1. AFCEA
State of Combat Comm Advancing Warfighter Capabilities in, through and from Cyberspace

2. Mission
Train and maintain in order to deploy, operate and defend expeditionary communications for dominant combat and contingency operations.
Supported Missions
AOC
AEW, AEG, AES
JTF
POTUS/US Secret Service
ACS, ASOS, ACOMS
Aircraft Mishaps
Joint/Coalition/Alliance
Other Directed Missions
DSCA
HA/DR
Let's Go!

3. Combat Comm Drawdown Timeline
2011
Force Strength: 44 AEW (LCP)
Combat Comm Sqdns: 10 AD / 17 ANG / 4 AFR
AFMA Manpower Study 2011
ISAG 2011
CORONA 2011
Deployable Comm CONOPS 2012
3 CCG/689 CCW Inactivation 2013
PAD Dec 2013
FY15 Alt POM: Jan 2014 AFSPC TDC Ltr
Force Strength: 22 LCP, 27 MCP, 38 SCP
Combat Comm Sqdns: 4 AD / 15 ANG / 3 AFR
New Mission: “Extend the Net” for ACC Units
2014

4. 938 people and 84,419 man-days deployed since 2011!
Historical Ops Tempo
TALKING NOTES:
High Ops Tempo, numerous missions worldwide
US Secret Service, Combat Communication Missions
New missions
Gained 53rd missions (?)
Gained ASOS/ACS missions
Gained 3rd CCG missions (?) ( )
LEGEND
AEF =
MOB =
HERD=
938 people and 84,419 man-days deployed since 2011!

5. Way Ahead Normalize ASOS and ACS support
Explore redundant transmission paths
Embrace wireless
Formalize and standardize Small and Medium Comm Packages
Baseline Coalition network support and capabilities
Complete and execute results of Combat Comm Demand Study

6. Advancing warfighting capabilities in, through and from Cyberspace
Major General Ed Wilson
Commander, 24th Air Force and
Commander, Air Forces Cyber
OVERALL CLASSIFICATION OF THIS BRIEFING IS
UNCLASSIFIED

7. Today’s Warfighting Perspective
UNCLASSIFIED
Cyberspace is a Domain
…Not a Mission or Functional area
Cyberspace is Man-Made
…Primary Architect is Private Industry
Cyberspace is Contested
…Potential Risk to Main Street, Wall Street and Combat Ops
…Warfighting Principles Influence Mission Success
Cyberspace is Complex
…Challenges Existing Policy and Legal Framework
…Challenges Traditional C2 Constructs
Increasingly “Commander’s Business” to Succeed in Today’s Fight
UNCLASSIFIED

8. Complex Global Domain World Population on the Internet
World Cell Subscribers
UNCLASSIFIED
Reported Breaches
2020
5 B
Internet of Things
9 B ?
50.1 B
Growing Exponentially
Pervasive in Everyday Life
Borderless & Increasingly Faceless
Internet of Things
Becoming Internet of Threats
2015
2.9 B
7.2 B
1151
18.2 B
2010
2.2 B
5.2 B
831
2005
8.7 B
1 B
2.2 B
644
CISCO predicts over half (57%) of all IP traffic will originate with non-PC devices by 2018 (CISCO VNI Forecast 2013 – 2018)
It would take an individual over 5 million years to watch the amount of video that will cross global IP
networks each month in Every second, nearly a million minutes of video content will cross the network
by (CISCO VNI Forecast 2013 – 2018)
IoT = Expected to reach 50 B by 2020 (CISCO IoT Infographic)
These new devices/nodes will bring additional vulnerabilities/threats with them…the Internet of things will become the Internet of Threats
World Population expected to reach 7.5 Billion in 2018 (Population in Billion (
World Population /Cell Subscriber numbers taken from ITU (
Population on Internet from Networkworld.com referencing internet world stats (
Cell Subscriber Estimate from Technology Times (
Reported Breaches (Source
UNCLASSIFIED

