Inside an unassuming office building, a few floors up and tucked into a spread of austere rooms, is Operation Cyber Dragon. The brainchild of Chief Warrant Officer Scott Bryson, the hands-on endeavor authorized by U.S. Fleet Cyber Command aims to fix virtual vulnerabilities — shoring up systems bit by bit — while also fostering a new wave of cybersecurity expertise.

“We’re doing it so that we can continue to mitigate and fortify our attack vectors and secure our networks even better,” Bryson told reporters July 22, while standing among computers, cubicles and colleagues.

Cyber Dragon kicked off in March, with the second phase of the program now underway. In its current form, the operation is focused on fortifying unclassified networks and rooting out common, widespread digital weaknesses: lax security settings, easily guessed credentials, unpatched software and more.

Doing so, officials said, makes its more difficult for hackers to break in and wreak havoc. According to the Navy, some 14,500 issues were initially identified on service networks as in need of addressing. Each could be a foothold for an adversary, especially at a time of heightened cyber conflict. Deputy Chief of Naval Operations for Information Warfare Vice Adm. Jeffrey Trussler in a February memo warned sailors that “cyberattacks against businesses and U.S. infrastructure are increasing in frequency and complexity.”

To tackle such a large and evolving workload, manpower was needed. So Bryson turned to the reserves, including to people not necessarily cyber fluent.

“I went to the reserve forces that we have at 10th Fleet, and I requested some bodies, and I came up with a training plan. And I said, ‘Well, if you give me X amount of sailors for X amount of days, I think that we can get after a percentage of our vulnerabilities, patching and scanning.’ The reserve force came through with the manning, they came through with the space,” Bryson said.

“When we did the posting, it wasn’t limited,” he added. “I said I’ll take anybody.”

Among the dozens of participants were, by day, a long-haul truck driver, a banker and a small-business owner. The operation offers reservists the chance to fulfill annual training requirements while also making a tangible difference.

Cyber Dragon teams have thus far identified and remediated thousands of issues — everything from several “high-profile exposures” to default usernames and passwords to discovering “data where we didn’t want data to be,” according to officials involved with the effort.

“A default username and password means that anybody could could log in and execute on here, on these particular machines. Now, they weren’t national security-related. There was no major issue directly to national security,” said Rear Adm. Steve Donald, the deputy commander of Fleet Cyber Command/U.S. 10th Fleet. “But in some cases, it could have caused harm to individuals, identity theft or something of that nature. We were able to shut that down.”

Teams have also zeroed in on potential spoofing certificates, risky software use and cloud management hiccups. Some 50 sailors have been trained on state-of-the-art attack surface management software, used to discover, classify and assess the security of an organization’s assets, with 100 more expected to undergo the same education in the coming months.

Lt. Blake Blaze, a reservist with a cyber and tech background, said the operation has improved both his understanding of the field and the cybersecurity of the Navy.

“My biggest motivation for staying in the reserves was I wanted to be close to the fight in case things get interesting with some of our near-peer adversaries,” Blaze said. “We’re not directly engaging with the enemy, so to speak, but we are trying to prevent their avenues of access to our networks.”

Both Bryson and Donald said they foresee a bright future for Cyber Dragon. As long as there are bugs to fix and the will to fix them, they said, the operation is viable. And Cyber Dragon’s format makes it mobile and replicable, appealing to workspaces and workforces of all sizes across the U.S.

All that’s really needed is floor space, network connectivity and a few tools from third-party vendors.

“The interesting thing in the IT world or the network world is what’s patched and 100% compliant today might not be patched tomorrow, because vulnerabilities ebb and flow,” Bryson said. “So do I think that this has legs to continue on? Absolutely.”

The U.S. Cybersecurity and Infrastructure Security Agency and its Ukrainian counterpart, the State Service of Special Communications and Information Protection, announced the deepened partnership at the end of July, calling it an important step toward a more secure future.

Priorities of the agreement include the exchange of best practices, studying how critical infrastructure is guarded, and establishing joint cybersecurity projects and exercises.

Both the U.S. and Ukraine participated in the NATO Cooperative Cyber Defence Centre of Excellence’s Locked Shields exercise in April. Specialists with U.S. Cyber Command have also worked alongside Ukrainian forces to fortify networks and root out malicious behavior.

