoD Freedom of Information and Privacy programs, and Historical and Information Technology / Chief Information Officer (CIO) programs for the Office of the Secretary of Defense (OSD). He is also responsible for Washington Headquarters Services, a 1,300-employee, $1.3 billion Field Activity that oversees management of the Pentagon, DoD leased space and DoD administrative services within the National Capital Region; the Pentagon Force Protection Agency which is responsible for Antiterrorism, Security and Law Enforcement; and the $5.5 billion Pentagon Renovation and Construction Program.

Mr. Donley has over 26 years of experience in the national security community, including service in the Senate, White House and the Pentagon. During his career he has been involved in strategy and policymaking at the highest levels and is a recognized expert in national security organization, planning and budgeting.

From 1996 until his appointment as DA&M, Mr. Donley was a Senior Vice President at Hicks and Associates, Inc., a subsidiary of Science Applications International Corporation (SAIC). During this time he served as a Special Advisor to the Defense Reform Commission in Bosnia-Herzegovina for the State Department and contributed to several major Defense projects involving organizational reform and planning.
From 1993 to 1996, Mr. Donley was a Senior Fellow at the Institute for Defense Analyses. Prior to this position, he served as the Acting Secretary of the Air Force for seven months. From 1989 to 1993 he served as the Assistant Secretary of the Air Force (Financial Management and Comptroller) with responsibility for all CFO functions including budgeting, cost and economic analysis.

Mr. Donley served the National Security Council as Deputy Executive Secretary from 1987 to 1989 and as Director of Defense Programs from 1984 to 1987. He was also a Professional Staff Member on the Senate Armed Services Committee (1981-84), a Legislative Assistant to the U.S. Senate (1979-81) and the Editor of the National Security Record for the Heritage Foundation (1978-79).

Mr. Donley served in the United States Army from 1972 to 1975 with the XVIIIth Airborne Corps and 5th Special Forces Group (Airborne), attending the Army’s Intelligence and Parachute Schools and the Defense Language Institute.

Mr. Donley earned both B.A. and M.A. degree in International Relations from the University of Southern California. He also attended the Program for Senior Executives in National Security at Harvard University and until recently was a PhD Candidate at Georgetown University.

A new way to protect computer networks from Internet worms

Ness B. Shroff Ohio Eminent Scholar in Networking and Communications Professor of ECE and CSE. E-mail: shroff@ece.osu.edu, or shroff@cse.ohio-state.edu . Office: Room 764 Dreese Laboratory. Phone/Fax: +1 614-247-6554 +1 614-292-7596. Mailing Address: Department of Electrical Engineering, 2015 Neil Avenue, Columbus, OH 43210, USA

COLUMBUS, Ohio -- Scientists may have found a new way to combat the most dangerous form of computer virus. The method automatically detects within minutes when an Internet worm has infected a computer network. Network administrators can then isolate infected machines and hold them in quarantine for repairs. Ness Shroff, Ohio Eminent Scholar in Networking and Communications at Ohio State University, and his colleagues describe their strategy in the current issue of IEEE Transactions on Dependable and Secure Computing.

They discovered how to contain the most virulent kind of worm: the kind that scans the Internet randomly, looking for vulnerable hosts to infect.

"These worms spread very quickly," Shroff said. "They flood the Net with junk traffic, and at their most benign, they overload computer networks and shut them down."

Code Red was a random scanning worm, and it caused $2.6 billion in lost productivity to businesses worldwide in 2001. Even worse, Shroff said, the worm blocked network traffic to important physical facilities such as subway stations and 911 call centers.

"Code Red infected more than 350,000 machines in less than 14 hours. We wanted to find a way to catch infections in their earliest stages, before they get that far," Shroff said.

The key, they found, is for software to monitor the number of scans that machines on a network send out. When a machine starts sending out too many scans -- a sign that it has been infected -- administrators should take it off line and check it for viruses.

The strategy sounds straightforward enough. A scan is just a search for Internet addresses -- what we do every time we use search engines such as Google. The difference is, a virus sends out many scans to many different destinations in a very short period of time, as it searches for machines to infect.

"The difficulty was figuring out how many scans were too many," Shroff said. "How many could you allow before an infection would spread wildly? You want to make sure the number is small to contain the infection. But if you make it too small, you'll interfere with normal network traffic."

"It turns out that you can allow quite a large number of scans, and you'll still catch the worm."

Shroff was working at Purdue University in 2006 when doctoral student Sarah Sellke suggested making a mathematical model of the early stages of worm growth. With Saurabh Bagchi, assistant professor of electrical and computer engineering at Purdue, they developed a model that calculated the probability that a virus would spread, depending on the maximum number of scans allowed before a machine was taken off line.

In simulations, they pitted their model against the Code Red worm, as well as the SQL Slammer worm of 2003. They simulated how far the virus would spread, depending on how many networks on the Internet were using the same containment strategy: quarantine any machine that sends out more than 10,000 scans.

They chose 10,000 because it is well above the number of scans that a typical computer network would send out in a month.

"An infected machine would reach this value very quickly, while a regular machine would not," Shroff explained. "A worm has to hit so many IP addresses so quickly in order to survive."

In the simulations pitted against the Code Red worm, they were able to prevent the spread of the infection to less than 150 hosts on the whole Internet, 95 percent of the time.

A variant of Code Red worm (Code Red II) scans the local network more efficiently, and finds vulnerable targets much faster. Their method was effective in containing such worms. In the simulations, they were able to trap the worm in its original network -- the one that would have started the outbreak -- 77 percent of the time.

Anywhere from 10 to 20 percent of the time, it spread to one other network, but no further. The remaining 3 to 13 percent of the time, it escaped to more networks, but the infection was slowed.

In all cases, there was a dramatic decrease in the spread of the worm within the first hour.

To use this strategy, network administrators would have to install software to monitor the number of scans on their networks, and would have to allow for some downtime among computers when they initiate a quarantine.

According to Shroff, that wouldn't be a problem for most organizations. Very small businesses -- ones with only a few servers -- may have more difficulty taking their machines off line.

"Unfortunately there is no complete foolproof solution," Shroff said. "You just keep trying to come up with techniques that limit a virus's ability to do harm."

He and his colleagues are working on adapting their strategy to stop targeted Internet worms -- ones that have been designed specifically to attack certain vulnerable IP addresses.

This work was supported by a grant from the National Science Foundation, and Sarah Sellke's NSF Graduate Fellowship. #

Contact: Ness Shroff, (614) 247-6554; Shroff.11@osu.edu Written by Pam Frost Gorder, (614) 292-9475; Gorder.1@osu.edu. WEB: Ohio State University