The Jack Voltaic series, developed by the Army Cyber Institute at the U.S. Military Academy to game out the state of cybersecurity at local ports, kicks off its next conference Feb. 24 at The Citadel military college in Charleston, South Carolina.

The exercise has thus far focused on defending critical infrastructure across two cities — Charleston and Savannah, Georgia — allowing them to gain a better understand of incident management if a cyber disruption occurs.

Army Cyber Command, as well as the Guard and Reserves, have cyber protection teams that hunt actors on Defense Department networks and eradicate threats. This exercise could provide insights as to how to better use and deploy those teams.

“Are there places where it would be appropriate to apply those capabilities, and then where are the mechanisms to do that,” Lt. Gen. Stephen Fogarty, chief of Army Cyber Command, told C4ISRNET, regarding lessons he hopes to get out of the event. Fogarty is providing the opening conference keynote.

One mechanism he suggested is “Defense Support of Civil Authorities,” the process for which the U.S. military can assist state and local entities.

From the Army’s perspective, it has to deploy from ports. If those areas, which are under the control of state and local governments, succumb to cyberattacks, it hinders the Army’s ability to deploy. Thus, it is in the best interest of the Army and the rest of the services to lend a hand in aiding localities in improving their cyber defense, which leads to better national cybersecurity.

“We require strategic mobility. Again, we don’t want to be fighting on our shores; we want to keep that offshore. We have to be able to get to the fight,” Fogarty said. “For us, it’s making sure there’s clear understanding by civil authorities what our requirements are, what our expectations are, and then what we can [do] to assist them and protect that strategic capability for the nation.”

After Jack Voltaic 3.0 in September 2020, officials realized there was a need to keep the conversation going regarding critical infrastructure resiliency.

“It’s too important to conduct once, write down some lessons and then move on,” said Col. Jeffrey Erickson, director of the Army Cyber Institute. “Rather, we wanted to continue to foster an ecosystem of information and knowledge exchange through a series of conferences with Norwich University Applied Research Institutes, the Georgia Cyber Center, The Citadel and the Critical Infrastructure Resilience Institute at the University of Illinois.”

Events such as Jack Voltic also help the Army better tune to certain threats, Fogarty said, noting that partnerships with industry and academia help alert the service to different types of challenges, and vice versa for local governments.

There’s “an array of threats that local authorities — they’re going to be the principal responders to. Their ability to identify these [threats] — essentially to rehearse what their responses are, understand what their capabilities are, where their limitations may be, where they make investments — that’s, really what they principally get out of this,” Fogarty said. “For the Army, what I want to do is I want to worry about getting the people, the material that we require to conduct operations there.”

Officials believe success equates to increased awareness across all sectors.

“Success this week looks like increased awareness in the community, new (and greater) connections between public and private sectors, and potential new critical infrastructure resiliency events in the future. Only through more sets and reps can we continue to increase resiliency at all levels,” Erickson said.

“We know on the future battlefield, you got to fight dispersed and distributed,” Maj. Gen. Charles Costanza, commander of 3rd Infantry Division, told reporters at a media day at Fort Stewart, Georgia. He went on, adding that command posts at the brigade and division level are “just too big” and “not survivable.”

Armored formations must move rapidly on the battlefield, but their current communications architecture doesn’t allow them to do what they need at the right speed or range. The Army is working to change that. Between January and February, the service conducted a pilot aimed at better understanding the needs and design for modernizing the network for armored formations.

As part of the Army’s modernized network approach, it is providing “capability sets” to units every two years, each building upon the previous delivery and adding in new technologies. The first of these, Capability Set ‘21, was designed for infantry brigades. The next two focused on Stryker brigades and armored brigades, respectively.

The three-week pilot, which took place at Fort Stewart with 2nd Armored Brigade Combat Team, 3rd Infantry Division, sought to help establish Capability Set ‘25 design goals and inform concepts, requirements and technology maturity from division to battalion.

The soldier feedback gathered during the effort — especially so far in advance, given a preliminary design review isn’t scheduled until around April 2023 — is essential for providing units the capabilities they need to succeed. Officials hoped to understand how the capabilities were deployed, whether the right equipment was put in the right place in the right formation and did the technology support or hinder the mission.

