In a report released by SolarWinds — an IT management and software company who contracted Market Connections to conduct the survey — 56% of respondents said the general hacking community was one of the largest source of security threats at public sector organizations, followed by careless or untrained insiders at 52% and foreign governments at 47%.

400 IT decision makers responded to the online survey conducted in Oct. 2021 — 200 from the federal level, 100 from the state and local level, and 100 more from the education level. A majority of the respondents worked at civilian federal agencies, with the next highest cadre coming from the Department of Defense. Nearly half of the participants were IT staff, with IT director/manager the second largest portion of respondents and security staff making up a distant third. Others included chief information and technology officers, chief security and information security officers.

According to the report, participants from state and local governments were significantly more likely to be concerned about the threat from the general hacking community than those working for federal civilian agencies, who were more likely to indicate careless insiders as a top threat.

DoD employees, however, were more likely to list foreign governments as the top threat.

“Public sector organizations are increasingly concerned about the threats from foreign governments,” said Tim Brown, CISO and Vice President of Security at SolarWinds. “In looking at the survey data, it’s encouraging that a majority of the public sector is actively seeking to follow the roadmap outlined in the [Biden] Administration’s Cybersecurity Executive Order, including enhanced data sharing between public and private sectors.”

Public sector respondents’ concern over ransomware, malware and phishing increased the most over the last year.

A plurality of respondents, 30%, listed budget constraints as the biggest obstacles to maintaining or improving IT security. Insufficient training of IT staff, shortage of funding and resources and the expanded security perimeter created by remote or hybrid work were the top three impediments listed to detection and remediation of security issues.

Leaders at the DoD and across the larger federal government have long called for filling a cyber skills gap by speeding up recruitment and ensuring competitive salaries with private sector. That need is only growing with increasing cyberattacks. All U.S. agencies had to implement a job-coding plan to document filled and unfilled cyber jobs, many for highly qualified personnel who perform information technology and cybersecurity.

The DoD was supposed to have started logging its jobs starting in 2018, but the Army was the only component with an automated quality assurance process to code its cyber workforce, according to the DoD inspector general report.

While the DoD established work role codes as required, many components did not code or incorrectly coded civilian workforce positions.

“Until the DoD Components’ application of work role codes is complete and accurate, the DoD may not have the information needed to identify and target the recruitment and retention programs to meet its greatest cyber workforce needs,” the inspector general said.

The report blacked out many mentions of specific positions and percentages of filled and unfilled positions. “With [REDACTED] percent of its filled and [REDACTED] percent of unfilled core positions not coded or coded incorrectly, the DoD may be unable to accurately determine the skill set and size of its civilian cyber workforce, which may hinder workforce planning activities, such as recruitment and retention strategies and determining the work roles of critical need.”

The acting DoD chief information officer agreed with the IG’s recommendations for components to complete work role coding by the end of 2021. The CIO is developing an automated dashboard to show components’ cyber workforce status.

A copy of the list obtained by C4ISRNET showed that Cyber Command noted the recent SolarWinds intrusion of various government networks in its request for money to help the DoD secure its own networks and respond to malicious cyber actions. The item topped a list of four unfunded priorities totaling $93.4 million.

The DoD has said that the vast SolarWinds breach of federal and business networks, attributed to the Russian foreign intelligence service, did not affect its own systems.

“I ask your committee to support these priorities … to help us strengthen military readiness and alliances, secure the homeland from cyberspace attack and advance national interests,” Gen. Paul Nakasone, commander of Cyber Command wrote in the proposal.

Cyber intrusions and ransomware incidents are rising to epidemic status, according to some cybersecurity analysts, leading the federal government to prioritize response efforts.

In fact, the largest slice of the Pentagon’s $10 billion cyber request asked for $5.6 billion to protect IT systems.

Cyber Command’s No. 2 unfunded priority is $23.3 million for cyber training. The command, through service acquisition executives, is building an online training system called the Persistent Cyber Training Environment, which allows forces to conduct individual and collective training as well as mission rehearsal.

