6 - Intro to CWO Flashcards

1
Q

National Security Strategy (NSS)
– General Info

A
  • Legal foundation in Goldwater-Nichols Act of 1986
  • Highest level of strategic planning
  • Implementation relies on guidance derived from contents, such as NDS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

National Defense Strategy (NDS)
– General Info

A
  • Dev’d by DoD, signed by SecDef
  • Establishes set of overarching defense objectives/framework for achieving security
  • Provides direction for NMS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

NDS
– Main Goals (2)
– Lines of Effort (3)

A

Goals
- Restore America’s competitive edge by blocking global rivals
- Keep rivals from throwing international order out of balance

LOE
- Build a more lethal force
- Strengthen alliances and find new partners
- Reform the Department

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

National Military Strategy (NMS)
– General Info

A
  • Prepared by CJCS, JCS, CCMD, Joint staff, and OSD
  • Briefly outlines the strategic aims of the armed services
  • Chief guidance is NSS
  • Supports NSS, implements NDS
  • Defines set of interrelated military objectives
  • Describes ways and means to achieve mil objectives
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

NMS
– Five Mission Areas

A
  1. Respond to threats
  2. Deter strategic attack/proliferation of WMD
  3. Deter conventional attack
  4. Assure allies/partners
  5. Compete below the level of armed conflict
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

National Cyberspace Policy

A

Prevent or minimize disruptions to critical information infrastructures and protect the people, economy, essential human and government services, and national security of the US.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

NMS for Cyberspace Ops (NMS-CO)

A
  • Armed Forces Comprehensive strategic approach for using cyberspace ops to assure strategic superiority in the domain
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Joint Publication 3-12, Cyberspace Ops (JP 3-12)

A
  • Governs activities and performance in joint cyberspace ops and guidance for interaction with government and non-governmental agencies, multinational forces, and other inter-org partners
  • Provides guidance for the exercise of authority by CCDRs and JFC
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Air Force Doctrine Document 3-12, Cyberspace Ops (AFDD 3-12)

A
  • AF’s foundational cyberspace doctrine
  • Discusses cyberspace-related topics such as threats, C2, planning/execution, etc
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Air Force Policy Directive 17-2, Cyberspace Ops (AFPD 17-2)

A
  • Establishes AF policy for planning/executing AF/joint cyberspace ops
  • States cyber responsibilities for MAJCOMs, DRUs, FOAs, etc
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Combatant Command (COCOM)

A
  • Non-transferable command authority of a CCDR to organize and employ commands and forces
  • Includes assigning tasks, designating objectives, and giving authoritative direction over all aspects of mil ops, joint training, and logistics
  • Exercised by CCDRs as directed by President or SecDef
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Administrative Control (ADCON)

A
  • Direction or exercise of authority over subordinate/other orgs w/ respect to administration and support
  • Normally exercised along service lines to fulfill service admin support
  • Typical chain of command; not a warfighting authority
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Operational Control (OPCON)

A
  • The authority to organize and employ commands and forces, assign tasks, designate objectives, and give authoritative direction necessary to accomplish the mission
  • Can be delegated down from COCOM
  • Does not include authoritative direction for logistics or matters of administration, discipline, internal organization, or training
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Tactical Control (TACON)

A
  • Authority limited to detailed direction and control of movements or maneuvers within the operational area necessary to accomplish missions or tasks
  • Allows for controlling and directing application of force or tactical use of combat support assets
  • Can be delegated to and exercised by CC at any echelon
  • Does not provide organizational, administrative, or logistical authority
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Support (command authority)
– General Info

A
  • Authority that aids, protects, complements, or sustains another force
  • Used when neither OPCON or TACON is appropriate
  • SecDef specifies support between CCDRs; CCDRs specify lower level support
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Support (command authority)
– Four categories

A
  • General Support
    – Given to supported force as a whole rather than particular subdivision
  • Mutual Support
    – Support between units, against an enemy, because of their assigned tasks, positions relative to the enemy, and inherent capabilities
  • Direct Support
    – Mission requiring a force to support another force
    – Authorizes supporter to directly answer supported’s request for assistance
  • Close Support
    – Action against targets/objectives that are close enough to the supported force to require action integration/coordination
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Department of Defense Information Network (DODIN)

A
  • Globally interconnected, end-to-end information capabilities; associated processes; and personnel for collecting/handling information
  • Includes comm and computing systems/services; software; data; security services; and other associated services
  • Provides interfaces to coalition, allied, and non-DoD users/systems
  • The large, overarching network that all other DoD networks travere
  • Renamed from GIG in 2013
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Cyber Mission Force
– What does it include
– Timeline

