How Cyber Command’s plan to ‘frustrate’ hackers is working

By: Mark Pomerleau 

Source Link

Gen. Paul Nakasone, the head of U.S. Cyber Command, used prepared testimony before the Senate Armed Services Committee Feb. 14 to describe an organization that has been more active in recent months and one that is conducting cyber operations in multiple places throughout the world.

The new activity comes as the result of several changes: a new approach to cyberspace — one aimed at more effectively competing against adversaries that have taken advantage of the asymmetries cyberspace offers, a full workforce and additional authorities.

Nakasone noted that malicious cyber actors weaponize personal information, steal intellectual property and mount influence campaigns, all of which have had strategic effects on the nation and allies. To combat these threats, the United States must act in cyberspace, Nakasone wrote. In a recent interview with Joint Force Quarterly, Nakasone said that, unlike in the nuclear domain, where the strategic advantage came from possessing a capability or large stockpile, in cyberspace the use of cyber capabilities is strategically consequential.

“The threat of using something in cyberspace is not as powerful as actually using it because that’s what our adversaries are doing to us,” he said. “They are actively in our network communications, attempting to steal data and impact our weapons systems. So advantage is gained by those who maintain a continual state of action.”

In prepared remarks before the committee, Nakasone said that under a new guiding philosophy referred to as “defend forward,” the Department of Defense will take action against those who attack the United States. Defend forward is often described as fighting the cyber battle on someone else’s turf as opposed to fighting it at home. This includes gaining access to adversary networks or infrastructure to get insights into what they might be planning.

“In practice, this means confronting our adversaries from where they launch cyberattacks and developing robust capabilities that are responsive to Defense Support to Civil Authorities (DSCA) activities,” Nakasone wrote in his testimony.

What has this meant in action? Nakasone outlined how the command supported European Command, Northern Command, the Department of Homeland Security, the Federal Bureau of Investigation to defend against attacks on the 2018 midterm elections. This included establishing a Russia small group within the NSA, as well as working with European Command and European countries.

“We created a persistent presence in cyberspace to monitor adversary actions and crafted tools and tactics to frustrate their efforts,” Nakasone said.

Second, Cyber Command is also supporting ongoing DoD operations in the physical realm, namely against terrorist actors.

“We are employing cyber capabilities to improve force protection, bolster intelligence, understand and shape the information environment, and disrupt the operations, command and control and propaganda of several insurgent and terrorist groups in support of Central Command, Africa Command and Special Operations Command,” he said. “Cyberspace operations in places like Iraq, Syria, Yemen and Afghanistan today integrate and synchronize cyberspace and information operations with kinetic missions, with each enabling the other for offensive, force protection and intelligence purposes.”

Nakasone also pointed to the shift in the counterterrorism mission, aligning Marine Corps Forces Cyberspace Command to the cyber component supporting the joint and coalition efforts to degrade ISIS in Iraq and Syria and sought to deny ISIS’s use of cyberspace for spreading its message and coordinating operations known as Joint Task Force-Ares.

Previously, Army Cyber Command was in charge of the task force. Under what is known as the Joint Force Headquarters-Cyber (JFHQ-C) construct — which provides planning, targeting, intelligence and cyber capabilities to assigned combatant commands — MARFORCYBER supports Special Operations Command. In one sense, this realignment was thought to be a natural progression as the Marines are aligned with Special Operations Command and its transregional mission to counter violent extremists.

Moreover, Nakasone wrote that Joint Task Force-Ares has embarked on a special mission partnership with NSA to act together as a hub for whole-of-government cyber planning in the ongoing counterterror fight.