The other two items listed are $3.2 million for human intelligence to help the command build an organic intelligence capability to access strategic targets and $4.8 million for acquisition personnel.

Cyber Command has worked for several years to establish an acquisition structure with Congress, which in 2016 authorized limited purchasing authority described as a crawl, walk, run approach to ensure the young command could get the plan up and running.

In the most recent annual defense bill, Congress eliminated the $75 million acquisition cap on Cyber Command and enhanced the commander’s authority to oversee programs and priorities. However, the services still run major programs on behalf of the command and joint cyber mission force.

The $4.8 million would go toward integrating the command’s Joint Cyber Warfighting Architecture, which guides its acquisition priorities. Congress and the nonpartisan Government Accountability Office gave the command poor marks for the architecture, citing integration and oversight problems. The command has since sought to assuage those concerns.

Defense News reporter Joe Gould contributed to this report.

“I would anticipate that as we lay out the case, we have to look at some critical elements that will influence the future size of the cyber mission force, now 133 teams,” Gen. Paul Nakasone said at a House Armed Services Cyber, Innovative Technologies and Information Systems Subcommittee hearing.

Some members of Congress are worried that the cyber mission force — designed and built almost 10 years ago — does not reflect the current dynamic state of cyberspace.

Members questioned Nakasone last year on the topic, and he said Cyber Command would gather information for Pentagon leaders to make appropriate staffing decisions.

In fact, the congressionally mandated Cyberspace Solarium Commission recommended the Department of Defense create more cyberwarriors. That provision made it into last year’s National Defense Authorization Act in the form of providing a comprehensive assessment cyber operations forces as part of changes to the department’s quadrennial cyber posture review.

Nakasone told the committee today that he does have the data available to make such a determination.

“To prepare for the approved growth in the CMF, we will enhance our control over resources for the force, improve its readiness (including the metrics we require in doing so), and consolidate CMF training,” Nakasone wrote in congressional testimony provided to the Senate Armed Serves Committee in March and to the House Armed Services Committee on Friday. “Recent demand across DoD has demonstrated that the original 133 teams in the CMF are not enough. The strategic environment has changed since the original CMF was designated in 2012. Added forces will ensure USCYBERCOM can fulfill its responsibility as both a supported and a supporting command.”

A Department of Defense spokesperson told C4ISRNET that those specific numbers have not been released publicly.

Currently, there are 6,187 authorized positions for the cyber mission force with 238,000 personnel in the DoD’s cyberspace operations forces, which includes the cyber mission force, Cyber Command subordinate command elements, cybersecurity service providers, special capability providers, and specialty units, Nakasone said, drawing from the 2018 cyber posture review.

Those cyber mission force teams have undergone changes over the years to adapt to threats, allowing the freedom for commanders to task organize their teams as necessary. For example, in Nakasone’s written testimony, he noted how several teams were initially aligned to the counterterrorism fight, but with the department’s shift toward state actors, Cyber Command has realigned some units to focus on key nations.

One such example is its counter-Islamic State group task force, Joint Task Force-Ares. Cyber Command shifted the majority of the task force to focus more on nation-state actors, particularly in the Indo-Pacific region.

Nakasone told representatives that there are a few other factors that will affect the growth of the cyber mission force; chief among them is the growing importance of space.

The creation of the Space Force and Space Command adds more ground for Cyber Command to cover. The way the cyber force is staffed within the DoD is that each of the services are responsible for providing a set number of teams — offensive, defensive and intelligence/support teams — to the joint cyber mission force.

In turn, these teams are led by a Joint Force Headquarters-Cyber, which are headed by each of the service cyber component commanders, who them plan, synchronize and conduct operations for the combatant commands to which they’re assigned. The 16th Air Force and its Joint Force Headquarters-Cyber component takes responsibility for Space Command, which is in the process of creating its own Joint Cyber Center to create a tighter linkage with Cyber Command.

While all the services provide an allotted number of forces to Cyber Command through the cyber mission force, officials to date have said there are no plans for Space Force to provide cyber mission force contributions. Instead, officials have noted that they need specialized, serviced-retained cyber personnel to defend their critical assets, such as ground stations, from cyberattacks.

