Defense Enterprise Cyber Range Environment Command and Control Information Systems (DECRE C2IS) International Test and Evaluation Association

Transcription

1 Defense Enterprise Cyber Range Environment Command and Control Information Systems (DECRE C2IS) International Test and Evaluation Association 7 March 2018

2 DECRE C2IS Road to ere Feb 2013 DOT&E asked JS J6 to lead efforts to integrate range capabilities to build an operationally realistic representation of a CCMD s networks, C2 systems & process to support testing, training & development of cyber capabilities. Over the past 4 years DECRE C2IS partners have conducted 28 two/three-week events in the closed environment of the cyber range : Focused on air & missile defense systems in NORAD-NORTCOM. Discovered C2 system vulnerabilities and implemented exercise cyber effects. 2015: Continued NORAD-NORTCOM focus expanded to include EUCOM. Incorporated AEGIS weapons system and Missile Defense C2 systems, and demonstrated real time data feed from CCMD exercise to the range. 2016: Supported USPACOM with a series of cyber training and mission rehearsal events in preparation for Exercise PACIFIC SENTRY 16-2 and In house V&V of ability to support GCCS-J test : Built a SECRET//REL FVEY environment to support USPACOM and Australian Defense Force training & mission rehearsal for TALISMAN SABER : Restored the SECRET//NOFORN environment to train USPACOM and USTRANSCOM CPTs and USPACAF Mission Defense Teams. 2

3 DECRE C2IS Partners CCMD CPT CWIC, Camp Smith, I TSMO untsville, AL NIOC Norfolk, VA 57 IAS Nellis AFB, NV Subject to Cyber Effects C5AD Suffolk, VA AOC MDT Osan AFB, ROK CPT Red Team Red Team Red Team C2 Systems/Data CPT 613 T AOC MDT ickam AFB, I JIOR Norfolk, VA NCRC JMN untsville, AL 46 TS Eglin AFB, FL USN CPT Yokosuka Naval Base, JP 3 MDT 462 SQN Adelaide, AUS DCOT CCMD CPT Scott AFB, IL CPT Data Transport DCSR Stafford, VA Network Infrastructure/ Services 673 T CS MDT Elmendorf, AFB, AL MDT RSDPs: untsville, AL Pax River, MD Network Infrastructure Traffic Gen/Services 747 T CS MDT ickam AFB, I MDT Data Transport NCR Orlando, FL Network Infrastructure/ Services DODIN CPT Ford Island, I Realistic cyber environment to support vulnerability assessments, cybersecurity testing and warfighter training CPT C2 Systems/Data CDSA-USS Secure Dam Neck, VA Navy Labs Ship C2 Systems MDA Schriever AFB, CO BMD Systems CPT AOC: Air Operations Center BMD: Ballistic Missile Defense C5AD: C5 Assessments Division CCMD: Combatant Command CDSA: Combat Direction Systems Activity CS: Communications Squadron CWIC: Cyber War Innovation Center DCOT: Defensive Cyber Operations Team DCSR: DoD Cyber Security Range DODIN: DoD Information Network IAS: Information Aggressor Squadron JIOR: Joint Information Operations Range JMETC: Joint Mission Environment Test Capability JMN: JMETC MILS Network MDA: Missile Defense Agency MDT: Mission Defense Team NCR: National Cyber Range NCRC: National Cyber Range Complex NIOC: Navy Information Operations Command RSDP: Regional Service Delivery Pt TS: Test Squadron

4 Concepts Underlying DECRE C2IS Cyber Range Create an operational environment in which Blue Force Players, C2 systems and networks, and Red Teams can interact in a realistic manner Integration of real C2 system & networks and virtual C2 systems & networks, NIPR & SIPR (Focused on JOC, MOC, AOC, JFLCC) Integration of recorded exercise data or real time data from exercises to drive C2 data play Integration of instrumentation to quantify system performance, survivability and mission impacts Integrate training of network operators and defenders, Enterprise Operations Centers (EOC), Cyber Security Service Providers (CSSP), and Cyber Mission Force operators and systems 4

5 DECRE C2IS Activities and Capabilities Activities DECRE C2IS Footprint Training Mission Rehearsal Capability Development Experimentation Testing 5 Persistent SECRET NOFORN Environment Persistent SECRET REL (FVEY) Environment JIOR and JMN interconnected, 220+ nodes Integrated Planning Team / White Cell Joint CCMD architecture Emulates Base/Post/Camp/Stations interconnected by DODIN NIPRNet and SIPRNet Current Capabilities Traffic emulation for NIPR/SIPR & C2 systems Cyber defenders install/configure own Cyber Defense Applications/Sensors/Rule Sets Network Operations Monitoring and Analysis with SOLARWINDS and RIVERBED Daily after-action Review Capability (Ground Truth for Testing and Training) Scenario & Traffic Playback J7 M&S Federation (3 recorded CCMD exercises in hand, 4 more by April 2018)

