2018 Army Signal Conference

Transcription

1 2018 Army Signal Conference March Springfield, VA This briefing is: Ronald Ronald W. W. Pontius Pontius Deputy to the Commanding General Deputy U.S. to Army the Cyber Command & Second Army Commanding

2 What is Cyber Manmade, global domain, integrated into all other domains Used and controlled by diverse private and public entities Domestic, Informational, Military & Economic considerations 3 distinct but interrelated layers contribute to complexity Public, Commercial, and Adversarial network components Cyber- Persona Individual Cyber Identity Full Spectrum Cyberspace Operations DoD Information Network (DoDIN) Ops Provide effective C4IM services support Facilitate aggressive network defense Network Convergence and Modernization Defensive Cyberspace Ops (DCO) Identify and protect Mission Relevant Cyber Terrain Clear and Harden Efforts (Analysis and Response pre-incident) Logical Physical Information Physical Network Geographic Component Offensive Cyberspace Ops (OCO) Transition current efforts to more global lines Support selected Combatant Commands

3 Command Overview Cyber Overview Global Presence, 24x7 19,000+ Personnel Directs and Conducts Integrated: Cyberspace Operations (DoDIN Ops, DCO and OCO) Information Operations Electronic Warfare

4 Where we are today The Army Cyber Enterprise DAMO-CY Army Cyber Institute Cyber Center of Excellence Army Cyber Command Operations: Provide C4IM services and defend against our adversaries 24/7 DODIN Ops, Defensive Ops, Offensive Ops, Information Operations, and Electronic Warfare Training: Cyber Center of Excellence is training all cohorts Officer, Enlisted, Warrant, Civilians Active, Guard, Reserve Research: Army Cyber Institute is national resource for interdisciplinary research, advice and education in cyber domain

5 DODIN Readiness Improved readiness and resiliency through an overarching security architecture and a standardized / modernized network Converging and Standardizing improves delivery of C4IM capabilities and reduces our attack surface Moving to WIN10 improves security and readiness of the network NETMOD improves the effectiveness and resilience of the DODIN Improve our ability to see our selves (situational understanding) Endpoint Management and Endpoint Security Cyber Analytics and Cyber Awareness Dashboard How it s measured Cyber Security Scorecard Command Cyber Readiness Inspections Quality and cost of C4IM Capabilities to Army and Joint organizations

6 CEMA Support to Corps and Below (CSCB) 3/25 IBCT (JRTC) MAY 2015 Objective: Integrate DODIN OPs and OCO Conducted OCO ISO maneuver operations 75 th Ranger Reg JUN 2015 Objective: Educate the RSTB in OCO COTS effects with infrax deployed to enable wireless reconnaissance NIE 16.1 SEP/OCT 2015 Objective: Integration of DCO reach support Executed reach support utilizing NIKSUN IDS 1/82 BCT (JRTC) NOV 2015 Objective: Support 1/82 with DCO BCT s organic MTOE defenders have increased ability to secure network 2-2 SBCT (NTC) JAN 2016 Objective: Enable 2-2 to integrate cyber effects at NTC -OCO & C-ISR ISO ULO -Disrupted adversary C2 and social media 1/1 ABCT (NTC) AUG 2016 Objective: Provide 1/1 with full spectrum ECT (CO/IO/EW) -Effective SOF integration -OSINT support to cyber exploited TRIP and WCCO involvement continues to evolve through each rotation 2/1 ABCT (NTC) MAY 2017 Objective: -Full spectrum ECT -Enable Reach -Mass effects at decisive point -Conducted OCO & C- ISR ISO ULO -Disrupted adversary C2 and social media Over the past 2+ years the CSCB Pilot has developed an innovative concept for the structure and opportunities to employ Cyberspace Electromagnetic Activities (CEMA) effects at the tactical level. 1/4 SBCT (NTC) JUN 2017 Objective: -ECT(-) / Reach ISO R&S rotation -Defend network -ID enemy C2 -Successfully executed remote OCO/DCO -Successfully integrated TRIP At its core, CSCB sought to answer the following questions: 1) Is CEMA relevant to a tactical commander s operations? 2) If yes, then how does it integrate into tactical operations? 3) What structure best supports tactical CEMA?