A
  • 133 Cyber Mission Teams, Joint Forces Headquarters-Cyber, and Cyber National Mission Force
  • USCYBERCOM’s action arm
  • Timeline
    – 2013 - Started Buildup
    – 2016 - All teams Initial Operational Capability
    – 2018 - All teams Full Operational Capability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Cyber Mission Force (CMF)
– Purpose (Cyberspace mission areas and Lines of Operation)

A
  • Carry out DoD’s cyberspace mission areas:
    – Secure, Operate, and Defend DODIN (Cyber Protection Force)
    – Defend Nation against cyberspace attack (Cyber National Mission Force)
    – Provide CCMD support (Cyber Combat Mission Force)
  • Mission areas carried out through the following LOOs:
    – DODIN Operations
    – Defensive Cyberspace Operations (DCO)
    – Offensive Cyberspace Operations (OCO)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Cyber Mission Force (CMF)
– Sub-commands (3)
– Teams (8)
– Directed By

A
  • Cyber National Mission Force (CNMF)
    – National Mission Teams (NMTs) (CNMF Headquarters)
    – National Support Teams (NSTs) (CNMF Headquarters)
  • Cyber Protection Force (CPF)
    – National Cyber Protection Teams (National CPTs) (CNMF Headquarters)
    – DODIN Cyber Protection Teams (DODIN CPTs) (Joint Force Headquarters DODIN)
    – Combatant Command Cyber Protection Teams (CCMD CPTs) (CCDRs)
    – Service Cyber Protection Teams (Service CPTs) (Service Cyberspace)
  • Cyber Combat Mission Force (CCMF)
    – Combat Mission Teams (CMTs) (Joint Force Headquarters - Cyberspace)
    – Combat Support Teams (CSTs) (Joint Force Headquarters - Cyberspace)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Cyber National Mission Force (CNMF)
– Aligned cyberspace mission area
– Role

A
  • Aligns with Defend the US and its interests against cyberspace attacks
  • Plans, directs, and synchronizes full-spectrum cyber ops to defend against cyber attacks
  • Relies on establishing partnerships with other agencies (NSA, DoD, IC, etc.) to widen awareness
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Cyber National Mission Force Headquarters (CNMF-HQ)
– Mission
– Responsibilities

A
  • Direct and synchronize full spectrum cyber ops to deter, disrupt, and defeat adversary cyberspace actors in order to defend DODIN, critical infrastructure, and the nation
  • Exercise OPCON for NMTs, NSTs, and national CPTs
  • Conduct joint tactical planning/direct tactical ops ISO CNMF missions
  • Synchronize CNMF maneuvers and conduct mission deconfliction
  • Synchronize CNMF intel ops ISO cyber ISR
  • Coordinate CNMF-HQ support functions (personnel, logistics, budget, etc.)
  • Direct CNMF training, exercises, and readiness requirements
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

National Mission Teams (NMT)

A
  • Each aligned against specific cyberspace threat
  • Tactical units
  • Include Defensive Cyberspace Operations Response Actions (DCO-RA)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

National Support Teams (NSTs)