To get that feedback and test new equipment in an operational context, the pilot outfitted three battalions with three different network configurations called equipment sets. One included line-of-sight and satellite communications; one was primarily satellite communications; and one was line-of-sight heavy.

Early feedback from soldiers indicated that the new equipment significantly improved units’ ability to move and communicate quicker, although some equipment might not be in the right formations.

“The general feedback we’ve received so far is it’s easy to use, it’s expeditionary in mindset and allows us … [to] keep a much smaller command post signature, which will help us increase our survivability,” said Col. Terry Tillis, commander of 2nd Armored Brigade Combat Team, 3rd Infantry Division.

From the division’s perspective, the new gear is poised to improve operations.

“This capability would allow us, enable us to fight a little bit more distributed and dispersed,” Costanza said. “I think this is really going to improve our ability to fight and survive on the future battlefield.”

In many cases, set up and tear down for command posts and communications was over an hour. Additionally, sometimes in the field, units would have to stop their vehicles to establish communications. However, soldiers said communications that would take much longer could now be communicated seamlessly in minutes with the new equipment, while also being more dispersed.

The ability to communicate faster and more efficiently in the future will invariably change the way the Army operates and fights, said Tillis.

“It is going to change because it adjusts the tempo and we’re going to be able to move faster … what changes for us is the ability to move when we need to move,” Tillis said. “The increase in technology is going to change fundamentally how we would fight. That’s something that we’ve got to learn at our level. How do we become expert coaches? How do we work distributed [command and control] in each of these command posts?”

For example, operators explained that one of the tenets of maneuver warfare is if formations outrun their communications, they have to stop. But what if they don’t have to stop and can maintain those links of communication, asked one battalion commander. New technology tested in the pilot could enable that, but armored formations come with their own challenges.

Armor formations and vehicles are one of the most difficult formations to outfit from a networking perspective given the confined space on the platforms. While this current pilot effort took place on surrogate vehicles — Vietnam-era tracked vehicles — discussions are ongoing across the acquisition community to outfit communications gear on forthcoming replacements. The Army’s Program Executive Office for Command, Control, Communications-Tactical (PEO C3T) is working hand in hand with PEO Ground Combat Systems, which has provided drawings for new vehicles such as the Joint Light Tactical Vehicle and the Armored Multi-Purpose Vehicle.

“As we start making some of these decisions coming out of this [pilot], then the next phase will be working with the identified vendors as we move forward on what that next step of integration going forward is,” Col. Shane Taylor, program manager for tactical networks at PEO C3T, said.

Once it’s determined which vehicles receive which equipment, based in part on feedback from the pilot, “we’ll be concurrently providing that information to the ground combat folks and then we’ll start working with them much tighter on the integration kits,” Taylor said.

Another integration aspect officials described is how the new experimental equipment works with the current network.

“The Army’s a big army. There’s a lot of kit already out there. We’re [not] going to throw everything away and start over,” Taylor said. “The Army is just too big to do that. Therefore, we need to make sure that what we carry forward out of this interoperates with the existing solutions that we have until we can replace it.”

The distributed denial of service (DDoS) incidents — which essentially flood internet sites with an unusually high amount of web traffic, rendering them useless — hit at least 10 Ukrainian websites, including those of the Defense Ministry, Foreign Ministry, Culture Ministry and Ukraine’s two largest state banks. Denial of service attacks don’t require the incredible sophistication or painstaking access to networks needed for most data theft or deleterious cyberattacks, making them a common tactic among criminal organizations.

Ukrainian Information Ministry’s Center for Strategic Communications and Information Security suggested Russia could be behind the Feb. 15 incident, but didn’t provide details.

“It is possible that the aggressor resorted to tactics of petty mischief, because his aggressive plans aren’t working overall,” the statement said.

The Pentagon and U.S. Cyber Command deferred comment on the cyberattack to the National Security Council, which did not immediately respond to a request for comment.