7 Cyber Mission Force (CMF) Readiness All of the Army s 41 Active Component CMF Teams are FOC and on mission today Continuing to build capacity in USAR and ARNG Status: 41 teams on mission conducting OCO and DCO in support of Army and Joint Force Commanders USAR and ARNG are building CPT capacity. Planned FOC is 2023 ARNG 11 CPTs USAR 10 CPTs Readiness Components Facility: New Ops and HQ facility at Gordon on track of 2020 occupation Platform: Fielding new operational platform to both CCOE and CMF Development: Ability to do capability development is up and running improving our responsive ness to Combatant Commander need How it s CMF measured National Mission Force (7) National Mission Team (NMT) 64 PAX National Support Team (NST) 39 PAX Combat Mission Force (14) Combat Mission Team (CMT) 64 PAX Combat Support Team (CST) 39 PAX Cyber Protection Team (CPT) (20) CPT 39 PAX

8 Talent Management Support ARCYBER s and NETCOM s mission through improvement of access to critical talent and expedited hiring of civilians Coordinated and developed with NETCOM the Consolidated Hiring Cell supporting all NETCOM Civilian Hiring actions Reviewed and updated regulations: Recruitment, Relocation, and Retention Incentives; Foreign Overseas Tour Extension and Statutory Return Rights; Position Classification; and Civilian Hiring Process Contracting with two civilian headhunter companies to attract new talent - - a groundbreaking approach for Government that leverages industry s best practices Momentum 1 Feb 2018: 32 Direct Hires, 16 Merit Announcements, 22 Referral Lists, and 18 Job Offers Reduced NETCOM personnel effected by the 5 year rule placed 37 personnel against CONUS NETCOM positions

9 Leveraging Partnerships We are leveraging partner capabilities to deliver solution we couldn t have on our own! Defense Digital Service Bug Bounty Program Cyber School Training Pilot Tiger Teams DIUX Endpoint Threat Detection Analytics Machine Learning Cyber Acquisition Task Force TRADOC Capability Manager (TCM) Cyber PEO EIS, C3T, IEW&S and STRI

10 Defensive Cyber Operations (DCO) Requirements Strategy DCO Maneuver Baseline Supporting Documents ONSs Big data 15 Jan 14 DCO-I 31Jan 14 Web Scanning 15 Jan 14 CPT Support 15 Aug 14 ICDs GIG IA ICD 06 Mar 06 Net-Enabled MC ICD 27 Dec 11 MS A Document DCO IS ICD Actively predict and hunt Outmaneuver adversaries Achieve survivability & security enhancement Conduct site exploitation and forensic analysis Conduct DCO mission planning and protection Conduct mission assurance actions to dynamically reestablish, re-secure, re-route, reconstitute, or isolate MS B/C Documents Requirements Definition Packages/Capability Drops 1. Cyber Analytics 2. Garrison DCO Platform 3. Deployable DCO System 4. DCO Tool Suite 5. Tactical DCO Infrastructure 6. DCO Mission Planning 7. User Activity Monitoring (Insider Threat) 8. Forensics/Malware 9. Advanced Sensors 10. Threat Discovery/ Counter- Infiltration 11. Threat Emulation JIE ICD 17 Jul 14 LWN ICD 30 Jul 14 Evaluate the defensive posture thru vulnerability assessments & threat emulation Using rapid development process to deliver capabilities faster. 10

11 //FOUO Defensive Cyber Operations (DCO) Evolutionary Capability Delivery Model DEVELOP, ASSESS, DEPLOY, LEARN, ITERATE DCO Capability Delivery Model: Requirements: Broad RDPs, CDs informed by operations and accounts for technology and adversary changes RDPs approved by ARB CDs approved by ARCYBER CG/CCOE CG in collaboration with ASA(ALT) Acquisition: Tailorable, incremental model Evolve existing operational prototypes Rapid capability delivery Spiral development, quick turns Testing: Series of incremental, discrete evaluations of Capabilities and any associated risk Underpinned by CFT construct with DevOps : tight coupling between Ops, Development, and Testing Capability delivery must keep pace with changing technology & evolving cyber adversaries, TTPs //FOUO 11

12 Defensive Cyber Operations (DCO) Outmaneuvering and Engaging the Adversary Mutually supporting capabilities operating on an integrated, standardized Infrastructure 12

13 Way Ahead Our processes need to be able to move at the speed of cyber Acquisition Limited Acquisition Authority Other Transaction Authority Future Transformational Technology Artificial Intelligence / Machine Leaning Supply Chain Risk Management

14 Conclusion Continual Efforts to improve DODIN Readiness and Resiliency Convergence, WIN10, NetMod The Active Army s Contribution to the Cyber Mission Force is Full Operational Capability (FOC) 41 teams on mission Helping to Build Capacity in USAR and ARNG 21 more teams FOC by 2023 Talent Management Efforts Are Paying Off