Cyberspace and the EMS: From Awareness to Understanding AFCEA TechnetAir 23 March, 2015

Transcription

1 Cyberspace and the EMS: From Awareness to Understanding AFCEA TechnetAir 23 March, 2015 Mr. Malcolm Martin US Army Cyber Center of Excellence Chief, Cyber Support Element-Ft. Leavenworth, KS. 1

2 Purpose Provide discussion of Cyberspace Situational Understanding (Cyber SU): what it is, who uses it, and how commanders apply Cyber Situational understanding, today and in the future. What has changed? Conflicts and Impacts of Cyberspace and Electronic Warfare. Constant threat and Actors, convergence Situational Awareness to Situational Understanding Cyber SU Concept and Operational framework Cyber SU Impact as holistic aspect of ULO Army Cyber Situational Awareness Applied Culture change 2

3 Georgia-Russia 2008 August 2008 Russian troops cross into South Ossetia w/ stated intent to defend their Russian compatriots. Combined Arms assault was pre-empted by (enabled) by a multi-faceted cyber attack against Georgian gov t and military infrastructure and defacement of web sites Distributed denial of service (DDoS) attacks combined with EW jamming disrupted and denied comms simultaneous to an integrated propaganda (MISO and MILDEC) campaign Overall operation should be considered the first large scale hybrid combined arms operation (air, land, cyber).

4 Ukraine-Russia 2014 The Russian occupation of Ukraine in 2014 was carried out with a military show of force informed and supported by a coordinated cyberspying campaign. The situation in Ukraine has seen relations between Russia and the West deteriorate to almost Cold War levels Russia s battle with Ukraine is being fought partly in cyberspace where it may have greater room for escalation because nations increasingly accept covert cyber attack as a valid form of international pressure when more traditional options are too violent or too visible. The current cyber battle also could spread if the overall strategic confrontation deepens, say toward a second Cold War. Such a stand-off, pitting Russia against the United States, NATO, and Ukraine The rule of thumb for seeing disruptive cyber attacks before they happen is that physical conflicts beget cyber conflicts.

5 Cyberspace Threats - Users/decision-makers - Their devices and associated IP addresses - Data, databases, and websites - Network infrastructure - Physical locations Cyber Adversary Tactics, Techniques, and Procedures Planning / Scanning Hostile Actor Exploitation Lateral Movement Adversary Intent / Exfiltration Web Server/ Webpages Reconnaissance Espionage Destructive Malware Users Target System

6 Operational Convergence Near Peer Competitor Cyber and EW Capabilities EMS Irregular Operations Conventional Forces & Capability Cyber Proxies Terrorist/ Criminal Strategic Capability -Advanced EW -Integrated C4ISR and Fires -High Tech: Jam UAS, disrupt comms, exploit, influence and attack Regional Hegemony/Hybrid Technology Transfer Non-state Ideologies Failed States Nation States, Non-state actors or proxies with a full range of capabilities Strategy to preclude U.S. from executing preferred way of war Designed to impact U.S. actions, from National to Tactical 6

7 Cyber Situational Awareness JP 3-12 Cyberspace Operations Cyberspace SA is the requisite current and predictive knowledge of cyberspace and the OE upon which CO depend, including all factors affecting friendly and adversary cyberspace forces. DODIN operations activities are the foundation of cyberspace SA, therefore, DODIN operations are fundamental to the commander s SA of the OE. Accurate and comprehensive SA is critical for rapid decision making in a constantly changing OE and engaging an elusive adaptive adversary. SA of friendly cyberspace is provided today by the Services and agencies operating their portions of the DODIN, DISA, through the theater NETOPS centers, to the CCMD theater/global NETOPS control centers, USCYBERCOM Joint Operations Center, Joint Functional Component Command for Space s Joint Space Operations Center, and their Service/agency leadership. They coordinate with each other as required to ensure operational effectiveness.

8 Cyber SA Functional Elements (U) TRADOC Pamphlet (TP) , The Army Capstone Concept (ACC), asserts that future Army requires the capability to provide leaders and Soldiers that understand how and when adversaries employ CO and cyberspace capabilities, how to mitigate adversary actions, and how to respond to gain and maintain the cyberspace advantage within the OE in support of ULO 8

9 Awareness vs. Understanding Army ADRP 5-0 Operations Process defines situational understanding as The product of applying analysis and judgment to relevant information to determine the relationships among the operational and mission variables to facilitate decisionmaking. Situational awareness (shared or otherwise) is not the same thing as understanding (which, unlike awareness, requires some useful grasp of the information at hand). One might argue further that understanding is different from and inferior to insight or wisdom, and that either of these should be a recognized goal on the path toward self-synchronization (which does not automatically result, even from shared situational insight or wisdom). A shared warfighting culture is therefore the ultimate key to shared situational understanding in the battlespace. It is on this then that we must focus. Richard Stuart Maltz, Military Review 2010

10 Cyber SU Definitions FM 3-38 Cyber Electromagnetic Activities (CEMA) Activities leveraged to seize, retain, and exploit an advantage over adversaries and enemies in both cyberspace and the electromagnetic spectrum, while simultaneously denying and degrading adversary and enemy use of the same and protecting the mission command system. (ADRP 3-0) To gain understanding, commanders and staffs process data to develop meaning. At the lowest level, processing transforms data into information. Analysis then refines information into knowledge. Commanders and staffs then apply judgment to transform knowledge into situational understanding. CEMA provides the means for communication and synchronization that facilitates a commander s situational understanding of the cyber and EMS operational environment.