Adversaries are now using cyberspace in ways that weren’t necessarily imagined when the force was initially conceived. Namely, they’ve discovered they can conduct operations below the threshold of war to undermine U.S. national security and not draw a significant response.

“We have to have that balance of not only, what we are going to support our fellow combatant commands if conflict was to break out, but also if our adversaries are operating below the level of armed conflict every single day, what type of force do we need to be able to ensure that we can counteract that,” Nakasone said.

The executive order signed Wednesday touches on many issues that the Defense Department is weighing to ensure adequate protections among its vast information technology supplier network, an effort driven in large part by lawmakers’ alarm over recent high-profile government network compromises. For example, lawmakers ordered the DoD to assess programs to share cybersecurity information with the defense industrial base and to consider the possibility of a threat-hunting program on vendors’ networks.

The security of the military’s most sensitive information, such as weapon controls and service members’ locations, rides on its cyber protections.

The Biden administration is trying to eliminate any hesitation or contractual barriers that might prevent IT providers from sharing cyber threat information with the government.

“Federal agencies can’t defend what they can’t see,” a senior administration official said during a call with reporters the day Biden approved the plan. “Removing barriers to information sharing regarding threats and incidents is a fundamental first step to preventing breaches in the first place and empowering the federal government to respond when they do occur.”

The order follows a raft of major cyber breaches and compromises over the last year, including the wide-ranging, Russian-orchestrated Solar Winds intrusion of federal systems that compromised the supply chain; a Chinese-orchestrated operation that compromised Microsoft Exchange servers globally; and a ransomware attack against Colonial Pipeline that is affecting gas supplies. Officials said the order would help detect some of these problems much faster in the future.

“Companies need to share information about the incident, the vulnerability, what occurred. We’re really focused on information that’s important to be used to get out information to better help other entities defend themselves,” the senior administration official said. “We’re really creating a common threshold across the federal government to say let’s make sure that info is shared so all can defend themselves and all can get at information to private sector stakeholders and others to enable them to defend themselves as well.”

The order requires, within six months for some agencies, advanced protections including multifactor authentication of users’ identities and endpoint detection systems that constantly monitor for malicious activity and block it.

“Fundamentally what we saw in SolarWinds was that federal government cybersecurity was not at the level needed to detect attempts to intrude and to rapidly find those that are successful,” the administration official said.

Additionally, the new order pushes the federal government to move to secure cloud services and a zero-trust architecture and mandates encryption to secure data.

In the event of a breach or lesser network problem, the order creates a “playbook” or a standard set of definitions for cyber response by federal agencies.

Software suppliers also must provide federal buyers with a “software bill of materials,” essentially a list of ingredients of what’s inside the software. John Cofrancesco, vice president of government business for Fortress Information Security, told C4ISRNET that the bill of materials was “huge.”

“Weapon systems and platforms were once thought to be disconnected standalone systems, because they were not consistently connected to a network,” Cofrancesco said. “That belief has been dispelled in large part due to the heavily reliance on software that must be updated, refreshed, loaded, downloaded and patched. Each of these present unique touch points and access points for adversaries and criminals to corrupt our systems.”

This executive order is the first step in helping to secure supply chains and add greater transparency and accountability.

Officials acknowledge that the order is limited given the authorities afforded to executive orders. While it is a welcome stride, some argue that more needs to be done to protect the federal government from sophisticated intrusions.

“This executive order is a good first step, but executive orders can only go so far. Congress is going to have to step up and do more to address our cyber vulnerabilities, and I look forward to working with the administration and my colleagues on both sides of the aisle to close those gaps,” Sen. Mark Warner, D-Virginia, chairman of the Intelligence Committee, said in a statement.

Andrew Eversden contributed to this report.

WASHINGTON — The Air Force school to prepare airmen to become high-end cyber defenders will introduce an online training tool in its upcoming curriculum.