Despite these incidents not yet being attributed to an actor, experts are worried they could signal an uptick in activity in eastern Europe amid the Russian troop buildup.

“Overall, this is telling us that more is starting to go down in Ukraine. I think this may very well signal the beginning of a Russian attack on Ukraine,” Tatyana Bolton, policy director of the Cybersecurity & Emerging Threats team at the R Street Institute think tank, told C4ISRNET. Bolton is also the former director of the Cyberspace Solarium Commission, a a bipartisan organization created in the 2019 defense policy bill to develop a multipronged U.S. cyber strategy.

Bolton noted there’s no direct indication Russian entities are responsible. However, the targets affected are what one might see during the beginning of a coordinated military campaign, she said.

Timothy Jones, vice president of systems engineering at Forescout, an enterprise defense company, cautioned that while the initial DDoS incident may not seem sophisticated, it could get worse and more complex.

With denial of service attacks, “sometimes the full extent isn’t really seen right away. We’re just starting to get some of the reports out,” said Jones. “Maybe they’re doing stuff in the background that we’re not necessarily looking at yet, or hasn’t really been felt.”

Using denial of service indicates some level of restraint, which Bolton described as a bit atypical for Russia.

“Usually, [DDoS] doesn’t take you offline for more than a day,” she said. “It can be more serious, but it’s not like encrypting all their files or deleting all their files. Those would have really been significant attacks. But the concern is also, what’s next? Is this a smokescreen for a larger incident or attack?”

The critical infrastructure sector — such as energy companies — were not targeted, which could signal that if Russia was behind the incident, they either view the banking sector as more critical or they are following general rules of warfare by not knocking out power to the civilian sector in the dead of winter, Bolton added.

DDoS is a tactic the Russians have been accused of using previously.

In mid-January, Ukraine blamed Russia for a cyberattack that temporarily disabled about 70 Ukrainian government websites simultaneously. During last month’s attack, an announcement posted stated that Ukrainians should “be afraid and expect the worst.”

Russia launched one of the most devastating cyberattacks ever on Ukraine in 2017 with the NotPetya virus, causing over $10 billion in damage worldwide. The virus, also disguised as ransomware, was a so-called “wiper” that scrubbed entire networks.

Cristin Monahan of the George Washington University’s National Security Archive’s Cyber Vault pointed out the Russians hit Estonia with a series of DDoS incidents in 2007 over Estonia’s decision to relocate a Soviet war monument, something of a watershed moment in the modern cyberwarfare era.

“The Russians made the point that even without direct military intervention, or even cyber interventions with kinetic effects, they can exert significant pressure on nations in their crosshairs, and Ukraine has received the same message for a number of years,” she said.

Monahan added that DDoS incidents rarely result in military intervention, implying the U.S. is not likely to physically engage with Russia over the loss of banking services.

The Associated Press contributed to this report.

Cyber Command created the Joint Cyber Warfighting Architecture, or JCWA, in 2019 as a means of guiding capability development. When the command was initially created, it lacked resources and capabilities, thus having to rely upon systems used by the National Security Agency. Given the two have distinctly different missions — intelligence collection versus warfighting — Cyber Command needed to build its own tools and infrastructure.

The fiscal 2021 annual report of the Office of the Director, Operational Test and Evaluation assessed this architecture lacked governance, the latest in a series of government watchdog assertions alleging as much.

“[A] lack of governance has led to an ad-hoc alignment of [test and evaluation] efforts for the systems JCWA encompasses. This will result in fielding capabilities without demonstrating or understanding their contribution to JCWA operational effectiveness, suitability, or survivability,” the report said. “USCYBERCOM has not designated an Operational Test Agency to define and develop metrics needed to conduct integrated JCWA‑level OT&E. T&E strategies and processes are maturing, but not fast enough to support initial delivery of capability and features.”

Following criticism from government agencies and Congress, Cyber Command created a JCWA integration office and a JCWA capabilities management office. Moreover, to address interoperability concerns, Cyber Command created a concept of operations that defines a vision for employing and integrating various capabilities.

Despite these efforts, DOT&E said both the integration office and the capabilities management office lack authority or resources to effectively manage JCWA activities.