11 CEMA Operational Framework Electronic Electronic Protect Protect EW EW CF17 Phase 2 CF17 Phase 2 Electronic Electronic Attack Attack Cybersecurity EW EW CYBER CYBER Signal Signal SIGNAL DoDIN Operations Network Focused Threat Agnostic INTEL INTEL 6

12 Cross-Functional Warfighting Functions Cyber Situational Understanding CDR s Intent S3 CEMA Working Group Coordination Integration Synchronization Cyber-SU

13 Army Cyber SU CONOPS Cyber SU Operational View - 1 * * What must the Army do at the tactical level (corps and below) to employ cyberspace and EW capabilities as part of a combined arms strategy that enables commanders to gain and maintain advantages simultaneously in the increasingly contested cyberspace domain and the land domain? * * The Army at Corps through BDE and below echelons lacks the ability to aggregate, analyze, and synthesize cyberspace * The COP operations is defined by the highest information, and then integrate a visual tactical echelon. Each unit displays user defined information their representation of that information into the COP. operational picture. 13 Red, Blue, and Grey aspects, as well as how we are seen by them!

14 Cyber SU CONOPS Working Model Industry JIM Commercial xxx C/JFLCC Cyber Analytics (Big Data) Big Data Network View JFHQ-C CEM xx CEM x CEM Corps, Division and BCT Commanders & Staffs Home Station and Deployed Cyber Mission Forces DODIN, DCO and OCO CONUS and Expeditionary Command Post Computing Environment e.g. GoogleEarth-like Contextualizes three interrelated Awareness outputs: Threat, Network, and Mission; And the ability to plan operations! JIE, COE, LWN e.g.big Data Analytics/ Dagger-like What is needed to achieve Cyber SA; how will Cyber SA be integrated into the COP; 14 and how will Commanders develop and use Cyber SU to plan, prepare, execute, and

15 Cyber SU IS ICD Strategy Cyber CBA 15 Dec 13 Joint EW ICD 1 Oct 09 Net-Enabled MC ICD 27 Dec 11 Joint Attack ICD 02 May 12 Document CBA ICDs Joint Cyber SA ICD 23 Apr 12 LWN ICD 30 Jul 14 Cyber SU IS ICD DRAFT Overall Requirement Display all relevant cyberspace operations information to include data from other specified cyberspace elements Provide a common suite of tools enabling collaboration within the tactical community, includes sharing of ideas and situational understanding between levels of command Enable commanders to integrate and synchronize cyberspace operations, spectrum management operations (SMO), and intelligence operations to accomplish their missions DCGS-A 20 May 13 JIE ICD 14 Jul 14 Big data 15 Jan 14 ONSs CC-0427 CC Nov Dec , AUG 14 8 NOV , JAN 14, 12 NOV 13 Provide method that will deconflict, integrate, synchronize, and direct community awareness of cyber intelligence requirements Commanders need visualization of the adversary s internet and capability along with an ability to understand CO impact on their missions 7 of 13 JUONs/ONSs reviewed have specific implications and are 15 linked to the Cyber SA requirements

16 Cyber and EW Corps & Below CONOPS Corps, Division, BCT Commanders and Staffs xxx CEM xx CEM x Cyber/EW UA CEM - Planning - Tiered capabilities* - Assign AO and control measures; close area deep area framework Tactical Cyber and EW assets exploit, attack and influence* BCTs conduct EW and cyberspace ISR in the close fight while the corps conducts the full range of CO and EW activities in the deep fight Notional but in development from Cyber CBA * Assumption: Cyber SU capabilities fielded and CO authority granted

17 Unified Land/Cyber Ops & Planning Cyber SA Dashboard Look Red, Blue Grey and CEMA Running Estimate Mission Analysis, COA Development Wargaming Interactive with Mission Command and Intelligence systems Cyber SU utilizes standard geospatial reference map displays resident in future command post computing environment. Overlay creation tools available and provide export/sharing of displayed data directly to the Common Operational Picture (COP).