A
  • Provide specialized technical, analytic, and planning support to NMTs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Cyber Protection Force (CPF)
- Largest part of CMF - 68 CPTs - Mission is to **enable supported CC's mission capabilities** by **conducting survey, secure, protect, and recover missions** to prepare local defenders to defend critical assets and Cyberspace Key Terrain (C-KT) - Conduct **hunt missions** for suspected compromise
26
Joint Force Headquarters-DoDIN (JFHQ-DODIN)
- Provides **unity of command and unity of effort** to secure, operate, and defend DODIN - **C2 HQ** - Employs **operational-level C2**; no single HQ can effectively exercise all C2 for DODIN - CDRUSSTRATCOM delegated **directive authority for cyberspace ops over all DoD agencies** to the CC of JFHQ-DODIN
27
Cyber Protection Teams (CPTs) -- Core Capability -- Types
- Real-time DCO - DODIN CPTs -- DODIN systems/networks ISO DISA/DODIN customers -- Directed by JFHQ-DODIN - CCMD/MAJCOM CPTs -- Assigned specific MAJCOMs -- Directed by aligned MAJCOM - National CPTs -- Report directly to CNMF-HQ -- Perform CPT mission on US critical infrastructure/key terrain (CI/KR) and national interests (AOR of CNMF) - Service CPTs -- Aligned to particular military branch -- ex: hunt mission for NAOC
28
Cyberspace Combat Mission Force (CCMF) - Cyberspace Mission Area - Role - Directed by
- Aligns with **CCMD Support** - Provide **integrated cyberspace capes ISO mil ops/contingencies** - Where OCOs are carried out - Directed by JFHQ-C
29
Joint Force Headquarters - Cyber (JFHQ-C) - What makes up JFHQ-C - Role
- Comprised of the **four service cyber HQs** -- Army Cyber Command (ARCYBER) -- U.S. Fleet Cyber Command (FLTCYBER) -- Marine Corps Forces Cyberspace Command (MARFORCYBER) -- Air Forces Cyber (AFCYBER) - Also includes **CGCYBER** (under DHS) - Supports CCMDs; **execute OPCON over CMTs and CSTs**
30
Army Cyber Command (ARCYBER) -- AOR
- USCENTCOM - USAFRICOM - USNORTHCOM
31
U.S. Fleet Cyber Command (FLTCYBER) -- AOR
- USINDOPACOM - USSOUTHCOM
32
Marine Corps Forces Cyberspace Command (MARFORCYBER) - AOR
- USSOCOM
33
Air Forces Cyber (AFCYBER) - AOR
- USEUCOM - USSTRATCOM - USTRANSCOM
34
Combat Mission Teams (CMTs) -- level -- number of teams -- Role -- Team members
- **Tactical units** operating at tactical level of authority, **designated by USCYBERCOM CC** - **27 CMTs** within CMF - Conduct ops **ISO CCMD contingency plans**, crisis action plans, etc. - **Operators, analysts, targeteers, linguists**
35
Combat Support Teams (CSTs)
- capability **devs**, OCO **analysts/planners**, DCO analysts/planners - **Develop and employ offensive cyber capes ISO CCMD** objectives while being integrated, synchronized, and/or deconflicted w/ ops in other domains
36
Defend the Nation Against Cyberspace Attack (Cyberspace mission area)
- **Defend the U.S. and interests** against cyber attacks of significant consequence - **Conduct cyber ops to counter imminent or ongoing cyber attack** on U.S. or interests -- When directed by president or SecDef -- **Prevent loss of life/destruction of property** - **Private sector is first line of defense**
37
Secure, Operate, and Defend the DODIN (Cyberspace mission area)
- **Secure DoD network and recovery quickly if security measures fail** - Conduct **ongoing network defense** ops - **Quick response** to hostile activity within networks -- **Mitigate or close vulnerabilities**
38
Provide CCMD Support (Cyberspace mission area)
- **Ensure internet remains open, secure, and prosperous** - **Provide cyber capes ISO mil ops/contingencies** -- OCO -- Ops support **rule of law, respect freedom of expression, privacy, ideas, etc.** -- follow **LOAC**
39
Categories of Cyberspace Operations
- DODIN Ops - Offensive Cyberspace Operations (OCO) - Defensive Cyberspace Operations (DCO) - Cyber Operational Preparation of the Environment (OPE) - Cyber ISR
40
DODIN Ops (Cyber Operation Category)
- Designing, building, configuring, securing, operating, maintaining, and sustaining the ops information environment - Proactive
41
Offensive Cyberspace Operations (OCO)
- **Project power** by application of force in Cyberspace - must be **authorized just like physical domain ops**
42
Defensive Cyberspace Ops (DCO)
- **Passive and active cyber defense** activities to **outmaneuver adversaries** - **Change current paradigm** where attacker has advantage - **Discover, detect, analyze, and mitigate threats, including insider**
43
DCO Subcategories
- DCO-Internal Defensive Measures (IDM) -- Hunting on **friendly terrain**, **internal** responses -- **Detect, defend, analyze, and stop** threats/vulnerabilities - DCO-Responsive Actions (RA) -- Going after the threat (including in red space) -- **Best defense is a good offense** -- **Only conducted by NMTs**
44
Operational Preparation of the Environment (OPE)
- **Non-intelligence activities** related to **planning and preparing** for follow-on cyber ops - testing a way into a box, pre-staging tools, creating accounts, setting up beacons, etc
45
Cyber ISR