6 DECRE C2IS (Example) DISA IAP Internet (Site A) JFACC/AOC 6 (Site B) CCMD JOC (Site C) JFMCC/MOC (Site D) JFLCC (Site E) External Interface

7 7 Command & Control Systems and Supporting M&S

8 AOC Weapon System Critical C2 Systems (example) Mission Applications Army Battlefield Control System C2 Info Processing System C2 Personal Computer C2 Common Client Collection Mgmt Mission Applic n Combat Survivor Evader Locator DoD Intel Support System Generic Area Limit n Envrnmt Lite Global Cmd & Control System - I3 Global Cmd & Control System - J Global Decision Support System GPS Interference & Navigation Tool Imagery Product Library Info Warfare Planning Capability Interim Targeting Solution Joint Air & Ground Station Joint Auto Deep Ops Coord System Joint Targeting Toolkit Joint Weather Impact Server MAAP Tool Kit CSAR C2 Software Planning & Decision Aid Station Portable Flight Planning System Process g & Displ Subsys Migrat n Space Battle Mgmt Core System Target Application Workstation Theater Battle Mgmt Core System Weapons System Video AOC 10.1 Baseline Web-Based Tools Global Transportation Network INTELINK and INTELINK-S * Requirement Mgmt System Services Air Operations Net Core Services Defense Message System Geospatial Product Library Global Broadcast System-IP InfoWorkSpace NSA Threat Warning Network Predator Video Infrastructure AOC Comm Enhancement Pkg AF Tactical Receive Suite Boundary Security System *C2 Wpn Sys Part Task Trainer Core Infrastructure (e.g., routers, network apps) Cross Domain Solutions Deployable Transit-case System Jt Air Defense System Integrator Precision Lightweight GPS Rcvr AOC 10.1 Baseline 8

9 M&S Capabilities in DECRE C2IS Cyber Range Low Overhead Training System (LOTS) Joint Staff J7 GOTS software application designed to stimulate C2 Systems when simulation of forces is not needed LARIAT MIT-Lincoln Labs (MIT-LL): Emulates users performing real tasks, with real applications, , browsing, chat of from to a million physical hosts. Live feed USEUCOM / USAREUR EUCOM AC15 C2/M&S Track Feeds to DECRE Cross Domain Solution (Controlled Interface) Radiant Mercury BLUE GROUND LOTS WS BLUE AIR LOTS WS BLUE NAVAL LOTS WS C2 SYSTEMS JS J7 JLVC Federation DECRE C2IS Environment Suffolk, VA Joint Simulation Protocol Analyzer (JSPA) Logs all exercise simulation traffic LA / DIS / TENA Networks JRC JSPA LOTS 9 Record on SIPRNET and Play-back C2/M&S in DECRE C2IS (JIOR) JMEM JAWS JMECS C2 Networks (OT-Gold / TADIL / USMTF / FDL) VRSG Joint MSEL and Exercise Control Station (JMECS) C2 Stimulation and MSEL Management

10 DECRE C2IS Footprint for US/AUS Training and Mission Rehearsal Air Force Red Team 57 IAS Nellis AFB Red Team Sandia National Labs Albuquerque CONUS C4 Assessment Division Suffolk Test Resource Mgmt Center JMETC MILS Network Point Redstone Army Red Team Threat Systems Mgmt Office Redstone Cyber Security Range Stafford Joint IO Range Norfolk Navy Red Team Navy IO Command Norfolk Navy Combat Systems Direction Activity Dam Neck / Virginia Beach awaiian Islands USPACOM Cyber Protection Team Cyber War Innovation Center Camp Smith 4,400 miles 46 Test Squadron Eglin AFB Cyber Defense Flight 613 AOC ickam AFB 9,900 miles Range/Capability Provider Cyber Defender OPFOR Red Team 5,700 miles 9,800 miles Australia Objectives Support PACOM DCO training, Cyber C2 CONOPS & TTP development 462 Squadron RAF Edinburg Defence Network Operations Centre Canberra Build the US/AUS Environment on the range in preparation for TS17 Work through issues of integration, interoperability and survivability. 10