18 Change the Culture DCO EW OCO MC, FIRES, Maneuver, MED, MCO, EW, INTEL Enterprise Cybersecurity JWICS NSA NET DODIN Enabling Platform WFX Rifleman Radio The Network: The DODIN is the base for Mission Command, enables all Warfighting Functions, and is foundational to Cyberspace Operations, underpinning OCO & DCO functions The Signal Corps will remain irreplaceable in DODIN Operations, and will assume responsibility for the TS/SCI network Signal-Intel-EW-Cyber Collaboration: Both internal and external collaboration is required to achieve synergy of effort Signal and Intel are becoming increasingly dependent upon each other Combined Arms Cyber Teams: Cyberspace Operations is inherently Joint, Interagency, Intergovernmental, Multinational Signal, EW, and Intel capabilities must be integrated with all stakeholders to be successful 18

19 TRANSPORT DATA ORGANIZATION CYBER TRANSFORMATION Drive Convergence CURRENT (LACK OF CYBER SITUATIONAL AWARENESS) INTERIM (MOVE TOWARD COMMON OPERATING ENVIRONMENT) OBJECTIVE (INTEGRATED INFORMATION ENVIRONMENT) COORDINATION The harmonious functioning of staffs, networks and systems for effective results. COLLABORATION To work jointly with staffs, networks, and systems to achieve effective results. CONVERGENCE The effective merging or integration of distinct staffs, networks and systems, into a unified whole to achieve decisive results. COMMAND POST OF THE FUTURE COMMON OPERATING ENVIRONMENT USER DEFINED OPERATIONAL PICTURE TOC TOC TOC PROCESS & RESOURCE SHARING IO S6 FIRES S2 EW IO S6 FIRES S2 CYBER EW NIPR AFATDS AMDWS BET CPOF GCCS-A SIPR DCGS-A BCS-3 TAIS DTSS IMETS SIPR NIPR DATA NIPR TS/SCI SIPR NIPR JW ICS NIPR SIPR UNIFIED CLOUD DATA INFORMATION SIPR NIPR NIPR TS/SCI UNIFIED CLOUD DATA JW ICS NSANeT KNOWLEDGE UNIFIED DATA CENTER NIPR SIPR TS/SCI UNIFIED CLOUD DATA SIPR NIPR JW ICS NSANeT WMA COMMAND POST I TOC DODIN ENABLED BMA Business Mission Area DIMA DoD portion of the Intelligence Mission Area DODIN Department of Defense Information Network EIEMA Enterprise Information Environment Mission Area JW ICS Joint Worldwide Intelligence Communication System NIPR Non-secure Internet Protocol (IP) Router Network NSANeT National Security Agency Network SIPR Secret Internet Protocol Router Network W MA Warfighting Mission Area TOC Tactical Operations Center TS/SCI Top Secret/Sensitive Compartmented Information SECRET SCIF TOP SECRET 19

20 Questions? Mr. Malcolm W. Mack Martin US Army Cyber Center of Excellence Cyber Support Element Fort Leavenworth, KS. Office: (913) Mobile: (913)

21 Cyberspace Domain CYBERSPACE: Cyberspace is a global domain within the information environment consisting of the interdependent network of information technology infrastructures and resident data, including the Internet, telecommunications networks, computer systems, and embedded processors and controllers (JP 1-02). Characteristics: Manmade domain ever changing Physical, functional, cognitive, logical/virtual and social Programming code and protocols define rules of the domain Environment and TTPs evolve at speed of code Constant presence Phase 0 on-going Unlimited, instantaneous (operational) reach Success in this domain means being smarter, more creative, faster, and stealthier than your opponent

22 Required Capabilities Gap 17: Commander s SU (includes social/media layer) RC (CSa01) Overall Commander s SU RC (CSa02) Adversary awareness, understanding, impacts RC (CSa03) Awareness of own networks, impacts RC (CSa05) Legal considerations, intelligence gain & loss, risk RC (CSa07) Awareness, understanding of social layer of network RC (CSa08) Awareness across cyberspace and EMS enable integration RC (CSa09) Awareness of OCO effects on adversary (BDA) Cyber SU was Cyber CBA #1 Gap; Army SU Required Capabilities (RC) are directly linked to the Joint Cyber SA ICD RCs; Legend SA: Situational Awareness EMS: Electromagnetic Spectrum OCO: Offensive Cyberspace Operations BDA: Battle Damage Assessment 22

23 Unified Land Operations ADRP 5-0: The operations process, while simple in concept is dynamic in execution. Commanders must organize and train their staffs and subordinates as an integrated team to simultaneously plan, prepare, execute, and assess operations. In addition to the following principles of mission command, commanders and staff consider following principles for the effective use of the operations process: Commanders drive the operations process. Build and maintain situational understanding. Apply critical and creative thinking. Encourage collaboration and dialogue. COMMANDERS DRIVE THE OPERATIONS PROCESS Understanding is fundamental to the commander s ability to establish a situation s context. It is essential to effective decisionmakingduring planning and execution.