Cyber forces prepare for an attack on a grand scale

Practice might not always make perfect, but it certainly can help when preparing to defend the nation against a disaster—or a coordinated cyberattack. Over 100 organizations from government and the private sector recently participated in a training exercise focusing on the latter, which involved simulating rolling blackouts in the Northeast, attacks on Gulf oil and gas facilities that caused an oil spill, and attacks on three ports across the California coast bringing vessels and container ships carrying consumer goods to a standstill.

The annual Cyber Guard exercise – co-hosted by The U.S. Cyber Command, the Homeland Security Department and the FBI, along with additional participants including Northern Command, 13 different National Guard units from 11 different states, the Federal Aviation Administration, international partners such as the UK, Canada and Australia, industry partners, Internet service providers, power and electric companies as well as port authorities – aims to test whole of nation defense during a national crisis. Cyber Guard 16 focused on three goals: how can the Defense Department better defend its networks, how well can DOD and the government writ-large prevent destructive attacks of a significant nature against critical infrastructure, and how does DOD support to civil authorities in times of attack.

In addition to gaming the way DOD can lend its cyber resources to civilian agencies – which serve as the lead in domestic crises – and industry in an emergency, the exercise also served as another step toward building up a cyber force that by 2018 will number 133 teams. “We put [participants] under pressure to perform up to the point of failure because that’s where learning is going to occur.  That’s important because we must press ourselves to failure and learn in this environment where in the real world in this scenario we cannot fail,” Rear Adm. Kevin Lunday, cyber command director of Exercises and Training, told reporters attending the exercise as part of a media day. “What we’re after here in the Department of Defense is operational readiness of the cyber mission force...What we’re after in the broader sense is resilience across the whole of nation for this kind of a scenario.” 

Cyber Guard 16, hosted at a Joint Staff facility in Suffolk, Va., was used as one metric toward certifying the cyber protection teams that participated in the exercise. Once the full cyber force is filled out, there will be a total of 68 cyber protection teams among the 133 teams overall that will focus on defending DOD networks. According to one CPT member participating, a full CPT consists of a mix of military and civilian personnel totaling 39 individuals that are divided into various roles or tasks depending on each person’s technical competency. One of the challenges Cyber Command has faced since its inception in 2009 is being thrown into the fight while it is building out its force. The command is still not yet operating at initial operating capacity – which will be achieved in September of 2016 – yet it has been operational since its creation. Despite these facts, its commander, Adm. Michael Rogers, has described this year as a tipping point in terms of generating capacity and capability.

During the exercise, CPTs were responding to a U.S.-based military aerospace control center that was directly under attack. According to one participant, the fictitious adversary, he believed, was interested in data exfilitration of software that could provide real-time situational awareness of air assets.

In the center’s exercise control room, planners can dial adversarial capability up if the participants are finding the exercise too easy, or dial it back if participates find it too difficult. Teams have a certain set of objectives that have to be met and those in the exercise control room ensure that the opposing force enables these teams to meet these goals.  

For officials, however, one of the key challenges that remain following the exercise’s conclusion on June 18, is that the event is only once a year. “I need teams that can do this rapidly more than once a year, that can pull on partners, that have a distributed network, that have assessors, that have an adversary that is adaptable and is expandable to what we need to improve our readiness,” Maj. Gen. Paul Nakasone, Cyber Command Cyber National Mission Force commander, told reporters.  “That’s the next step for us in cyber mission forces.” 

Officials talked about the need for a persistent training environment going forward. “We’re really building a cyber training highway here,” Maj. Gen. John Charlton, vice director for Joint Force Development, said of the Joint Staff facility, which provided a private network for exercise participates to play on as to not compromise operational networks. All told, the exercise took up 48,000 square feet of reconfigurable space, over 1,150 workstations and planning and engineering that took between 10 and 12 months.  

 Cyber Guard 16 was the fifth annual exercise of its kind. Nakasone offered three major changes from the last four Cyber Guard exercises to Cyber Guard 16. First, the exercise is a good indicator of force progress. “Four years ago we came here with soldiers, sailors, airmen, and Marines that were really focused on individual skills. The concept of team was developed, perhaps, here as they came together. Now, four years later we come with teams that are trained, ready to be certified, ready to be tested at a higher level,” he said. 

Second, this year saw a significant uptick in scope and scale, given that Cyber Guard 16 involved thousands of individuals – with others participating at other remote locations as well – and the improved ability to simulated adversarial threats. Third, Nakasone said, DOD has forged solid partnerships through four years of performing these exercises, not just among other federal agencies, but also with private industry. 

With a significant portion of critical U.S. infrastructure owned by the private sector, officials stressed the need to build partnerships and trust with industry in the case of an emergency. This exercise helps build that trust, one participant said. 

Given that DHS plays the leading role in domestic incidents, DOD’s role can serve mere capacity.  Sometimes, solving a problem is just a matter of capacity or manpower, one participant said. Many small organizations, such as FireEye – or even DHS – while extremely capable, just don’t have enough resources or people to respond to an incident, so they call DOD.     

Despite criticisms from other government watchdogs, DOD has maintained that it knows how to respond to domestic incidents through its civil support authority. However, some have conceded that adding the cyber element is tricky. “[W]e were actually putting meat on the bones – so what is the framework in a national incident,” Lt. Gen. James “Kevin” McLaughlin, deputy commander of the U.S. Cyber Command, said at an April event. “We know how to do that as a department in [support of the] civil authorities framework. What’s being added to that is the cyber element…We have an exercise called Cyber Guard that we have done for multiple years in a row … and we run that as a command but it really is a broad interagency exercise that’s usually the non-DOD scenario.” Prior to Cyber Guard 16, officials from across the government participated in a policy discussion on the legal authorities and issues surrounding response coordination. 

Following Cyber Guard 16, which took place from June 9-18, DOD will transition into a separate exercise at the same location called Cyber Flag that will conclude at the end of June. Cyber Flag encompasses full spectrum military operations in simulated scenarios integrating cyber capabilities with traditional military capabilities across all domains – air, land, sea and space. Of DOD’s three missions in cyberspace – operate and defend DOD networks, be prepared to defend U.S. critical infrastructure and support joint force commander objectives – Cyber Flag focuses on DOD’s first and third mission sets, Lunday said. Cyber Guard, on the other hand, focuses on DOD’s fist two cyberspace missions.    

“We understand that cyber operations will never take place in a vacuum. So everything in that domain has a connection or an impact on physical space: air, land, sea, and space,” Lunday continued. “So the ability to operate in an integrated and synchronized way from U.S. Cyber Command’s point of view in support of a geographic or functional combatant commander or their joint force commander that’s conducting military operations, that’s critically important.”