- Cyber **intel gathering activities** to support future ops - **Synchronize and integrate planning and operation** of cyber systems ISO current/future ops - Focuses on **tactical and operational intel** and **mapping adversary cyberspace**
46
Information Operations (IO)
- Integrated employment of information-related capabilities in concert with other Lines of Operation to **influence, disrupt, corrupt, or usurp the decision-making of adversaries** during military operations - Ultimately, **affect adversary behaviour** in ways that help achieve friendly objectives - Not the same as integrating non-lethal capes/activities w/ behaviour-related objectives as primary purpose
47
Information Environment (Information Operations) - Definition - 3 Dimensions
- Aggregate of individuals, organizations, and systems that collect, process, disseminate, or act on information - Physical Dimension - Information Dimension - Cognitive Dimension
48
Physical Dimension (Information Operations)
- **C2 systems, key decision makers, and supporting infrastructure** - People, C2 facilities, newspapers, books, microwave towers, laptops, objects subject to empirical measurement, etc. - Not confined to military or nation-based; crosses national, economic, and geographical boundaries
49
Information Dimension (Information Operations)
- **Specifies where and how info is collected, processed, stored, disseminated, and protected** - Where C2 is exercised and CC's intent is conveyed
50
Cognitive Dimension (Information Operations)
- **The minds of those who transmit, receive, and respond to or act on information** - Information processing, perception, judgment, and decision making - Influenced by individual or cultural beliefs, norms, vulnerabilities, motivations, emotions, experiences, etc. - Most important component of information environment
51
Information Assurance (IA)
- Processing, storing, and transmitting the right information to the right people at the right time
52
Wing Cybersecurity Office (WCO)
- Addresses all cybersecurity requirements on base
53
Information Assurance Officer (IAO)
- Unit-level liaison between the unit and WCO for all COMPUSEC matters under IA program
54
Special Security Officer (SSO)
- Handles security for all types of SCI material within his/her respective organization - Responsible for personnel security, communications security, physical security, information security, and/or computer security - Handles development of classification guides, document marking, safeguarding info, and SCI use procedures
55
Information System/COMSEC User
- The end users - Responsible for knowing required safeguards and using information systems IAW assigned duties
56
OPSEC -- Definition
- Reduce vulnerability of missions by eliminating or reducing successful adversary collection and exploitation of critical information - An Operations function or activity (a process) - Responsibility of **all** members of military
57
Critical Information
- Specific facts about friendly intentions, capabilities, and activities that adversaries can use to disrupt or deny friendly missions - Can be obtained as a whole or derived from smaller parts
58
OPSEC Process (5 steps)
1. **ID Critical Information** -- Develop CC-approved CIL 2. **Analysis of Threats** -- Research and analysis to ID likely adversaries and actions -- Who is adversary; what are their goals?; etc. 3. **Analysis of Vulnerabilities** -- ID an op or activity's vulnerabilities -- Compare vulnerabilities w/ adversary's collection capes ID'd in step 2 -- True vulnerability exists when adversary is capable of collecting CI, analyzing it, and acting on it 4. **Assessment of Risk** -- Vulnerabilities analyzed/countermeasures ID'd -- CC/staff estimate impact to ops to implement (cost to time, resources, personnel, etc.) vs. potential harm -- CC/staff select countermeasures based on assessment 5. **Application of OPSEC countermeasures** -- CC implements countermeasures selected in step 4
59
1B4 Duties and Responsibilities (apprentice-craftsman)
- **Conduct OCO** to project power by application of force in cyberspace -- target cyber functions or initiate cascading effects into physical domain - **Conduct DCO** to defend DOD and friendly cyberspace -- Does not include passive defense measures - **Provide C2** of cyber ops ISO DOD, interagency, and coalition forces - Developing/executing TTPs -- Implementing policies through dev of TTPs -- Planning, conducting, and evaluating exercises - **Establish performance standards**, training, and evals - **Participate in R&D and operational testing**/eval for new capes -- **Assess/reverse engineer** nodes/devices to determine capes/limitations/vulnerabilities - **Apply forensics** to reverse engineer adversary TTPs and determine extent of damage from cyber attacks -- May require partnering w/ other DoD, interagency, or coalition forces - **Conduct** specific cyberspace actions
60
1B4 Duties and responsibilities (Superintendent)