“Each program has different release and deployment schedules and there are no validated JCWA‑level mission thread requirements or plans for an integrated JCWA-level operational test,” the report said.

Cyber Command declined to comment on the report.

While Cyber Command does possess some level of acquisition authority, it continues to rely on the services as executive agents to procure major tools, systems and infrastructure that will be used by all cyberwarriors across the Department of Defense.

Officials have acknowledged ongoing integration challenges.

“We are evolving and we are beginning some initial direct integration across the different programs,” Col. Ben Ring, director of the JCWA, said in November. “You’re integrating across multiple services, multiple programs, and each of the services — they have different personnel systems, different training systems, and trying to bring that together is working, we’re evolving. But it’s, as you can imagine, it’s taking some time to bring that together. We’re continuously gathering feedback from the force and continuing to evolve, as we are one team to try to achieve unified mission.”

However, the effort overall is rapidly evolving with constant improvements and iterations.

DOT&E did note that in fiscal 2020, the JCWA integration office initiated the development of a test and evaluation strategy establishing multiple working groups to inform test infrastructure requirements and develop test scenarios based on mission threads. However, that strategy is still maturing and needs greater support from Cyber Command and the services, DOT&E said.

What’s more, the report asserted that each of the programs are developing test and evaluation strategies independent of the JCWA’s, which could lead to inefficiencies and test inadequacies.

DOT&E recommended the Pentagon identify, resource and empower a JCWA acquisition management organization to coordinate the integration of capabilities.

The International Institute for Strategic Studies’ Military Balance+ database, which evaluates global military trends, sought to provide a breakdown assessing the military cyber capabilities of these nations based mostly on active duty military forces with a responsibility for cyberspace operations (though some data was gathered on reservist units).

According to the report, 33% of Russia’s military cyber forces are focused on effects, compared to 18.2% of Chinese military forces and 2.8% of U.S. forces. This data was derived from the composition of principal cyber forces according to roles assigned to individual units.

Authors of the report clarified that “effects” generally refers to actions to deny, degrade, disrupt or destroy as well as those conducted by proxies in conjunction with a government actor. It can also include a range of other capabilities such as the ability to research vulnerabilities, write or use malware, and maintain command and control through exploits.

“Russia is a highly capable cyber power. Cyber capabilities are part of a broader framework of information operations, and strategic documents generally refer to cyber security under the rubric of ‘information security,’ ” the Military Balance report read.

In July 2021, Russia released an update to its National Security Strategy, devoting a section to information security and stressing the further development of military cyber forces and capabilities.

The IISS report noted that China has also shown significant improvements in its military cyber capabilities over the last decade, integrating offensive cyber operations into recent military exercises.

Russia also allots a significant amount of personnel to incident response, the report noted, with 80% of its forces dedicated to the mission. That is compared with 29% on the U.S. side and 9.1% on the Chinese side.

All three nations dedicated roughly the same proportion of forces to conducting cyber intelligence, surveillance and reconnaissance, hovering between 50% and 54%.

While companies began announcing their individual contracts in January, the Pentagon’s Joint Artificial Intelligence Center only confirmed the awards in a Feb. 10 statement to reporters.

The test and evaluation blanket purchase agreement on behalf of the Joint Artificial Intelligence Center is intended to establish a decentralized mechanism for artificial intelligence test and evaluation, creating criteria, performance metrics, standards and best practices for automated testing of artificial intelligence-enabled systems. Moreover, the agreement will focus on ensuring compatibility and standards for AI testing efforts across DoD.

Specific categories under the agreement include:

• Test technology and tools;
• Data set development/curation;
• Test harness development;
• Model output analysis;
• Test planning;
• Documentation;
• Reporting;
• Testing Services;
• Targeted test and evaluation and independent verification and validation;
• Algorithm test and evaluation;
• System test and evaluation;
• Operational test and evaluation;
• Human factors/user acceptance test and evaluation, and;
• Project management

Of the 79 companies awarded under the agreement, 44 are small businesses and 35 are large businesses, according to a spokesperson. They added that the agreement will foster competition in which both the government and private industry partners will mutually benefit from the streamlined methodologies implemented during this acquisition strategy.