Oleksandr Potii, the deputy chairman of the SSSCIP, in a statement said the new accord “represents an enduring partnership and alignment in defending our shared values through increased real-time information sharing across agencies and critical sectors and committed collaboration in cultivating a resilient partnership.”

CISA Director Jen Easterly applauded the agreement — saying she was “incredibly pleased” to sign it — and noted that she has been “moved by the resiliency and bravery of the Ukrainian people throughout this unprovoked war.”

Russia’s latest invasion of Ukraine, launched Feb. 24, was preceded by cyberattacks, including one on Viasat, a California-based company involved in commercial and military markets worldwide. The digital attack was meant to cripple Ukrainian command and control as Russian forces advanced. U.S. government clients were unharmed.

Some five months on, cyberattacks continue in Ukraine, with hackers mostly focused on the defense, government, finance and telecommunications sectors, according to a July 12 bulletin from the SSSCIP. Russia has historically denied involvement.

President Joe Biden in March warned of Russia potentially targeting U.S. networks and critical infrastructure as its fight flounders. The U.S. Navy also cautioned in an unclassified memo that adversaries are seeking to exploit digital vulnerabilities, like weak passwords and mistakes made on military or at-home, private networks.

“Cyber threats cross borders and oceans,” Easterly said in a statement, “and so we look forward to building on our existing relationship with SSSCIP to share information and collectively build global resilience against cyber threats.”

Feared attacks on U.S. assets, though, have yet to materialize.

Australia is investing millions of dollars into research and development to close gaps in the country’s cyber defense apparatus, they told the Australian Defence Science, Technology and Research Summit in Sydney on June 20.

And while the talent pool for workers with for AI and machine learning in Australia is deep, Anton van den Hengel, director of the Centre for Augmented Reasoning at the Australian Institute for Machine Learning, said their are simply not enough jobs and career opportunities in the country to keep them at home.

“We’ve made very little — very little — progress towards artificial intelligence,” he said.

The U.S. faces a critical cyber labor shortage, with some 700,000 cybersecurity positions open nationwide, according to estimates from the White House. More than 35,000 job openings are currently posted on the Indeed hiring wesbite using the search term “Artificial Intelligence.”

Van den Hengel, who also works as a director of applied science at Amazon, and other industry leaders at the summit pointed to the government’s inability to compete with tech companies as a major issue when expanding the country’s AI abilities. In both the U.S. and Australia, governments come up against the draw of private industry, creating high salary costs and other the hurdles to attracting and retaining talent.

“Defense no longer has the best tech,” he said, noting that private companies have committed billions of dollars to develop technologies and have the open positions to attract workers in the AI field.

The Defence Science and Technology Group, a part of the Australian defense department aimed at providing science and technology support to national security interests, hosted the summit.

Private-sector competition intensifies for AI talent

With high salaries and access to breaking-edge technologies, the private AI field has become increasingly lucrative. In recent years, many western counties, including the U.S., have turned to the private sector to compete with investments made by China.

Van den Hengel said outsourcing to the private sector only goes so far. Governments have to try and keep track of the technologies coming out of companies while also trying to understand them deeply enough to figure out their defense applications, he said.

In November, the Australian government said it would invest $10 million in innovative AI tech. The move followed the September announcement that Australia would partner with Britain and U.S. in a new working group, known by the acronym AUKUS, to share advanced technologies, including AI.

Kate Devitt, the chief scientist of Trusted Autonomous Systems, said Australia specifically needs experts in the field of deep learning and natural language processing compared to companies such as Google and Meta as well as specialists in reinforcement learning.

“We lack the digital infrastructure and investment required to enable the human capital with these skills to flourish in universities,” she said. “These gaps make Australia vulnerable and dependent on the choices of our allies and our rivals.”

Trusted Autonomous Systems is Australia’s first defense cooperative research center. It partners the country’s defense industry and research organizations with Australia’s defense department to develop autonomous and robotic technology.

While Devitt said the “obvious” answer is more investment in technical AI capabilities and infrastructure, she said that Australia needs to be decisive in its investments. As a medium-sized country, the government must use its limited resources to make “scrappy” decisions that yield outsized impacts, she said.