9. Aurora Video DoD’s Cyber Mission Force Aligned to 3 mission areas
UNCLASSIFIED
Aurora Video
DoD’s Cyber Mission Force
Aligned to 3 mission areas
Defend the nation: NMT, CSTs & CPTs focused on defending the nation’s critical infrastructure against adversary attacks
Defend DoDIN: CPTs focused on defending DoD networks to ensure freedom of maneuver within DoD networks
Includes partnership with DISA for JFHQ-DoDIN
Combat Mission Forces: Combat Mission Teams providing cyber capabilities to meet Combatant Command requirements
Forces C2’d through Joint Forces Headquarters – Cyber for each Cyber Component
UNCLASSIFIED

10. Proliferation and Sophistication of Threats
UNCLASSIFIED
German Steel Mill - Germany’s Federal Office for Information Security (or BSI) recently reported attackers gained access to the steel mill through the plant’s business network, then successively worked their way into production networks to access systems controlling plant equipment. The attackers infiltrated the corporate network using a spear-phishing attack—sending targeted that appears to come from a trusted source in order to trick the recipient into opening a malicious attachment or visiting a malicious web site where malware is downloaded to their computer. The attack resulted inability to control a blast furnace which resulted in physical damage to equipment. The report did not identify the Steel Mill. This is the second publicly reported attack that has resulted in physical damage. The first being the stuxnet attack.
(Reference:
Sands Corp – In February 2014, Sands Casino experienced a cyber attack that shut down their servers and computers and erased hard drives. Investigators believe the attacks originated from Iran and may have been attributed remarks made by Mr. Adelson on Iran’s nuclear program. Mr. Adelson owns significant portion of Las Vegas Sands and has a lucrative gaming empire overseas. This particular attack may have been conducted to punish versus for financial gain.
(Reference:
Sony – Sony Pictures forced to take their systems offline due to reported cyber attack by “Guardians of Peace” on 24 Nov. Their website was defaced with a message stating “Hacked by #GOP.” The attackers warned they had obtained internal corporate data to include their “top secrets” and threatened to leak them unless their demands were met. The attack resulted in delay release of the movie “The Interview”
(Reference:
Lockheed Martin – NY Times reported hackers used stolen security tokens to gain access to their information networks. Lockheed Martin reported they detected and blocked the intrusion before any important data was compromised. The company replaced 45,000 SecurID tokens held by their employees and required all passwords be changed.
(Reference:
Boeing - Three Chinese nationals seeking to make "big bucks" broke into the computers of Boeing and other military contractors, stealing trade secrets on transport aircraft, reported in a US criminal complaint filed in June of US authorities accused the attackers of obtaining information about the C-17, related parts and performance of C17, Lockheed Martin’s F-22 and F-35 and other military projects.
(Reference:
QinetiQ - For three years, boutique defense contractor QinetiQ was compromised by an advanced persistent threat (APT) attack group operating from China. During that time, attackers accessed information about cutting-edge U.S. military drone and robot weapons systems and brought competing products to market.
(Reference:
US State Department – US State Department shut down one of its computer networks when it was believed to have been hacked. The incident impacted . Experts believe the breach may be related to the White House’s unclassified network breach.
(Reference:
National Oceanic and Atmospheric Administration – NOAA temporarily disrupted flow of certain satellite data to the National Weather Service due to “an Internet-sourced attack” on four NOAA websites. Effects did not prevent NOAA from delivering forecasts to the public.
(Reference:
USPS – Reported victim of cyber attack compromising information of 800,000 employees. USPS suspects the attack was conducted by Chinese hackers. There was no indication of customer information being compromised.
(Reference:
White House – Washington post reported hackers thought to be working for the Russian government breached the unclassified White House computer networks. The attack resulted in temporary disruptions to some services while cybersecurity teams worked to contained the intrusion.
(Reference:
Warsaw Stock Exchange – 23 Oct 2014, Hackers breached the Warsaw Stock Exchange, exposing login credentials for dozens of brokers in apparent retaliation for the bombing campaign against the Islamic State in Iraq and Syria (ISIS) (Refernece:
Heartbleed Vulnerability – OpenSSL vulernability which could allow a remote attacker to expose sensitive data to include authentication credentials and secret keys through incorrect memory handling (Reference:
ShellShock Vulnerability – Disclosed in Sept 2014, is a family of security bugs associated with the UNIX BASH shell and could allow an attacker to gain unauthorized access. (Reference:
Ransomware – Malware that stops you from using your PC…hold your PC for ransom and often displays message stating illegal activity has been detected and requires some action to get access to your files. (Reference:
K-Mart – Early Oct 2014 K-mart released a statement identifying attackers obtained customer credit and debit card data…number of customers and locations has not been disclosed (Reference:
Home-Depot – 2 Sept 2014 Point of Sales systems breached. Estimated 56 Million payment cards may be at risk due to malware affecting point of sale systems
J.P. Morgan Chase – Data breach possibly affecting 76 million customers…hackers used malware to retrieve names, addresses, phone numbers and addresses
Dairy Queen – 27 Aug 2014 Dairy Queen reported a point of sale malware compromise affecting 4,500 stores…attackers used third party vendor credentials to gain access to the POS system. DQ implemented cash only fix to prevent further risk to customers until they remediated the vulnerability.
Neiman Marcus – 15 Jun 2014 Neiman Marcus reported malware was used to collected payment card data affecting 350K cards…9,200 cards were fraudulently used
eBay – 21 May 2014 eBay reported hackers accessed a database containing 145 million user records which were copied…cross site scripting was used to access the database and gain addresses, encrypted passwords, birth dates, mailing addresses
Target – 13 Dec 2013 Target reported 40 million customers may have had their payment information compromised . It’s believed the compromise began with a malware-laced phishing attack
Auburn University – 20 Nov 2013 AU reported a server compromise within the College of Business network potentially affecting 14,000 individuals personal information
Exploitation
Disruption
Destruction
UNCLASSIFIED

