Cyber Command works to address criticism over how it integrates tools — challenges remain

Mark Pomerleau

Source Link

WASHINGTON — U.S. Cyber Command is working to instill more seamless integration of disparate cyber war-fighting systems.

Congress has expressed concern that the command’s vision lacks a governance strategy to connect systems together, a key finding of an audit published in November by its nonpartisan watchdog. Lawmakers ordered the Department of Defense to report to them on its governance strategy, called the Joint Cyber Warfighting Architecture. While the report, turned in at the end of the previous administration, is not released publicly, a Senate Armed Services Committee staffer told C4ISRNET that the senators were correct in their assessment that the cyber strategy lacked proper structures.

The strategy, created in 2019 and meant to better align the commands’ programs and resources, is a priority this year for the command, Executive Director David Frederick said this week. He and other leaders who spoke at virtual events said the command is working on integrating its systems to serve needs across the military, but they acknowledged there are inherent difficulties with technology purchases for cyber warriors.

“The tricky part, for anybody who’s done large-scale acquisition programs is: How do you synchronize? How do we get all these programs to have a shared vision and a shared set of priorities to work through the interconnections and interdependencies? That’s our big challenge right now,” Frederick said March 10 at an Intelligence and National Security Alliance event. “We also are working with relatively limited authority at the command level. Most of the decision-making authority is at the acquisition program level within the military services.”

Unlike most other aspects of warfare, cyber is designed to be joint from the beginning. Cyber Command is responsible for outlining specific capabilities used by its cyber warriors provided by each of the services. However, due to the way the DoD procures equipment, the services are responsible for providing the variety of tools and systems these cyber warriors must use during operations, spreading those technologies over many program offices.

The Joint Cyber Warfighting Architecture has five elements:

Common firing platforms being built by the Army providing a comprehensive suite of cyber tools.

A Unified Platform being built by the Air Force to integrate and analyze data from offensive and defensive operations with partners.

Joint command-and-control, also being built by the Air Force, for situational awareness and battle management.

Sensors that support defense of the network and drive operational decisions.

The Persistent Cyber Training Environment being built by the Army for education and mission rehearsal.

Cyber Command created two offices that focus on identifying the proper requirements for systems and ensuring they work together.

At the strategic level, the command has established an overarching management office called the Joint Capability Management Office, which works for the deputy commander and drives many system requirements. It looks at the strategic vision and concepts needed for integration and what the big picture architecture must look like holistically.

A second team, in the Joint Integration Office, focuses on lower-level tactical aspects, such as how the individual service program offices work together. This office — under Cyber Command’s advanced concepts and technology directorate, or J9 — works on mission engineering and requirements to ensure the pieces plug into one another for an integrated solution.

Beyond the two integration offices, Col. Benjamin Ring, director of the capability management office at Cyber Command, said more oversight and a means for synchronization are needed, especially in the data sphere.

“How do you integrate, expose data in this day and age because we can’t look at data as an IT commodity,” he said during a virtual presentation March 11 for the AFCEA DC chapter. “Data is an asset. We need to make sure that we can share our data. There’s a tendency to hide and protect our data. We have to make sure we share and protect that, so how do you break down some of those barriers?”

“As we look strategically at the DoD, in policy and who has oversight on data standards, and implementing different data strategy, I think, as we tread forward in this new era, this new digital era, you have a lot of overlap between what is traditionally the DoD CIO role and the lineage of the CIO, and then what is U.S. Cyber Command’s role,” Ring said.

The department is working through that.

Some officials have noted there has already been some progress made on data standards.

“What the team has been doing across the JCWA community to establish the common data standard across the department has been a huge value to the Navy,” Sandra Radesky, deputy command information officer at 10th Fleet/Fleet Cyber Command, said at the same event.

She noted that the Navy is using these standards to ready its data to be input under Unified Platform.

Complicating matters further, officials noted that these tools are being used by the force while being built. Given many of these programs are primarily software based, the military has adopted best practices from private industry of rapid delivery and constant iteration of systems so they can deliver tools as needed, but continuously improve and add when technology becomes available.

“We’re going to build out and integrate these platform at the same time we’re using them for operations, and that’s going to cause a natural tension to making sure things are secure and heading in the right direction for the long term rather than just making some short-term successes that could compromise the long-term future,” Al Mollenkopf, science adviser at Army Cyber Command, said at the AFCEA event.

He pointed to the importance of data standards for interoperability. Additionally, complexity is the enemy of success when it comes to integrating all of these disparate systems, he added.

“We have to make sure that we integrate and build out this platform in a way that reduces complexity in a mission-relevant way,” he said. “It has to be integrated in a mission-relevant way that reduces complexity so that people can leverage the platform to achieve the desired outcomes.”