Designed as the premier training tool for the Department of Defense cyber force, the Persistent Cyber Training Environment (PCTE) allows U.S. Cyber Command’s warriors to log on from anywhere in the world for individual or group training and mission rehearsals. The goal for PCTE is that it will be the training platform for the cyber mission force in the future.

To date, the services have used PCTE mostly for active duty units’ training and exercises.

Cyber Command sets training standards for its cyber mission force, fed by the military branches. The command selected the Navy as the joint curriculum lead for defensive cyber operations, and. the Army is manages the PCTE program on behalf of Cyber Command.

Officials at the 39th Information Operations Squadron, which provides airmen initial qualification training for defensive weapon systems before they join cyber protection teams, have worked with the Navy as it finalizes those joint standards. The schoolhouse at the 39th IOS is in the beginning stages of migrating to PCTE, inputting modules from the operational force, lab assignments and even practice ranges.

“The sooner everyone gets on board and moving in that direction is the sooner that we’ll start seeing the benefits from” PCTE, Lt. Col. Jonathan Williams, commander of the 39th IOS, told C4ISRNET.

Overall, training of defensive cyber warriors won’t change a whole lot given they have always used online tools and ranges in the classroom, officials said. What does change with the inclusion of PCTE in the schoolhouse is the variety and complexity of the training ranges, said Capt. Jerrelle Marshall, chief of weapons and tactics at the 39th IOS.

“Having a common set of training goals across the services provides a better opportunity for inter-changeability on cyber missions for the joint cyber operations force,” he said.

Officials said using PCTE will create a more ready force — from better training at the schoolhouse level to more realistic and on-demand training for operational forces — all to a greater benefit to taxpayers.

“From the budget perspective, [uploading operational lessons for students] saves us a heck of a lot of time and money and makes us much better stewards of your taxpayer dollars,” Runyan said.

Because training is conducted in the same environment at the schoolhouse and in operational units, there are resource efficiencies gained from standardization, simplification and automation of the training management processes, Marshall said.

“Instead of reinventing the wheel each time the field requests new training requirements, the schoolhouse has a direct link to entire communities’ worth of lessons learned and best practices, significantly shortening the timeline to go from need to implementation,” he said. “This link also enables tremendous cost savings to the joint community as we scale down the number of fielded independently operated and managed cyber training ranges to a consolidated model.”

The tool comes with a variety of additional benefits. It allows students to rerun practicals or replay scenarios they might have struggled on. They can get hands-on experience with the real tools and environments they’ll encounter in operations against actual threats.

Officials hope that experience will help the Air Force students, who at this level are focused heavily on individual training, more ready to integrate with their units and conduct mission qualification training.

“My personal opinion is that’s going to pay off in spades at the unit level at the mission qual [qualification] training, at the exercises and upgrade team certification for our CPTs out in the field,” said Skip Runyan, a tech adviser at the 39th IOS. “The possibilities that PCTE brings to the fight are enormous.”

This approach differs from traditional training for the broader military, which has limited training times and ranges because people have to practice on the tanks, fighter jets or other equipment they use in missions. What’s more, while the military does its best to replicate threats, it can only go so far. In cyberspace, these units can play against actual strains of malware or networks seen in operations.

“If we’re using the fighter analogy, they’ve got the ability to hop in the F-15 cockpit and do some training when there is a need to do that training. [Airmen] don’t have to schedule themselves for training sorties. The training will always be available,” Williams said. “I think that’s the true power with this new environment.”

Professors’ workload is lightened because PCTE grades students’ lessons.

“The grading aspect takes up a lot of time for the instructors, and if we have the ability to not only grade them with a little bit of the automation built into PCTE but also do some replays from what they’re doing in there, we can actually show them where they went wrong or where they went right in the system,” Runyan said. “That saves a lot of time and effort on the part of the instructor and saves a lot of frustration on the part of the student.”

Marshall explained that instead of instructors spending time thinking up how ranges should be configured, they can now focus their efforts on developing threat-representative scenarios.

The news Wednesday that Anne Neuberger, deputy national security adviser for cyber, is in charge of responding to the Russian breach pleased Senate Intelligence Committee leaders, who called the effort disjointed a day earlier and have pushed for more information about federal cybersecurity.

