1. OVERALL CLASSIFICATION OF THIS BRIEFING IS UNCLASSIFIED
24th Air Force (AFCYBER)
Col Robert Skinner
Commander, 688th Information Operations Wing
OVERALL CLASSIFICATION OF THIS BRIEFING IS UNCLASSIFIED
11 Jun10

2. 24 AF Perspectives on Cyberspace
Only operational domain that is man-made
Physical Domain (A place, Not a mission)
Where Operations are conducted (Like Land, Sea, Air & Space)
Integrate operations conducted across domains (don’t integrate domains)
About Mission Assurance (not Network Assurance)
Mission statement
Extend, operate and defend the Air Force portion of the DoD network and to provide full spectrum capabilities for the Joint warfighter in through and from cyberspace
Mission Essential Tasks
Provide shared cyberspace situational awareness
Assure Freedom of Action for Friendly Operations and deny
adversaries the same
Synchronize Network Operations and Defense
Project trained Cyber warriors in support of military operations
Enable full spectrum cyber operations
"Cyberspace is not a mission, it is a place where operations are conducted … and is about assuring the mission, not about assuring the network”
–Maj Gen Dick Webber, AFNS, 20 Nov 09

3. Combat Communications Forces
Joint C2 Relationships
JFCOM
STRATCOM
COCOMs
As Required
USCYBERCOM CSE
AF CYBER LNO?
USCYBERCOM
ACC
AFSPC
C-MAJCOM
ACCE
ACCE – Support to:
- Joint planning
- Targeting
- Weaponeering
- Interagency coord
- Synchronization
- COCOM/OPLAN CCIR
- Joint effects
- Deconfliction
- Other cyber components
AEF Tasking
Lead MAJCOM MOU
AFCYBER
(24 AF*)
C-NAFs
Desired
624 OC
As Required
COLE
AOC
COCOM
OPCON
DELEGATED
AUTHORITY
ADCON
COORD
SUPPORT
COLE– Provides support to:
- Theater planning
- Joint effects coordination
- Mission assurance
- Synchronization
DAL
CC Intentions
CC Priority
Hunter Team
AF CYBER
FORCES
Combat Communications Forces
ACCE: Air Component Coordination Element
COLE: Cyber Operations Liaison Element
CSE: Cyber Support Element
DAL: Defended asset list

4. AF Cyber Force Capabilities
AFSTRAT
8 AF
AFSTRAT
24 AF / AFNETOPS
AFCYBER
AFISRA
614 AOC
608 AOC
624 OC*
Cyber C2
Operational planning
Mission integration
Cyber fusion
Operational Integration
Direct Support
ARC Forces
67th NWW
688th IOW
689th CCW
659th ISRG
Combat Comm
Engineering and Installation
Blue Team
assessment
Full Spectrum
Cyber Ops
MCCC
3x(CACS)
Full Spectrum
NetOps
Net Control
ESSA
CORA
AFCERT*
Hunter teams
TTPs
Cyber OT&E
Rapid tool development
Blue Team assessment
Engineering and installation
Combat Comms
Hammer Ace
Global Net extension
SIGINT support
Threat analysis
NTI
Threat warning
Target development
Law Enforcement/AFOSI Presence
ESSA: Electronic System Security Assessment
CORA: Cyber Operational Risk Assessment
Hammer Ace: Rapid deployable comm
NTI: National Tactical Integration
OPCON
ADCON
OTHER

5. Acquisition & Development Process
Unclassified
Acquisition & Development Process
Increasingly dynamic environment
Streamline acquisition processes
Rapid capability delivery
Meet warfighter needs
Leverage DISA/NSA tools and capabilities
Ops
&
Innovation
AFMC ESC AFSPC
Current Rapid
(UON/JUON)
Requirements:
AFSPC: Near-real-time development / organic/non-contracted (“speed of need”)
AFMC/ESC: Rapid development (months) – take off-the-shelf stuff and tweak as necessary
AFMC: Long-term/foundational (e.g., CITS) (years, etc) – primarily contracted out
Foundational
Unclassified

6. Mission Assurance vs. Network Assurance
Operator business (A3)
Service provider business (A6)
Assure mission accomplishment
Assure the network works
Focuses on operational need
Focuses on service availability
Prioritizes defense
May deny mission to ensure
the network is protected
Establishes operational “crown
jewels”
Attempts to defend everything
Integrates intelligence
preparation into threat response
Can dismiss the greater threat
due to lack of tangible effects
Response to attack:
fight through
disconnect
Mission Assurance: A process to ensure that assigned tasks or duties can be performed in accordance with the intended purpose or plan. It is a summation of the activities and measures taken to ensure that required capabilities and all supporting infrastructures are available to the DoD to carry out the National Military Strategy. It links numerous risk management program activities and security relation functions --such as force protection; antiterrorism; critical infrastructure protection; information assurance; continuity of operations; chemical; biological; radiological nuclear, and high-explosive defense; readiness; and installation preparedness--to create the synergistic effect required for DoD to mobilize, deploy, support, and sustain military operations throughout the continuum of operations. (DoD Directive )
Our Mission Is To Make Sure The Warfighter Can Perform The Joint Mission 6

7. Build The Foundation For The OODA Loop
Priorities
Real time situational awareness
Filter mountains of data for relevance
Be proactive with vigilant monitoring
Standardize network architecture
Fight through an attack
Reroute critical traffic
Kill malicious traffic
Respond with active forces
Be proactive/vigilant monitoring:
Detect changes that signal malicious activity
Know how maintenance affects capabilities
React to unscheduled outages to minimize impact
Standardize Net Arch:
Simplifies maintenance
Limits potential vulnerabilities
Makes deviations more apparent
Build The Foundation For The OODA Loop

8. Challenges Cyber: High demand, low density
Command and control at the speed of war
Real-time situational awareness
Size and complexity of the network
Heterogeneous networks
Time to build Cyber capabilities
Advanced adversaries

9. Services Working Together
CJCSM directs services to: “share and corroborate [incident info] for validation and situational awareness.”
Accomplished through incident reporting process
Response actions directed by USCYBERCOM via TCNOs, IAVAs or OPORDS as needed
Joint Exercise BULWARK DEFENDER
Annual CND exercise, all services participate
Robust scenarios developed by services and USSTRATCOM
Services attend valuable lessons learned conf. POST-EX
Service Liaison Officers
688 IOW has LNOs from all services and NSA
Ensures valuable exchange of tactics and lessons learned

10. Teaming with Industry/Academia
Working on partnerships with large enterprise-focused commercial companies
Academic Partnerships:
Saint Mary’s University Cyber Security Conference
Defense Technological Cluster (DTC)
Air Force Institute of Technology
UTSA
Vanderbilt
George Mason
Help exchange lessons learned
Possible data sharing
Potential for shared SA
UTSA – 24AF and AFRL working with UTSA on Cyber R&D
Vandy/George Mason – Working on Mod & Sim support to Cyber Planning and mission rehearsal
“We must establish close & continuing relationships with our joint partners, industry and academia”
- Secretary of the Air Force, “Air Force Cyberspace Mission Alignment”, 20 Aug 2009

11. 24 AF Way Ahead Crawl  Walk  Run Build cyber situational awareness
Create mission assurance paradigm
Normalize NetOps and defense
Complete Ops Center transformation
Operationalize cyber C2
Space and Cyber integration
Mature joint relationships
Partner with industry
Increase capacity
Total Force Integration
Grow component-NAF staff
Crawl  Walk  Run