{"id":28673,"date":"2017-08-16T16:45:43","date_gmt":"2017-08-16T16:45:43","guid":{"rendered":"https:\/\/one.sightlinemg.com\/c4isrnet\/uncategorized\/2017\/08\/16\/defensive-cyber-teams-take-on-more-missions-under-new-model\/"},"modified":"2026-08-08T18:33:52","modified_gmt":"2026-08-08T18:33:52","slug":"defensive-cyber-teams-take-on-more-missions-under-new-model","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/c4isrnet\/newsletters\/2017\/08\/16\/defensive-cyber-teams-take-on-more-missions-under-new-model\/","title":{"rendered":"Defensive cyber teams take on more missions under new model"},"content":{"rendered":"\n

Given the obfuscation afforded to actors in cyberspace and the low barrier of entry, cyber protection teams within the U.S. Central Command area of responsibility were conducting no more than two missions a year, as they were becoming bogged down in preparatory intelligence for defensive operations.<\/p>\n\n\n\n

In turn, CENTCOM developed a cyberthreat prioritization model to resolve the issues surrounding intelligence preparation of the environment, otherwise known as IPE, which is the work that comes before a cyber protection team, or CPT, heads out on a defensive mission.<\/p>\n\n\n\n

A threat prioritization model serves as an analysis tool, combining information from cyber defenders and managers, said to Marlene Kovacic, a cyberspace branch senior intelligence analyst at CENTCOM and defensive cyber operations team lead, who spoke at the DoDIIS Worldwide Conference on Tuesday.<\/p>\n\n\n\n

Moreover, these models are an \u201cintelligence driven analytical matrix from a structured data model to characterize and prioritize adversary groups,\u201d according to a slide from her presentation. \u201cIt is used in order to determine the weight of each intrusion set, enabling defensive operations to make planning decision on how to protect critical infrastructure with defensive cyberspace operations.\u201d<\/p>\n\n\n\n

\u201cThe model came to be mainly because our cyber protection teams … the ones that are assigned for Central Command [from Cyber Command] \u2026 were asked to speed up their IPE development process because the analysts were taking so long developing IPE because the threat space is really big,\u201d Kovacic said. \u201cThe CPTs were limited to one, maybe two missions a year, which is not really using the CPTs efficiently.\u201d<\/p>\n\n\n\n

CPTs of U.S. Cyber Command act as cyber swat teams, responding to breaches for a short amount of time to make recommendations and get networks back online. They are also organized by task based on assets directed by the commander.<\/p>\n\n\n\n

The defensive missions themselves are done by the commander\u2019s priorities, Kovacic said. Whatever the commander\u2019s priorities are for that theater, CPTs perform the defensive mission and bring back an assessment. This was the case when the CPTs were tasked to protect a Terminal High Altitude Area Defense battery<\/a> in South Korea.<\/p>\n\n\n\n

[Cyber protection teams assigned to THAAD in South Korea<\/a>]<\/i><\/p>\n\n\n\n

The analysts, she said, were taking a long time to look at what threat indicators to concentrate on, what threat actors are most important and so on.<\/p>\n\n\n\n

The model they ended up developing was adopted and modified from a similar prioritization model devised by the Army\u2019s intelligence directorate. However, the Army\u2019s traditional model did not fit the bill for the CPTs because within nation-states there are a plethora of unique tactics, techniques and sophistication levels by other threat actors, and because the CPTs would try to cover that every time there was mission, which wasn\u2019t working out, she noted.<\/p>\n\n\n\n

The model, referred to as A.C.A.R.E., was a great foundation to work with and modify to fit the bill of CPTs. It has seven categories to evaluate an intrusion or threat actor, each of which has a score of 1-5:<\/p>\n\n\n\n