“The federal government’s response to date to the SolarWinds breach has lacked the leadership and coordination warranted by a significant cyber event, so it is welcome news that the Biden administration has selected Anne Neuberger to lead the response,” said Sens. Mark Warner, D-Virginia, and Marco Rubio, R-Florida, the committee chairman and vice chairman, respectively. “The committee looks forward to getting regular briefings from Ms. Neuberger and working with her to ensure we fully confront and mitigate this incident as quickly as possible.”

Before moving to a new cybersecurity-focused role on the National Security Council, Neuberger was the first director of the National Security Agency’s Cybersecurity Directorate, created in 2019 to provide the private sector key intelligence to bolster national cybersecurity.

Media reports noted that the Biden administration said Neuberger has been the point person on the federal response all along, but that role had not been known publicly.

The breach, believed to have started in last spring, was executed through a variety of vectors, according to experts, most notably by inserting malicious code in software updates provided by government supplier SolarWinds.

Hackers targeting the government’s supply chain could be the new normal, a top cyber expert warned members of Congress.

“SolarWinds really represents a new normal for Russian intelligence. If you look at what they were doing prior to SolarWinds, they were trying to be very noisy when they were breaking in and being detected very, very quickly,” Dmitri Alperovitch, executive chairman, Silverado Policy Accelerator, said in a Feb. 10 hearing before the House Committee on Homeland Security. “I believe that they reevaluated post their original compromises of the White House, State Department and the Joint Chiefs of Staff back in 2014 and 2015 and realized that the supply chain vector — being able to comprise these high-risk software like SolarWinds and using that to gain access to high value networks is really the way to go if you want to have long term access to these networks and remain undetected for months if not years.”

Other cybersecurity experts have noted changes in Russia’s tradecraft throughout the last decade. Kevin Mandia, CEO at cybersecurity firm FireEye, has said if Russian hackers were caught in U.S. networks a decade ago, they would leave to prevent any observation of their behavior. This changed around 2014-2015 when, if caught, they would persist on the network even though they knew they were being watched.

Alperovitch, who co-founded CrowdStrike and left in 2020, has followed Russian intelligence and cyber activities for years. He indicated the country’s efforts in cyberspace mirror its activities in human intelligence, sending spies to implant themselves in society over decades to steal secrets.

China is also likely taking note of these Russian tactics, he said.

In fact, China discovered several years back that it can hack contractors working on sensitive Department of Defense and national security programs to steal information and intellectual property, even use the information to build similar systems such as its J-31, which closely resembles the F-35.

Adversaries have realized they can target small to medium-sized manufacturing companies with crippling cyberattacks because, in many cases, these companies provide the Department of Defense critical services but often are so small that they don’t have the wherewithal to institute enough cyber defenses against intrusions.

A key role for the NSA’s cybersecurity directorate is helping secure the defense industrial base and defense weapons systems.

One way the government has sought to bolster the supply chain and defense industrial base is the Cybersecurity Maturity Model Certification, a tiered cybersecurity framework that grades companies on a scale of one to five. A score of one designates basic cyber hygiene and a five represents advanced hygiene.

Another way to improve supply chain vulnerabilities, Alperovitch offered, is to elevate standards for providers and require them to provide annual audits of their source code and networks.

In a Feb. 9 letter, Sens. Mark Warner, D-Virginia, and Marco Rubio, R-Florida ― the chairman and vice chairman of the Senate Intelligence Committee, respectively — expressed their concern with the federal response to date.

“The federal government’s response so far has lacked the leadership and coordination warranted by a significant cyber event, and we have little confidence that we are on the shortest path to recovery,” they wrote to the director of national intelligence, director of the National Security Agency, director of the FBI, and acting head of the Department of Homeland Security’s cyber arm.

The U.S. government has blamed Russia for widespread breach of federal agencies and private companies. The hacking campaign, believed to have started in the spring, was executed through a variety of vectors, according to experts, but most notably by inserting malicious code in software updates provided by government supplier SolarWinds.