11. Shaping Key Cyber Terrain
UNCLASSIFIED
UNCLASSIFIED

12. DoD’s Cyber Mission Force
UNCLASSIFIED
National Mission Team
National Support Team
Defend the Nation
Counter Cyberspace Operations against adversaries emanating from Nation-States
Combat Mission Team
Combat Support Team
COCOM Support
Offensive Cyber Operations to achieve or directly support CCMD objectives
Cyber
Protection Team
Cyber Defense
Defensive Cyber Operations to protect key cyber terrain
DoD’s Cyber Mission Force
Aligned to 3 mission areas
Defend the nation: NMT, CSTs & CPTs focused on defending the nation’s critical infrastructure against adversary attacks
Defend DoDIN: CPTs focused on defending DoD networks to ensure freedom of maneuver within DoD networks
Includes partnership with DISA for JFHQ-DoDIN
Combat Mission Forces: Combat Mission Teams providing cyber capabilities to meet Combatant Command requirements
Forces C2’d through Joint Forces Headquarters – Cyber for each Cyber Component
Fielding DoD’s “Cyber Maneuver Force”…6,000+ New Cyber Operators
UNCLASSIFIED

13. AF’s CMF Force Structure
UNCLASSIFIED
National
Mission Team
Support Team
Defend the Nation
Combat
Mission Team
Support Team
COCOM Support
13 x CMTs/CSTs
Cyber Defense
Cyber
Protection Team
20 x CPTs
DoD’s Cyber Mission Force
Aligned to 3 mission areas
Defend the nation: NMT, CSTs & CPTs focused on defending the nation’s critical infrastructure against adversary attacks
Defend DoDIN: CPTs focused on defending DoD networks to ensure freedom of maneuver within DoD networks
Includes partnership with DISA for JFHQ-DoDIN
Combat Mission Forces: Combat Mission Teams providing cyber capabilities to meet Combatant Command requirements
Forces C2’d through Joint Forces Headquarters – Cyber for each Cyber Component
6 x NMTs/NSTs
Total contribution: 1,700+ Airmen; 39 Teams
AFCYBER presents forces to USCYBERCOM
Jointly manned by 24 AF & 25 AF (1,000+ and 700+ Airmen)
= 24 AF
= 25 AF*
UNCLASSIFIED

14. Challenges and Opportunities
UNCLASSIFIED
Challenges and Opportunities
Proliferation & Sophistication of Threats
Resource Stability
Joint Information Environment (JIE)
Added Capacity & Capabilities (CMF)
Multi-Domain Integration
Command & Control
Rapid Cyber Acquisition
Force Development
UNCLASSIFIED

15. 5th MOB…Let’s Go!