The JAIC was created in 2018 to serve as a clearinghouse for all the DoD’s artificial intelligence efforts. In a December reorganization, the DoD created a chief digital and artificial intelligence officer to oversee the JAIC as well as the Defense Digital Service and the DoD’s chief data officer in an effort to better streamline digital efforts.

The Army has adopted an incremental, multiyear strategy to modernize its network and deliver new capabilities to soldiers. These service plans to field new “capability sets” with upgraded technologies every two years, each one building on the last. Capability Set ‘21 focused on infantry brigades, with Capability Set ‘23 focusing on Stryker brigades and Capability Set ‘25 focused on armored brigades.

Capability Set ‘23 is expected to reach critical design review this April, which will lead to a procurement decision. To get there, the Army needs to conduct a series of tests to ensure the technologies are ready, and it’s tweaking those tests based on the lessons learned from testing and fielding Capability Set ‘21, Maj. Gen. Robert Collins, program executive officer for command, control, communications-tactical, told C4ISRNET during a visit to Aberdeen Proving Ground in Maryland Feb. 2.

One of the biggest lessons learned from the Capability Set ‘21 effort was how to set up the test in order to get better data.

“How do we instrument each one of these nodes, collect the types of traffic, whether it’s message completion, whether its demands and really characterize that,” Collins said.

The instrumentation tools will allow the Army to harvest data, synthesize it and see how it performed.

New instrumentation tools were built by the Army Command, Control, Computers, Communications, Cyber, Intelligence, Surveillance and Reconnaissance Center that allowed testers to see the entire network, which didn’t exist for Capability Set ‘21. That data allows the Army to do proper analysis and demonstration, ensuring what they’re building fits the Army’s needs.

The Army also built out robust mission threads for the technical test to see if a piece of equipment would deliver the needed network capabilities in multiple operational scenarios. Mission threads focused on the following capabilities:

• Voice, which focused on analog and digital voice communication;
• Situational awareness and command and control data exchange, which focused on messages and location information exchanged by various platforms;
• Data exchanges between electronic warfare and signals intelligence tools that focused on how they pass data of various classifications across the network;
• Call for fires, which focused on passing data from dismounted and mounted fires platforms across aspects of the network, and;
• Point to point data exchanges;

Officials said the scenarios were critical to helping get the analysis they needed, allowing them to see how a unit fights with the network over multiple types of events from a threat perspective. Given that it was a technical test, they could inject a simulated threat, which is more difficult during an operational test where soldiers are conducting an exercise.

Test strategy

Officials said that following the critical design review, they will undertake a series of operational tests and experiments with units to inform a fielding decision involving what capabilities go to what units at what echelons. This is part of a multifaceted codified test strategy the Army is developing for its network, something it’s been criticized for not having already. While a multifaceted testing approach was used during the Capability Set ‘21 process, it’s been enhanced for Capability Set ‘23 based upon feedback from around the military, new tools and more mature technology.

“The overall strategy … is a series of operational activities that will lead up in support of the procurement and the fielding decision,” Collins said.

Developmental tests will be conducted on specific components with an eye toward interoperability and integration. Then there will be threat-based tests that include cyber and electronic warfare. These will be phased operational readiness assessments and exercises that will take place in Europe allowing the Army to understand if Capability Set ‘23 is ready to physically give to units.

A fielding decision is expected in March 2023.

The Army has adopted a multiyear strategy involving the incremental development and delivery of new capabilities to its integrated tactical network. Those “capability sets” now provide technologies to units every two years, each building upon the previous delivery. Capability Set ‘21 was primarily designed for infantry brigades; Capability Set ‘23 is focused on Stryker brigades, and Capability Set ‘25 is focused on armored brigades.

Officials said Capability Set ‘23 begins to set the foundations for the Pentagon’s new concept — Joint All-Domain Command and Control — which seeks to seamlessly connect sensors and shooters to share information across services and domains while enabling faster decision-making.