The senators urged the government to establish a single leader who can unify the response.

“The briefings we have received convey a disjointed and disorganized response to confronting the breach. Taking a federated rather than a unified approach means that critical tasks that are outside the central roles of your respective agencies are likely to fall through the cracks,” they wrote. “The threat our country still faces from this incident needs clear leadership to develop and guide a unified strategy for recovery, in particular a leader who has the authority to coordinate the response, set priorities, and direct resources to where they are needed.”

In her Jan. 19 confirmation hearing to become director of national intelligence, Avril Haines committed to providing open channels of communication with the committee to keep members abreast of new developments.

The Trump administration created a Unified Coordination Group at the National Security Council to respond to the infiltration.

President Joe Biden has tasked the intelligence community to develop a full assessment of the breach.

Most recently, U.S. Cyber Command deployed cyber teams to check military networks for any signs of a compromise following what some experts and Congress members say is potentially the biggest hack and cyber espionage campaign in U.S. history.

The Pentagon has found no evidence thus far that the susceptibility affected Department of Defense’s networks. “Parts of our software supply chain source have disclosed a vulnerability within their systems, but we have no indication that the DoD has been compromised,” said Capt. Katrina Cheesman, a U.S. Cyber Command spokesperson.

But the teams are looking for damage nonetheless.

While the department doesn’t share many details about how defensive cyber protection teams do their jobs, one common tactic that threat hunters employ is monitoring networks closely for any strange behavior or actions, such as odd login times or use of unusual software.

A network user who takes actions outside of normal daily activity could be a hacker that the defensive team must block out of computer systems, sometimes confronting active trespassers directly to deny access through a kind of virtual hand-to-hand combat.

In the latest breach, the U.S. blames Russia for implanting malicious code in software updates provided by government supplier SolarWinds, allowing unprecedented access for months across federal networks.

The infiltration went beyond the software vendor, with hackers accessing networks in a variety of ways, The Wall Street Journal reported in a Jan. 29 article that included a Cybersecurity and Infrastructure Security Agency estimate that 30 percent of affected businesses and government offices did not have a direct link to SolarWinds.

To date, Cyber Command’s teams have not been asked to assist breached federal agencies but would do so if authorized, Cheesman said.

Cyber protection teams — 68 in total — make up the majority of the Pentagon’s cyber troops, and they’re always in high demand to help with suspicious activity throughout the vast DoD information network. Staff throughout the world use DODIN, a complex collection of thousands of local networks, for everything from sending real-time information to war fighters to storing basic personnel data.

While cyber protection teams are the DoD’s defensive frontline, they primarily act as a response force and don’t get involved until an adversary breaches networks, according to a December presentation during an Army conference by one of its cyber units.

When a breach occurs, the teams go to the site of the problem with specialized kits including a mix of laptops, small servers, passive and active sensors, analytic capability and software tools.

They work with the local IT staff who run networks to understand the unique qualities of a particular network’s day-to-day operations. The teams help search for malicious activity, eradicate any lingering interlopers, and recommend to the local personnel how to rebuild stronger network defenses.

Each team has 39 members, but they deploy in smaller elements to spread their expertise and rotate through active operations, regrouping and training.

Cyber experts familiar with cyber protection teams’ work described for C4ISRNET how the units would respond to a hypothetical breach, with some experts sharing insights anonymously because they are not authorized to speak publicly about the issue.

If CPTs see the actor is still on the network, they will work to kick the hacker off by changing credentials and blocking methods of access like backdoors and then determine what information the actor reached. The teams might have to set up deliberate defense within the network, putting up blockades to disrupt adversaries and force them into certain portions of the network. That improves their ability see hackers’ activity or confront them directly.

A team’s first action would likely be to get a handle on the attack vector, determining what machines or network segments run malicious software. From there, commanders prioritize hunting on the highest and most sensitive assets or portions of the network. For example, a system that works with the nuclear command and control infrastructure would be a top priority.

Sophisticated network hunters are needed because high-end actors will obfuscate their activity with a variety of tools, such as using credentials and privileges to look like an administrator or legitimate user. CPTs will try to lock out the actors by changing credentials and passwords, a painstaking process of looking at all corners of the network, all legitimate users and credentials.