The measure, championed by retiring Rep. Jim Langevin, a Rhode Island Democrat, would designate certain critical infrastructure entities as “systemically important” for the wellbeing of the U.S. and establish new avenues for information sharing, risk management disclosures and rapid responses to digital intrusions, among other steps.

“In the nearly 22 years that I’ve served in Congress, we have come a long way in cyberspace,” Langevin said in a statement following the 329-101 House vote. “When I was elected in 2000, nobody was talking about cybersecurity.”

As many as 200 entities could initially be named, according to the language of the measure, with room for 150% more in four years. Entities could appeal placement on the list.

The vast majority of stateside critical infrastructure is stewarded by the private sector, with assets ranging from communications to chemicals, dams to the defense industrial base. Their destruction would debilitate U.S. economic security, public health and safety, according to the Cybersecurity and Infrastructure Security Agency.

Russia’s February invasion of Ukraine trained a spotlight on critical infrastructure and related digital vulnerabilities.

Lawmakers and analysts warned of potential cyberattacks on American assets — physical and virtual — and CISA issued a so-called Shields Up notice, urging heightened online awareness. The longer the Russia-Ukraine war grinds on, the more likely Moscow will act belligerently in cyberspace, according to Neal Higgins, deputy national cyber director for national cybersecurity.

The measure included in the House’s defense policy package is an offshoot of work done by the Cyberspace Solarium Commission, a bipartisan group assembled to analyze and improve U.S. cybersecurity. Its flagship report, published in 2020, included a recommendation that Congress codify systemically important critical infrastructure, also known as SICI.

“Both the private sector and the U.S. government have a vested interest in protecting these systems and assets and have unique responsibilities for their security and resilience,” the report stated.

Langevin was a member of the commission.

The other transaction authority agreement, announced July 13 by the U.S. Army, runs through October 2023. Lockheed will provide prototypes mounted into Stryker combat vehicles ready for operational assessment and issuance to an initial unit.

The TLS-BCT is considered a next-generation platform for the Army that brings the service one step closer to satisfying the joint all-domain operations philosophy, a holistic approach to planning and fighting. The system is designed to boost awareness and offer troops more offensive options that can deny or degrade enemy systems.

Officials have said the TLS-BCT will help defeat contemporary threats on an increasingly digital battlefield. Modern warfare often revolves around control of the electromagnetic spectrum, which is relied upon to communicate with allies and identify and suppress adversaries.

“The new integrated suite of signals intelligence, electronic warfare, and cyberspace operations provides the warfighter with critical situational awareness of the enemy through detection, identification, location, exploitation, and disruption of enemy signals of interest,” said Ken Strayer, the project manager for electronic warfare and cyber at the Army’s Program Executive Office for Intelligence, Electronic Warfare and Sensors.

The deal announced Wednesday is the latest advancement in the effort, and marks another win for Lockheed.

The Maryland-based aerospace and defense company in September won a $9.6 million second-round contract, beating out Boeing subsidiary Digital Receiver Technology and allowing it to continue development.

At the time, Lockheed said it would spend a few months finalizing hardware and software designs based on previous experience and soldier feedback.

Deon Viergutz, vice president of Lockheed’s spectrum convergence division, on July 14 said he and his team were “pleased to continue” their partnership with the Army and its program “that will help soldiers operate effectively within the electromagnetic spectrum.”

“TLS-BCT is an example of Lockheed Martin’s 21st century security vision in action, taking a cutting-edge program from concept to fully fielded prototype under an aggressive schedule to put this important capability into the hands of the warfighter, helping them be ready for future mission needs,” Viergutz said.

The Army this year identified a power problem associated with new networking tools and older Strykers during a live-fire exercise in Germany. Officials on June 23 told reporters the matter was under investigation and would be fixed, and that a solution may already exist with newer variants.

The Program Executive Office for Ground Combat Systems, which works with Strykers, was looped in to help.

Speaking during a C4ISRNET webcast, Kenneth McNeill said an initiative called “Bring Your Own Approved Device” would allow guardsmen to use personal mobile equipment to perform the same functions in the field that they would otherwise carry out at a desktop in their offices.

“In a typical state, all of our guardsmen, unfortunately, they may not have government-furnished devices — mobile cellphones, iPads,” McNeill said. “It cuts down on time when we’re planning for a mobilization.”