Features and capabilities that are being added to this iteration of the network set the stage for enhanced situational awareness, greater tracking of troops on the battlefield, better transport of data – secure but unclassified, secret and top secret – from the tactical edge to the command post, and the automatic transition of communications pathways referred to as PACE, or primary, alternate, contingency and emergency.

The latter is an important component of military communications capabilities officials have discussed for several years, equating it to the way cell phones seamlessly transition from WI-FI to cellular network when the user leaves their home without any action taken by the user. In the field, this means that if a vehicle or system’s connection to its primary form of communication is unsuccessful for whatever reason, it will automatically switch over to the next available communication pathway. This allows the soldiers to be much more mobile and focused on their mission rather than having to be constantly fiddling with buttons to get on the right radio or waveform. In addition, soldiers can now turn the radios in their vehicle off to conserve power, connecting to the WI-FI in their Stryker as they transit from one place to another.

While Capability Set ‘21 provided units a level of situational awareness on the battlefield not previously realized, Capability Set ‘23 provides the first mounted and dismounted situational awareness capability, providing a common operational picture and mobile command posts that significantly improve the understanding of troop locations on the battlefield. It is also the first time that the command post can connect via line-of-sight to other platforms and automatically switch to satellite communications if that link is broken.

The command vehicle, a Stryker where the battalion or brigade commander resides, has a variety of situational awareness tools to see their troops on the battlefield.

Additionally, a new revolutionary tool is being introduced to the network that allows dismounted soldiers to call for fires. Previously, soldiers would have to use a mounted tool, and there was a lot of human input and verification prior to issuing a fire to ensure there weren’t any friendly soldiers in the area. With Precision Fire-Dismounted, soldiers can plan targets and send information back through the network that tracks their exact location, making the process faster, more seamless and leading to less friendly fire.

“I would argue this is the first real step towards a true JADC2 environment that we’re getting after here,” said Col. Gregory Napoli, the unified network lead for the Network-Cross Functional Team.

When it comes to sharing this common operational picture with other services, officials said they need a data fabric, which is not a single solution, but a federated environment that allows information-sharing among various forces and echelons. While the other services won’t have the same exact systems as the Army, as long as the data can be shared over networks they can attack the same targets. Officials said this is what the Army has sought to do with Project Convergence.

Officials also explained they are now beginning to fold in electronic warfare and intelligence systems into the Army’s network as part of Capability Set ‘23. That includes the forthcoming Terrestrial Layer System, the Army’s first integrated electronic warfare, signals intelligence and cyber platform mounted to a Stryker;

It also includes the Electronic Warfare Planning and Management Tool, or EWPMNT, a software interface that serves as a command-and-control planning capability, allowing forces to visualize the potential effects of electronic warfare in the field and chart courses of action to prevent jammed capabilities. While the Army initially expected EWPMT to reside in a command post, officials realized they needed that capability inside the vehicle to process data at the edge.

“The key thing you’re getting here that we didn’t have before is you’re getting real time data from the soldier, from the platform, back to the command post,” said Kenneth Strayer, project manager for electronic warfare and cyber within Program Executive Office for Intelligence, Electronic Warfare and Sensors. “In the old days, even if you collected data, you’d have to manually move it from the soldier to the platform, manually move it from the platform to the command post. The ability of the commander to see this in near real time is the greatest advantage.”

Commanders will now be able to plan and visualize what they previously couldn’t see and to better understand how communications could be jammed.

And given that TLS is both an electronic warfare and a signals intelligence platform, it needs to work with data at both the secret and top secret classification levels. In the past, the Army has relied on an intelligence network to move that data, which presented a number of challenges.

“We relied on the intel network and it’s worked for us, but it’s a single network, single point of failure for us with limited bandwidth and the ability to move that data off that network is really impossible,” Strayer said.

Now, the Army has created a PACE plan for that data by linking it to the Army’s overall battlefield network. This requires what officials call “colorless transport” which means data of all classifications can flow over the network with proper automated controls to ensure the right people are seeing the data.

Adding these tools will require more bandwidth, and the Army is working with network management tools to prioritize what information is sent at what time.

