OVERALL CLASSIFICATION OF THIS BRIEFING IS UNCLASSIFIED 24th Air Force (AFCYBER) Col Robert Skinner Commander, 688th Information Operations Wing OVERALL CLASSIFICATION OF THIS BRIEFING IS UNCLASSIFIED 11 Jun10

24 AF Perspectives on Cyberspace Only operational domain that is man-made Physical Domain (A place, Not a mission) Where Operations are conducted (Like Land, Sea, Air & Space) Integrate operations conducted across domains (don’t integrate domains) About Mission Assurance (not Network Assurance) Mission statement Extend, operate and defend the Air Force portion of the DoD network and to provide full spectrum capabilities for the Joint warfighter in through and from cyberspace Mission Essential Tasks Provide shared cyberspace situational awareness Assure Freedom of Action for Friendly Operations and deny adversaries the same Synchronize Network Operations and Defense Project trained Cyber warriors in support of military operations Enable full spectrum cyber operations "Cyberspace is not a mission, it is a place where operations are conducted … and is about assuring the mission, not about assuring the network” –Maj Gen Dick Webber, AFNS, 20 Nov 09

Combat Communications Forces Joint C2 Relationships JFCOM STRATCOM COCOMs As Required USCYBERCOM CSE AF CYBER LNO? USCYBERCOM ACC AFSPC C-MAJCOM ACCE ACCE – Support to: - Joint planning - Targeting - Weaponeering - Interagency coord - Synchronization - COCOM/OPLAN CCIR - Joint effects - Deconfliction - Other cyber components AEF Tasking Lead MAJCOM MOU AFCYBER (24 AF*) C-NAFs Desired 624 OC As Required COLE AOC COCOM OPCON DELEGATED AUTHORITY ADCON COORD SUPPORT COLE– Provides support to: - Theater planning - Joint effects coordination - Mission assurance - Synchronization DAL CC Intentions CC Priority Hunter Team AF CYBER FORCES Combat Communications Forces ACCE: Air Component Coordination Element COLE: Cyber Operations Liaison Element CSE: Cyber Support Element DAL: Defended asset list

AF Cyber Force Capabilities AFSTRAT 8 AF AFSTRAT 24 AF / AFNETOPS AFCYBER AFISRA 614 AOC 608 AOC 624 OC* Cyber C2 Operational planning Mission integration Cyber fusion Operational Integration Direct Support ARC Forces 67th NWW 688th IOW 689th CCW 659th ISRG Combat Comm Engineering and Installation Blue Team assessment Full Spectrum Cyber Ops MCCC 3x(CACS) Full Spectrum NetOps Net Control ESSA CORA AFCERT* Hunter teams TTPs Cyber OT&E Rapid tool development Blue Team assessment Engineering and installation Combat Comms Hammer Ace Global Net extension SIGINT support Threat analysis NTI Threat warning Target development Law Enforcement/AFOSI Presence ESSA: Electronic System Security Assessment CORA: Cyber Operational Risk Assessment Hammer Ace: Rapid deployable comm NTI: National Tactical Integration OPCON ADCON OTHER

Acquisition & Development Process Unclassified Acquisition & Development Process Increasingly dynamic environment Streamline acquisition processes Rapid capability delivery Meet warfighter needs Leverage DISA/NSA tools and capabilities Ops & Innovation AFMC ESC AFSPC Current Rapid (UON/JUON) Requirements: AFSPC: Near-real-time development / organic/non-contracted (“speed of need”) AFMC/ESC: Rapid development (months) – take off-the-shelf stuff and tweak as necessary AFMC: Long-term/foundational (e.g., CITS) (years, etc) – primarily contracted out Foundational Unclassified

Mission Assurance vs. Network Assurance Operator business (A3) Service provider business (A6) Assure mission accomplishment Assure the network works Focuses on operational need Focuses on service availability Prioritizes defense May deny mission to ensure the network is protected Establishes operational “crown jewels” Attempts to defend everything Integrates intelligence preparation into threat response Can dismiss the greater threat due to lack of tangible effects Response to attack: fight through disconnect Mission Assurance: A process to ensure that assigned tasks or duties can be performed in accordance with the intended purpose or plan. It is a summation of the activities and measures taken to ensure that required capabilities and all supporting infrastructures are available to the DoD to carry out the National Military Strategy. It links numerous risk management program activities and security relation functions --such as force protection; antiterrorism; critical infrastructure protection; information assurance; continuity of operations; chemical; biological; radiological nuclear, and high-explosive defense; readiness; and installation preparedness--to create the synergistic effect required for DoD to mobilize, deploy, support, and sustain military operations throughout the continuum of operations. (DoD Directive 3020.40) Our Mission Is To Make Sure The Warfighter Can Perform The Joint Mission 6

Build The Foundation For The OODA Loop Priorities Real time situational awareness Filter mountains of data for relevance Be proactive with vigilant monitoring Standardize network architecture Fight through an attack Reroute critical traffic Kill malicious traffic Respond with active forces Be proactive/vigilant monitoring: Detect changes that signal malicious activity Know how maintenance affects capabilities React to unscheduled outages to minimize impact Standardize Net Arch: Simplifies maintenance Limits potential vulnerabilities Makes deviations more apparent Build The Foundation For The OODA Loop

Challenges Cyber: High demand, low density Command and control at the speed of war Real-time situational awareness Size and complexity of the network Heterogeneous networks Time to build Cyber capabilities Advanced adversaries

Services Working Together CJCSM 6510.10 directs services to: “share and corroborate [incident info] for validation and situational awareness.” Accomplished through incident reporting process Response actions directed by USCYBERCOM via TCNOs, IAVAs or OPORDS as needed Joint Exercise BULWARK DEFENDER Annual CND exercise, all services participate Robust scenarios developed by services and USSTRATCOM Services attend valuable lessons learned conf. POST-EX Service Liaison Officers 688 IOW has LNOs from all services and NSA Ensures valuable exchange of tactics and lessons learned

Teaming with Industry/Academia Working on partnerships with large enterprise-focused commercial companies Academic Partnerships: Saint Mary’s University Cyber Security Conference Defense Technological Cluster (DTC) Air Force Institute of Technology UTSA Vanderbilt George Mason Help exchange lessons learned Possible data sharing Potential for shared SA UTSA – 24AF and AFRL working with UTSA on Cyber R&D Vandy/George Mason – Working on Mod & Sim support to Cyber Planning and mission rehearsal “We must establish close & continuing relationships with our joint partners, industry and academia” - Secretary of the Air Force, “Air Force Cyberspace Mission Alignment”, 20 Aug 2009

24 AF Way Ahead Crawl  Walk  Run Build cyber situational awareness Create mission assurance paradigm Normalize NetOps and defense Complete Ops Center transformation Operationalize cyber C2 Space and Cyber integration Mature joint relationships Partner with industry Increase capacity Total Force Integration Grow component-NAF staff Crawl  Walk  Run