11 Red /Blue Team Observations July 2017 (PACOM TS17 Cyber FTX) On a scale of 1-10 with 10 being real, how representative of a CCMD network is the DECRE C2IS? 613 th AOC Mission Defense Team 7 (by design due to REL-FVEY) 501 CPT, AOC defense mission SQDN DCOT, Australian AOC cyber defense team CPT, PACOM JOC defense mission 8 46 th Test SQDN, AOC system provider 7 (by design due to REL-FVEY) TSMO, US Red Team 4 (need for more systems and traffic) (previous event was 8) This was a PACOM/Australia SECRET REL FVEY environment involving combined US/Australian Blue and Red Teams attacking and defending a JOC and AOC. Network traffic replicated real world well, making it challenging to pinpoint the Red Team (501CPT) 1 st time US and REL FVEY partner have jointly defended and attacked C2 systems 11

12 Near Term Focus: More: C2 systems, enclaves, system operators, MDTs, CPTs, and CSSPs Persistent unclassified and classified environments (NIPR, SIPR, REL FVEY) PKI, DEE, Dynamic Web Services, Dynamic SharePoint, LARIAT supplement Build cloud computing environment (Web services to host TRANSCOM) Support to C2 cyber testing and assessment Challenged by: (working with JMETC and TENA to address) Persistence Event management functions (OPFOR, Scenario, White Cell) (TENA) Automated threats Focus and Challenges Automated configuration tools for creation, restoration and re-use (TENA) Instrumentation to quantify Red and Blue team actions and effectiveness of tools and response actions (TENA) 12

13 As of 8 Feb 2018 DECRE C2IS FY 18 Schedule Sep 17 Oct 17 Nov Dec 17 Jan 18 Feb Mar Apr May Jun Jul Aug Sep 18 Oct 18 TC/UG/VS Oct 7 Nov USPACOM & USTRANSCOM Cyber Mission Rehearsal and Training PS/KE Jan-2 Feb PS Aug TC/UG/VS 19 TBD Oct Engineering Sep DECRE 18-1 Eng 6-9 Nov EX Nov DECRE Feb - 16 Mar DECRE Apr DECRE Jun DECRE Jul - 17 Aug DECRE 19-1 TBD DECRE 18-1 Objectives: Establish S//NF environment for FY 18 CCMD Support Deploy JIOR nodes for current / future operations NIPR & SIPR enclaves; NIPR Internet Access Point Define requirements for TENA support / integration Conduct Red & Blue Team environment assessment Exercise CPT defensive actions DECRE 18-2 Objectives: S//NF Support mission rehearsal /training for CCMD CPTs & PACAF MDTs Robust & refine traffic generation capabilities Improve OPFOR planning & threat presentation Exercise CPT & MDT defensive actions / TTPs Integrate TENA Event Management Capabilities DECRE 18-4 Objectives: TBD Establish US/ROK S//REL ROK Cyber Range ost Event environment in PACOM RSDP Enable US/ROK information sharing DECRE 18-3 Objectives: S//NF Support mission rehearsal /training for CCMD CPTs & PACAF MDTs Integrate 46 TS AOC enclave Exercise CPT & MDT defensive actions / TTPs Begin Integration of PKI Capabilities Integrate TENA Visualization/Event Mgmt capabilities Deploy 128T (MTU mitigation) capabilities DECRE 18-5 Objectives: S//NF Mission rehearsal support for CPTs & AOC MDTs in PACOM AOR S//NF Mission rehearsal for USTC CSSP & CPT Exercise CSSP, CPT and User defensive actions Improve USTC and JFCC enclaves Add additional mission systems Deploy Military Sealift CMD ship (USS Secure) Other Known / Expected Events BQ Oct-3 Nov C5AD MX 20 Nov-12 Jan RF Jan-9 Feb BQ 18-1 TBD CG / CF Jun Jun RF Jul DISA Defender Sep 13 - Marks olidays 2017 Labor 4 Sep Columbus 9 Oct Veteran s 10 Nov Thanksgiving 23 Nov Christmas 25 Dec 2018 New Year 1 Jan MLK 15 Jan Pres B-Day 19 Feb Memorial 28 May Independence 4 Jul Labor 3 Sep CSR MX 2-7 Jan CSR MX 3-8 Apr Black Demon 16 Apr-7 May CSR MX 3-8 Jul CSR MX 2-7 Oct

14 Points of Contact Gregory Curth Joint Staff J6, C5AD (757) Randy Coonts Joint Staff J6, C5AD (757) Roderick allum Joint Staff J6, C5AD (757)