“In a certain part of the mission, they may want to prioritize some of those intel and electronic warfare resources. You start to capture some of those demands on the network, now you can help our communicators, our signaleers, work with the commander to prioritize those,” said Maj. Gen. Robert Collins, program executive officer for command, control, communications-tactical.

This intelligence and sensor data will now be able to feed into a true common operational picture, officials explained, further contributing to the notion of JADC2 and multi-domain operations.

This level of data integration has not occurred before. Now, commanders will be able to have a more holistic picture of the battlespace.

Deputy Secretary of Defense Kathleen Hicks directed the realignment of the Cybersecurity Maturity Model Certification from the undersecretary of defense for acquisition and sustainment to the CIO Feb. 2.

CMMC seeks to create new standards and controls for defense contractors as a means of better protecting data from being exploited by foreign hackers. It is based upon a tiered cybersecurity framework that grades companies on a scale of one to five based on the level of classification and security necessary for their work. It was initially conceived of to fight contractor information being exploited by adversaries. Officials have previously said adversaries cost the country $600 billion a year in cyber theft.

“As we realign responsibility for the program, it’s important to note that we will continue to work closely with A&S on this program,” DoD CIO John Sherman said in a statement.

The realignment — which moves six DoD civilians along with contractor support — will increase CMMC’s integration with other defense industrial base cybersecurity programs, Sherman said. During the coming weeks, the CIO will begin submitting proposed changes to the Defense Federal Acquisition Regulation Supplement rule-making process to ensure proper collaboration on requirements with these other efforts.

DoD has sought to consolidate a variety of industry related cybersecurity programs under common leadership to maximize collaboration, the department noted in a statement.

This move follows a November 2020 decision to revamp CMMC, announcing CMMC 2.0. That initiative included enhancements to the initial program first developed during the Trump administration, such as simplifying the standard with additional clarity on regulatory, policy and contracting requirements, focusing the most advanced cybersecurity standards and third-party assessment requirements on contractors supporting the highest priority programs, and increasing oversight of professional and ethical standards.

After a series of high profile hacks and breaches, the NSA had to “up its game,” officials said. It established the directorate as a means of using its unique intelligence capabilities to share threat information with companies and the defense industrial base in a timely fashion to ensure they stay ahead of the most sophisticated threats.

“Since we established the cybersecurity directorate a little over two years ago, we’ve been doing great things. We’ve been using intelligence and letting it drive risk mitigations and building up partnerships,” Neal Ziring, the directorate’s technical director said during a virtual presentation Feb. 1 hosted by INSA. “How do we do that at greater scale? How do we expand what we’ve been able to do with the defense industrial base, for example, from 100 companies to 1,000 or even 10,000? How do we start getting cyber threat information out to lots and lots of partners and doing it at relevant speed?”

In times of heightened international tensions, such as the current imbroglio with Russia, Ziring said cyber threats can increase.

Working with other federal partners such as the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency and the FBI, Ziring said his organization has used its unique intelligence insights to provide a fuller picture of what adversaries are doing and help defeat them.

“One of the things we’ve done in that regard — directly as a result of these heightened tensions — is issuing additional guidance published on nsa.gov. We’re published jointly with CISA, FBI and others about specific threats and tradecraft of Russian actors and how to secure some of the systems that they tend to go after,” he said.

Securing artificial intelligence and machine learning

As more Department of Defense entities are looking to incorporate machine learning and artificial intelligence into their practices and systems, NSA is in the beginning stages of understanding the security needs required to do so. NSA will be digging deeper under the hood to understand the security vulnerabilities across the entire lifecycle for applying machine learning or artificial intelligence into a system — such as a driverless vehicle — Ziring said, citing an example of how DoD might employ such technologies.

Currently, it’s not clear if traditional security measures with normal software would be enough to secure these technologies.

“An AI or ML system can be so dependent on the things you do early in the lifecycle, like gathering training data and training initial models. We have to extend our security thinking back into those stages,” Ziring said. “That will be a focus for us in the next few years, is thinking about how we can do that, do it better and then advise our customers as they adopt that technology, how to do it secure.”