- **Manage and direct** personnel ISO OCO and DCO -- **Manage execution** of ops plans -- **Evaluate operational effectiveness** of equipment - **Analyze national defense guidance/strategic objectives** to create operational policies -- **Implement policy** through TTPs -- **Manage budget** to ensure resource availability -- Plan and conduct exercises/evals to ensure operational readiness - **Manage C2** of ops w/ DoD, interagency, and coalition forces - **Manage** specific cyberspace actions
61
1B411
- Cyberspace Warfare Operations Helper - Awarded upon retraining acceptance and approval - Focus on gaining skills and knowledge to complete CWO Apprentice Course
62
1B431
- Cyberspace Warfare Operations Apprentice - Awarded upon completion of IST - Assigned to tactical level units - Incident Response Operator, Interactive Operator, other entry-level positions
63
1B451
- Cyberspace Warfare Operations Journeyman - Awarded after core STS tasks are signed off - Required to enter CCAF Degree program
64
1B471
- Cyberspace Warfare Operations Craftsman - Awarded after core STS tasks are signed off - Min rank: SSgt
65
1B491
- Cyberspace Warfare Operations Superintendent - Min rank: SMSgt
66
1B000
- Chief Enlisted Managed (CEM) - MAJCOM Functional Managers (MFMs) and Career Field Manager (CFM) - Superintendent w/ expanded scope of supervisory/managerial involvement, permitting expanded resource use
67
1B4 Prefixes
- T -- Instructors (333 TRS and 39 IOS) -- Affixed to DAFSC and CAFSC - U -- Information Operations -- Specialize in Military Deception (MILDEC), PSYOPS, OPSEC, network warfare, or electronic warfare
68
3D0X2
- Cyber Systems Operations - Install, support, and maintain server operating systems or other computer systems/software - Support ID, reconnaissance, and exploitation of vulnerabilities while enhancing capes w/in cyber environments
69
3D1X2
- Cyber Transport Systems - Deploy, sustain, troubleshoot, and repair standard voice, data, and video network infrastructure, IP detection systems, and cryptographic equipment - Maintain networks - Configure/maintain network equipment of weapon system - Ensure down-range systems can communicate w/ in-garrison equipment
70
1N0X1
- Operations Intelligence - Analyze multiple sources of info to develop, evaluate, and disseminate intel on potential threats
71
1N4X1A
- Fusion Analyst - **Analyze, disseminate, and exploit intelligence from target comms** - Analyze comms to recognize, exact, verify, and process reportable info - Operate similar to 1B4s but with intel focus - May run Wireshark, collect IOCs, crack passwords, etc.
72
17DXX
- Warfighter Communications Operations - 17DXA - Network Ops -- **Manages cyber infrastructure** -- Leads DODIN operations missions -- Network support, but typically attached to supported CC's mission - 17DXB - Expeditionary Communications Operations -- **Engineer, build, operate, secure, and extend cyber infrastructure** -- Leads DODIN ops in deployed, austere, and hostile environment -- Similar to 17DXA, but more combat comm
73
17SXX - Cyber Effects Operations
- Cyber Effects Operations - 17SXA - Offensive Cyberspace Operations -- Operate intel platforms/weapon systems -- **Exploit adversary networks** -- Work alongside/manage 1B4s in OCO missions - 17SXB - Defensive Cyberspace Operations -- **Operates defensive platforms/weapon systems** -- Works alongside/manages 1B4s in DCO missions
74
14NX
- Intelligence Officer - Performing/managing intel functions - Provide threat analysis of potential adversaries/targets and threats to friendly assets
75
Civilians
- Provide expertise and continuity to operate garrison bases w/o mission stoppage - GS/SES pay grades aligned w/ military rank -- Equivalencies originally created for the purpose of determining civilian PoW treatment IAW Geneva Convetion
76
Contractors
- Provide **flexible workforce** dedicated to supplementing the civilian and military workforce - **Provide required SMEs and industry knowledge** w/ emerging and legacy technologies - Contracts **must be supervised by a federal employee**, uniformed or civil service -- Oversight provided by **Contracting Officer's Representative (CORs)** - Qualifications for each position are contained w/in the legal contract
77
16th Air Force (AFCYBER)
- Falls under ACC - HQ at JBSA-L - Also known as Information Warfare Numbered Air Force - Integrates multi-source ISR, cyber warfare, electronic warfare, and info ops capes - **Integrates Information Warfare (IW) at operational and tactical levels**
78
616th Operations Center (616 OC)
- **Receives orders from U.S. Cyber Command** - **Tasks 16AF subordinate units** w/ cyber missions ISO AF and joint CCs - Operates **Cyber Command and Control Mission System (C3MS)** weapon system
79
67th Cyberspace Wing (67 CW)
- JBSA-L - **Deliver cyberspace outcomes to generate a decisive advantage** across the continuum of conflict for the Nation - Newest combat wing - AFCYBER's execution arm for employing **CVA/H weapon system** - 4 Groups and 26 Units -- **67 COG** -- **318 COG** -- **567 COG** -- **867 COG** - 7 Operating Locations - >2000 Airmen, civilians, contractors
80
67 COG