The initiative, which is a collaboration with the Department of the Army and the Pentagon’s cybersecurity office, is in its third phase of a pilot program consisting of a yearlong trial with the largest sample size to date. After this trial, if deemed successful, the initiative will be enacted, McNeill said.

Work began on the initiative before the pandemic, which drove a transition to remote work. The realities of the situation forced the Guard to accelerate its efforts.

“This is another tool in the toolkit that will give us an opportunity to allow our workforce, even after the pandemic, to continue to telework and [perform] remote work that is critical in the National Guard,” McNeill said. “I don’t think we’re going back [to] everyone in the office. I think this is the future of how we’re going to operate here in the government and in the Department of Defense.”

While deployed to the streets of Washington, D.C., following the Jan. 6 insurrection on the Capitol, the National Guard employed a similar capability called Commercial Virtual Remote to carry out the mission that was limited in scope and time.

“Now we will have a capability that really links our force, even before they are called up for deployment,” he said. “This will be a game-changer.”

JADC2

McNeill also discussed an addition to the Joint All-Domain Command and Control concept being implemented by the DoD that would focus on the needs of the National Guard’s mission set. Called “Project Homeland,” the initiative would apply the same capabilities of JADC2 to the domestic front.

JADC2 is a project by the Department of Defense to connect all the sensors from the individual services and compile data collected into a single information network. Previously, each service had their own tactical networks that were unable to interface with each other.

“JADC2 is a warfighting necessity to keep pace with the volume and complexity of data in modern warfare and to defeat adversaries decisively,” the department said in a statement. “JADC2 enables the Joint Force to ‘sense,’ ‘make sense,’ and ‘act’ on information across the battle-space quickly using automation, artificial intelligence (AI), predictive analytics, and machine learning to deliver informed solutions via a resilient and robust network environment.”

Project Homeland would apply those same capabilities during domestic deployments across the 54 states and territories National Guard units and their civilian interagency partners as opposed to the military services and their coalition forces.

McNeill spoke to the challenges the National Guard faced during their humanitarian relief operations post Hurricane Katrina. On the ground, the Guard was unable to talk with the local first responders because they did not have cross-banding communication systems.

“We learned from that experience that we’ve got to think out of the box,” McNeill said. “We’ve got to look at capabilities that can talk to first responders and focus on what we do in the homeland.”

Their target – critical Ukrainian government data.

As the multi-pronged invasion commenced, cruise missiles struck a Ukrainian governmental facility housing servers full of important data. At the same time, Russian cyber operatives conducted “wiper attacks” on computer networks – attempting to delete all the stored information.

Despite the sophisticated and holistic nature of the Russian attack, the Ukrainian data survived the onslaught. For a week earlier, it had been virtually smuggled out of the country. The data which had once singularly been stored on physical servers, had been uploaded to the cloud.

“The key to a country’s digital resilience in wartime is the ability quickly to move data outside the country while still connecting to and relying on it for a government’s digital operations,” according to a report from Microsoft on the cyber lessons of the Ukrainian war. “One reason these kinetic and cyberattacks have had limited operational impact is because digital operations and data have been disbursed into the public cloud,” it said.

Microsoft, which competes with Amazon, IBM, Salesforce and other software and computer networking companies in providing cloud services to governments, published the report, “Defending Ukraine: Early Lessons from the Cyber War,” on June 22.

Prior to the Russia-Ukraine war, a data protection law prohibited the Ukrainian government from utilizing the cloud to store and process data, forcing all the data to be centralized and vulnerable, according to the report. The law was amended just days before the invasion to permit the very same information to be housed on the cloud.

The cloud is a system of decentralized, networked computer servers spread out all over the world. Stored data, often encrypted and secure, is housed in duplicate across multiple servers and can be accessed via the internet from any location. The redundancy means that even if one server is destroyed, the data is not lost because it is copied elsewhere.

Governments around the world have been exploring the idea of adopting the cloud for official use. The Pentagon awarded Microsoft a contract for just that reason in 2019 before rescinding it less than a year later. New DoD contracts for cloud computing are expected to be awarded this year.

“It’s also important to think about the longer-lasting lessons that come from these efforts,” the Microsoft report said. “The last few months in Ukraine illustrate the very different defense needs that prevail during a war.”