U.S. Cyber Command focuses on deterring cyberthreats from impacting the homeland, but could hold less direct authority if an internal threat targets the critical infrastructure of a state. That\u2019s why 40 states have representatives in an annual large-scale cyber exercise that kicked off late last week.<\/p>\n\n\n\n
Cyber Shield 19, which runs until April 20, brings together members of the National Guard, who answer to the governors of their respective states, and has them work with industry to improve incident response to cyber events.<\/p>\n\n\n\n
\u201cThe purpose is to develop and train internal defensive measures, incident response, coordinate train and assist activities,\u201d Brig. Gen. Jeffrey Burkett, vice director of domestic operations for the National Guard Bureau, told reporters April 9 during a briefing at the Pentagon.<\/p>\n\n\n\n
\u201cIt\u2019s a collective training event for us. It will enhance our war-fighting skills and that\u2019s very important to us.\u201d<\/p>\n\n\n\n
Overarching themes, Burkett said, are to protect the Department of Defense Information Network and coordinate, train and assist critical infrastructure partners in how they do their mission sets.<\/p>\n\n\n\n
For the National Guard, however, working on building partnerships with private industry is essential.<\/p>\n\n\n\n
\u201cCyber Shield is unique in the fact that we bring in partners that we work with \u2026 This is really key for us because our critical infrastructure, our networks are primarily private,\u201d Brig. Gen. Richard Neely, Adjutant General with the Illinois National Guard, said.<\/p>\n\n\n\n
\u201cWhen bad guys go after things … it\u2019s probably going to be outside the DoDIN.\u201d<\/p>\n\n\n\n
While primarily a training event, Cyber Shield really is also about building relationships so if an event does happen, the right entities know who to call and how to work with one another.<\/p>\n\n\n\n
\u201cPart of the goodness with the Guard is that dual-status technician, that dual-use soldier who may work at the department of public works in his everyday job and then he drills on the weekend,\u201d George Battistelli, chief of defense cyber operations at the National Guard, said.<\/p>\n\n\n\n
\u201cHe has the inside knowledge of how that system works and he gets that training through the Guard and now he\u2019s a very valuable asset because he can help protect that infrastructure if on a defensive cyber operation element or a different cyber team.\u201d<\/p>\n\n\n\n
Battistelli noted that Cyber Shield is a \u201cdetection\u201d event, with participants practicing their ability to identify malicious activity on the network and then remediate it. While declining to offer specifics, he said that activity emulates behavior seen in the news and the exercise has evolved each year to keep up with adversarial methods.<\/p>\n\n\n\n
\u201cWe used to have attacks that were very noisy and now we have attacks that are going over encrypted channels,\u201d he said.<\/p>\n\n\n\n
\u201cAs the adversary changes their [tactics, techniques and procedures], we change our TTPs, so it would be very na\u00efve to do the same scenario every single year because cybersecurity changes.\u201d<\/p>\n\n\n\n
For example, as recently as two years ago, offensive intrusions were just dropped into the exercise because they lacked the ability to properly simulate a real breach.<\/p>\n\n\n\n
\u201cBlue teams couldn\u2019t see how we got there and they weren\u2019t able to trace back,\u201d said Col. Teri Williams, deputy commander of the 91st Cyber Brigade in the Virginia National Guard, noting this is problematic for real-world training.<\/p>\n\n\n\n
Now, the offensive teams have to work their way into the networks and show the trail of how they got in and what they are doing so that our defensive forces can do the forensics, she added.<\/p>\n","protected":false},"excerpt":{"rendered":"
Cyber Shield 19 aims to train National Guardsman on best practices in cyber detection while building industry partnerships.<\/p>\n","protected":false},"author":7,"featured_media":39970,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":16,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"10":{"categories":["training-sim","training-simulation-report","newsletters","daily-news-roundup"],"primary_category":"training-sim"}}},"categories":[10,106,29,16,32],"tags":[],"coauthors":[3268],"class_list":["post-17643","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber","category-daily-brief","category-home","category-it-networks","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"LYGQHJOIOJD3VF4JF7OIGGVOOM","arc_canonical_url":"\/dod\/2019\/04\/10\/the-national-guard-decodes-how-to-beat-encrypted-attacks\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n