- JBSA-L - **Provide forces** to conduct network ops for USSTRATCOM, USCYBERCOM, and other CCMDs - Conducts SecDef-directed **special network warfare missions** **5 Squadrons** - 91 COS -- Conduct OCO tasked by USCYBERCOM ISO world-wide CCDR objectives -- Executes exploitation as a **NSA delegated authority** -- **Presents trained forces** to USCYBERCOM as part of the CMF - 305 COS -- Conducts OCO ISO CCMDs - 352 COS -- Generate, conduct, and sustain OCO - 375 COS -- Conduct OCO and **ISR** ops ISO CCDR objectives - 390 COS -- **Generate** Mission-ready offensive cyber maneuver **forces** for USCYBERCOM and **build cyber tacticians** for our Service, Joint Force, and Nation
81
318 COG
- JBSA-L - **Innovate, partner, and deliver combat capability** in, through, and from cyberspace through the dev, testing, training, and exercising of material and non-material solutions **4 Squadrons** - 39 IOS -- Conduct **qualification and advanced training** -- Provides IQT for most 1B4 students after CWO - 90 COS -- Accelerate Global Vigilance, Reach, and Power by rapidly **developing joint cyber capes** -- Integrates, innovates, and deploys cyberspace capes to achieve priority objectives - 318 RANS (Range Squadron) -- **Operate, manage, and maintain ACCs cyber range and Model & Simulation (M&S) capes** -- Deliver realistic cyber range environments and Live, Virtual & Constructive (LVC) models - 346 TS (Test Squadron) -- **Validate** DoD cyber warfare, electronic warfare, and information warfare capes -- **Conduct operational tests**, under realistic conditions, for any component of weapon system, equipment, or software to determine effectiveness
82
567 COG
- Scott AFB - Plan and execute ops to assist supported CCs to fight in contested cyber environment - Remove adversary cyber capes; **defends CC's key cyber assets**; prepares local defenders to sustain advanced defensive TTPs **4 Squadrons** - 92 COS -- Assure AF and DoD mission performance by employing **CPTs** and performing CVAs and COMSEC assessments - 834 COS -- Employ and Exploit unique advantage of **CPTs** in defense of AF and DoD critical mission areas - 835 COS -- **Protect** critical AF and DoD infrastructure/mission systems - 837 COS -- Maintain combat superiority by dominating cyberspace
83
867 COG
- Fort Meade - Newest Cyber Ops Group under 67 WG (2020) - OCOs and providing defensive capes to CNMF **4 Squadrons** - 315 COS -- **OCO** -- Find the enemy, exploit weaknesses, attack - 341 COS -- **OCO** -- Train and deliver ops focused Airmen to CNMF for defense - 833 COS -- **Defensive** Capes to CNMF -- Present, plan, and execute ops to defend info networks - 836 COS -- **Defensive** Capes to CNMF - Present, plan, and execute ops to defend info networks
84
688 CW
- JBSA-L - **Engineer, build, operate, secure, defend, and extend the AF cyber domain** - Dedicated to delivering actionable intel and TTPs across the AFIN enterprise - 4 Groups, only 2 discussed -- 26 COG -- 690 COG
85
26 COG
- JBSA-L - Defensive capes and flexible response options - **Active defense ops** **3 Squadrons** - 26 NOS -- Operates AF portion of **Global Information Grid** -- Network defense for AF enterprise network -- Operate and defend AFNET Increment 1 Gateway -- C2 and defense for >250 locations, >1100 WAN circuits -- sustains all NIPR/SIPR - 33 NWS -- **Monitors, secures, and protects AF and CENTCOM global networks** -- Ensures network CIA and responds to hostile network threats - 68 NWS -- **Detect, prevent, and assess risk** of data content loss in AF networks -- Provide **data loss vulnerability assessments**, force protection analysis, network vulnerability reporting, and info damage assessments
86
690 COG
- JBSA-L - Operate, sustsain, and defend the AFIN using **Cyberspace Security and Control System (CSCS)** weapon system **6 Squadrons, 4 discussed** - 83 NOS -- Provide centralized **cyber defense** and mission assurance using **CSCS** weapon system to perform DCO and DODIN ops -- Directly supports global installations w/ **authentication services, monitoring, server storage, backup management, boundary protection, etc.** - 561 NOS -- Provide **mission assurance** by operating, sustaining, and defending AF network -- **Manages core services**: messaging, network monitoring, directory services, infrastructure, etc. for > 100 AF installations - 690 COS -- Operate, sustain, and defend AFIN, employing **CSCS** to assure cyber supremacy, enforce network standards - 691 COS -- Deliver gobal, integrated capabilities and effects by employing **CSCS**
87
7th Intelligence Squadron (7 IS)
- Ft Meade - Red team ops, DCO, cyber intel ops ISO NSA missions
88
35th Intel Squadron (35 IS)
- JBSA-L - Conduct cyber ISR ops/analysis using cryptologic capabilities to enable USAF/joint ops
89
Title 10 - Armed Forces
- Outlines role of armed forces in U.S.C. - Provides legal basis for roles, missions, and organization of each service as well as DoD - Outlines how DoD provides manning, training, and equipment for mil ops **5 Subtitles** - Subtitle A - General Military Law, including UCMJ - Subtitle B - Army - Subtitle C - Navy and Marine Corps - Subtitle D - Air Force an Space Force - Subtitle E - Reserve Components
