Hovering somewhere overhead, a tiny robot points its camera at the van and takes note of its color scheme and markings. An even bigger drone, thousands of feet above its hovering kin, maintains a God’s-eye vigil on the whole hunt.

Everything these robots see is radioed to monitors thousands of miles away -- and into the targeting systems of a B-52 bomber winging, silent and nearly invisible, several miles overhead.

This scenario, played out at a remote Nevada facility last week, was the first major test of the Army’s $160-billion, 20-year plan to build a high-tech family of networked robots and hybrid-electric armored vehicles. The “Future Combat Systems” program, co-managed by Boeing and consultants SAIC, aims to equip roughly a third of the Army with 14 new vehicle types that are connected constantly to a vast communications net.

The theory behind the FCS is that dispersed, intelligent robotic systems plugged into a universal communications network can help small numbers of U.S. troops riding in new vehicles to control huge swaths of terrain. Any ship, airplane or tank fitted with the FCS network devices will be able to see everything the others see.

The SkyNet-like network and dynamic coordination “is the most important thing,” Brigadier General James Terry says.

This is “a big deal for joint fires,” Army spokesman Paul Mehney told Wired.com.

“Joint fires” is mil-speak for getting all the military services to share info and coordinate their attacks. That kind of teamwork is a big factor in the U.S. military’s combat prowess. And if FCS works out as planned, the five U.S. military branches will team up better than ever.

Did the test work? Kinda.

The robots spotted the van; their targeting data bounced to a nearby unit of specially-equipped Humvees, then across the network to an Air Force intelligence cell in Langley, Virginia, then back to the B-52 -- all in just seconds. The bomber simulated dropping a guided bomb to “destroy” the van.

The Nevada test proved it was possible, according to Mehney.

But one critic says the test essentially was rigged -- that the conditions were too easy.

“There is ‘works’ and then there is ‘works,’” John Pike, an analyst with Globalsecurity,org, told Wired.com.

“A considerable fraction of the FCS network hardware does not currently exist,” Pike said. And the integration of that hardware that does exist has been touch-and-go.

In February, when testers “flipped the switch” for the first time on the network radios, there was a collective sigh of relief that the radios even worked -- this according to one FCS insider who spoke on background.

Last week’s desert test comes at a critical time for Future Combat Systems. Mounting criticism from the GAO plus the growing cost of fixing and upgrading the Army’s current war-weary vehicle fleet -- $120 billion over 10 years, according to the GAO -– has put the squeeze on the futuristic program. “It is not yet clear if or when the Army and [its contractors] can develop, build, and demonstrate the … network,” the Government Accountability Office reported in March.

One powerful congressman, nominally a supporter of FCS, has proposed injecting extra money into the program in order to rescue some of its technologies before canceling the rest.

Rep. John Murtha (D-PA), chair of the defense appropriations subcommittee, promised an extra $20 billion this year for FCS, provided the Army could use the money to wrap up the program quickly. “We need to accelerate FCS if we ever want to see anything accomplished,” Matt Mazonkey, a Murtha staffer, told Wired.com.

The Army is still preparing its response to Murtha’s query, Mehney said. Regardless, the service’s position on FCS has never wavered. The Army says that FCS is on-budget, on-schedule, and with continued funding will deliver on its promises to connect the ground service to itself and to all the other military branches.

And to ensure smooth progress despite a combined $900 million budget cut last year, the Army this month asked Congress to “re-appropriate” $250 million of other Army funds into FCS coffers.

Over those months, I’ve had several things that I *wanted* to blog about; but just never made the time.  One of the reasons is that, for the most part, there has been little to be truly excited about in the industry as a whole.  “Nothing new under the sun;” and all of that…  At least that’s what it seemed like to me.  But now things are starting to settle down and I’m having/making time again to get plugged back in.

So today I was reading Martin’s show notes and came across the SalesForce.com data breach story.  And, behold, I felt the urge to write again.  As I’ve been reading the news over the past few months, I have been thinking to myself that we have a problem…  Breach notifications are being reported so often now that they seem to be just creating a constant “white noise” drone.  Sure, there are the standouts like TJX — but really, most are just more of the same.  To the extent that I fear the public will just end up being numb to the notifications, and ambivalent to the poor practices that are the cause.  Each new notification just being another drop in the ever-deepening ocean of lost records.

But the SalseForce.com story is different due to the “spear-phishing” aspect.  And it highlights multiple security problems.  Two in particular are of note.  1:)  Users are still susceptible to phishing.  Yeah, I realize that this was a highly-targeted “spear-phish” — but the “don’t click the link” (or at least verify the link) adage should still hold; and 2:)  data breaches, even those which do not contain what we would consider PII, are dangerous.  Here, the data is reportedly being used to create additional phishing emails (some intended to drop malware such as keystroke loggers, etc…), bogus invoices, and so on.  In other words, the SalesForce.com breach wholly revolves around social engineering.

I think that it is notable that these issues revolve around end-users and, outside of any emails intended to dropped malware, cannot be addressed solely through technical means.  So, we again come back to end-user training and awareness.  It is imperative that we, as an industry, get a handle on how to better address this in our organizations.  It’s clear that what most companies are doing is just plain broken.

Here are my thoughts:

Engage employees in ways that are relevant to their life as a whole.  Address the “What’s in it for me?” question.

Explain the “WHY” behind seemingly obscure security policies or procedures.  As is made clear by the SalesForce.com incident, we can’t simply expect technology or process to address all potential security issues.  Instead, we need our front line defenses to act as living firewalls.  Thinking on their feet and able to apply an informed mindset across multiple situations.

Let employees know that it is part of their job – just as much as any other duty that they do.  (Yeah – I realize that mentality must be driven from the top down).  Make it part of the performance evaluation; so that they are aware that the will professionally advance or stagnate based on how seriously they take their duty to protect information.

Make it fun.  Find ways to reward the folks who are doing it right.  Let that encourage others to improve.