90
Title 15 - Commerce and Trade
- Covers NIST and cybersecurity responsibilities **Cyber-related Chapters** - Chapter 7 - NIST - Chapter 22 - Trademarks - Chapter 23 - Dissemination of Technical, Scientific, and Engineering Information - Chapter 63 - Technology Innovation - Chapter 100 - Cyber Security Research and Development
91
National Institute of Standards and Technology (NIST)
- Non-regulatory federal agency w/in Dept of Commerce - Science, engineering, technology, and measurement lab
92
Title 17
- Covers copyrights - Protects digital works from unlawful reproduction, infringement, false representation, and fraudulent removal of copyright notices - Notable Chapters -- Chapter 2 - Copyright Ownership and Transfer -- Chapter 3 - Duration of Copyright -- Chapter 5 - Copyright Infringement and Remedies -- Chapter 7 - Copyright Office -- Chapter 10 - Digital Audio Recording Devices and Media
93
Title 18
- Crimes and Criminal Procedures - Enforcement of law within U.S. - Permits broad range of activities considered part of DoD's effort to defend DODIN, such as blocking IP addresses and certain file attachments - Role in cyber: crime prevention, apprehension, prosecution **Cyber-applicable sections** - Computer Fraud -- Addresses unauthorized access to protected computers to obtain something of value, cause damage, or loss -- Covers use of ransomware and transmission of program, code, or command w/o authorization - Wire Fraud -- Criminal fraud using electronic communication of any kind -- May be fined or imprisoned up to 20 years, or both -- If causing presidentially declared major disaster/emergency or affecting financial institution, fine up to $1M and imprisonment up to 30 years, or both - Communications Lines -- Deals with destroying or interfering w/ comm lines, stations, or systems owned, operated, or controlled by U.S. for mil or civil defense functions -- Used to prosecute DDOS attacks/other disruptions against mil comms - Federal Wiretap Act -- Prohibits 3rd party from wiretapping, monitoring, or intercepting comm in transit -- Covers telephone and electronic comm -- Numerous exceptions: --- Service Provider --- Consent --- Foreign Intelligence Surveillance Act --- Comms readily accessible to general public --- Trespasser exception --- Inadvertently obtained criminal evidence - Stored Communications Act -- Sets forth statutory privacy rights for customers/subscribers of computer network service providers -- 3 main components --- Section 2701 prohibits unlawful access to certain stored comms --- Section 2702 regulates voluntary disclosure by service provider --- Section 2703 creates procedures that law enforcement must follow to compel disclosure - Pen Registers and Trap/Trace Device -- Pen Register/Dialed Number Recorder (DNR) - device which records all numbers called from a particular phone line -- Trap/trace device - Captures incoming calls to a particular number -- Unlawful for anyone to install or use either device w/o court order, unless authorized under this law - Must not include contents of communication - Gov agency authorized use must use tech reasonably available to restrict inclusion of comm contents
94
Title 32 - National Guard
- Describes role of National Guard -- Outlines organization, personnel, training, service, supply/procurement, and homeland defense activities - Under Title 32 status, member remains under OPCON, TACON, and ADCON of Governor - Activation Circumstances -- State Active Duty - Governor activated response to natural or man-made disaster or Homeland Defense Missions -- Title 32 Full-Time - Federally funded activation w/ approval of state Governor. C2 remains w/ Governor -- Federal Duty (Title 10) - Full time duty in active military; Ordered by President to Active Duty
95
Title 50 - War and National Defense
- Governs conduct of war, national security, and defense related activities - Includes provisions related to intel activities - Assigns SIGINT responsibility to NSA - Lays out what Intel Community is authorized to do to conduct intel activities -- Requires need, purpose, collection technique, AG approval, law enforcement/civil authority assistance
96
EO 12333
- Defines foreign intelligence/counterintelligence responsibility of Services and intel oversight
97
Intelligence Reform and Terrorism Act of 2004
- Requires a civil liberties protection officer within the Office of the Director of National Intelligence (ODNI) -- Reports directly to ODNI -- Responsible for ensuring privacy and civil liberties protections are incorporated into policies and proceedures -- Reviews alleged abuse of privacy/civil liberties -- Conducts privacy impact assessment
98
UCMJ
- Cyber-related articles -- Article 2 - Persons subject to the UCMJ -- Article 91 - Insubordinate conduct toward warrant officer, NCO, or petty officer -- Article 92 - Failure to obey order or regulation -- Article 103a - Espionage -- Article 103b - Aiding the enemy -- Article 123 - Offenses concerning Government computers -- Article 134 - General Article
99
EO 13800, Strengthening the Cyberscurity of Federal Networks and Critical Infrastructure
- Focuses federal efforts on modernizing federal IT infrastructure - Key points -- Report to POTUS on Federal IT Modernization -- Support to Critical Infrastructure at Greatest Risk -- Support Transparency in the Marketplace -- Resilience against botnets and other automated, distributed threats -- Assessment of electricity disruption incident response capes -- American cybersecurity workforce development
100
Intellectual Property
- Intangible property (assset w/ value) resulting from human intellect, which can be protected by law -- Copyright -- Trademark -- Patents -- Trade Secrets
101
Copyrights
- Right granted to owner of original work to reproduce and distribute copies or records, or make derivative work, and perform or display work publicly - Lasts life of author + 70 years - Anonymous/pseudonymous work copyright is 95 years from publishing or 120 years from creation, whichever expires first
102
Trademarks
- Word, name, symbol, or device used in trade with goods to indicate the source of the goods and distinguish them from other goods
103
Patents
- Protect inventions - Excludes others from making, using, offering for sale, or selling an invention - Generally good for 20 years from date of filing
104
Trade Secrets
- Info such as formula, pattern, compilation, program, device, method, technique, or process - Protect business's method for creating specific product
105
Rules of Engagement (ROEs)
- Directives issued by mil authorities defining when combat will be initiated and/or continued - Provide standing guidance during peacetime - Control transition from peacetime to conflict - Control combat ops during conflict
106
Port Scanning
- Basic method for gathering info about devices on a network - Also called vulnerability scanning, enumeration, active reconnaissance, etc.
107
Sniffers
- Devices or software that monitor traffic, in real time, on a network
108
Forensics Tools
- Tools typically used by incident responders to deep dive into a computer system
109
Ethical Hacking
- Attacking a computer system or network in a way similar to unethical hackers, for a good purpose
110
Unethical Hacking
- Conduct unethical acts when hacking; may be done for fun, profit, or to destroy/steal data
111
3 system "Uses"
1. Prohibited Use - Adversely reflects on DoD; interferes w/ employee or office productivity, or use is to conduct outside commercial activity 2. Authorized Use - Does not interfere w/ official duties, is of reasonable duration/frequency, serves legitimate government interest 3. Official Use - Performance of work associated w/ day to day responsibilities
112
10 "Commandments" of Computer Ethics
1. Do not use computer to harm other people 2. Do not interfere w/ other people's work 3. Do not snoop around others' files 4. Do not use computer to steal 5. Do not use computer to bear false witness 6. Do not copy/use proprietary software for which you have not paid 7. Do not use others' resources w/o authorization or proper compensation 8. Do not appropriate others' intellectual output 9. Think about social consequences of the program/system you are designing 10. Always use computer in ways that ensure consideration and respect of others
113
PII -- AFI -- Law
- AFI 33-332 - Privacy Act of 1974 - Only grant access to those who need to access to perform their job
114
HIPAA -- Two DoD Regs
- DoD 6025.18-R, DoD Health Information Privacy - DoD 8580.02-R, DoD Health Information Security
115
Privileged Communications
- Communications not normally shared with law enforcement and may not be used in court -- Ex: communications w/ attorneys, chaplains, mental health, etc. - Normally special procedures to follow before accessing privileged info
116
Treaties
- Formally concluded and ratified agreement between two or more countries - Legally binding convention, protocol, pact, accord, international agreement, etc.
117
International Law
- Rules and principles governing relations and dealings between nations; states and individuals; and international organizations - Treaties are negotiated between vested countries, while international law applies to all countries
118
The Convention on Cybercrime (2001)
- Known as Budapest Convention - First international agreement aimed at reducing computer-related crime - Includes list of crimes that each signatory state must make unlawful - Ratified in 2006, enforced starting 2007
119
2015 G-20 Summit
- Leaders agreed international law applies to state conduct - Leaders committed their states to abide by norms of responsible behaviour in cyberspace - Each state agreed no country should conduct or support cyber-enabled theft of IP
120
United Nations Convention against Transnational Organized Crime
- Treaty known as Palermo Convention - Obligates state parties to enact domestic criminal offenses that target organized criminal groups - Requires adoption of new frameworks for extradition, mutual legal assistance, and law enforcement cooperation