With the latest breach, the actors were so stealthy they succeeded in masking their activity to look like a legitimate user. This is where a hunter has to know network processes inside and out, including what servers are running and what level of system is running those processes. Their forensics process might take them deep into network logs to analyze.

These hunters carefully look for the slightest anomalous behavior. That skill is the benefit, many sources said, of training cyber warriors to joint standards to learn offense and defense.

“The time that you spent trying to work on a network as an offensive person is going to help you understand where you might want to look defensively,” said Andrew Hall, a retired Army colonel who directed the Army Cyber Institute and teaches cybersecurity at Marymount University. “Now, they might use different techniques than you, so you’re probably not going to find the exact same thing as you, but you think of it from both sides. You think of it as a defender, you think of it as an offensive person.”

However, the reach of the recent hack makes it difficult for hunters to know where to look. Given the wide use of the vulnerable software within the government and DoD — and how well the actor stayed hidden — experts have said uncovering the extent of the any damage could take months.

“If you don’t have the access to military targets, adding more cyber units [isn’t] going to accomplish much,” Sen. Joe Manchin, D-W.Va., said during an Aug. 4 hearing with members of the Cyberspace Solarium Commission at the Senate Armed Services Subcommittee on Cybersecurity.

The commission is a bipartisan organization created by Congress in the 2019 to develop a multipronged U.S. cyber strategy. Manchin asked the witnesses if they have examined whether U.S. Cyber Command has difficulties recruiting, training and retaining its forces.

“Our sense of United States Cyber Command is they’ve done a great job within the authorities that they have of recruiting, training and developing for careers the people necessary to do the work that they do,” responded Chris Inglis, a commission member and a former deputy director of the National Security Agency.

Gen. Paul Nakasone, the head of Cyber Command, said during a discussion at an Association of the U.S. Army event in mid-July that the real issue isn’t necessarily training personnel, but “being able to retain our best, not everyone, but our best.”

There are a few initiatives in place to accomplish this, the commander added.

“First of all, it begins with the mission. If you like to work hard problems, if you like to be in the middle of ensuring the defense of our nation, if you like to work with incredible people and superb technology, being in a place like Cyber Command and NSA is critical,” he said. “But we’ve also been the beneficiaries of a number of different initiatives both by Congress and by our services to make sure that we have a significant amount of enumeration for those forces.”

The Senate has backed this approach in its defense policy bill, which sought to give Cyber Command the same hiring authority for technical talent as the Defense Advanced Research Projects Agency, the Strategic Capabilities Office and the Joint Artificial Intelligence Center. This would allow Cyber Command to offer more competitive pay.

Nakasone also outlined a hiring boom on the civilian side.

“Last year we hired over 2,000 people at the National Security Agency,” he explained. “What was interesting: There were a number of different programs upon which we were able to balance that. Whether or not it was developmental programs, whether or not it was outreach to colleges, we were able to fill all of those 2,000 spaces.”

Rightsizing the force

There is broad support for a fresh assessment of Cyber Command’s cyber mission force, which makes up the offensive, defensive, and intelligence/support personnel that perform cyber operations.

Designed in late 2012, key members of government are concerned it was designed prior to modern cyberthreats and a rapidly evolving landscape.

The Cyberspace Solarium Commission recommended an assessment of this force, which made it into the defense policy bill that must still be reconciled with both houses of Congress.

“I am a believer that that force needs to grow, and that’s one of the things that we’re involved in right now, is we take a look at the budget and one of the things I’ll be advocating for with the secretary. That’s a work in progress,” Nakasone said last month. “I will certainly be an advocate for looking at broader growth, obviously within the context of what our nation and what our department can afford.”

Other commissioners of the solarium project said this assessment will strengthen the nation in cyberspace.

“I think over time we will realize that the force structure assessment of the cyber mission force will end up having perhaps the biggest impact on DoD over the next decade if we come back with a finding that suggests that we do not have enough personnel,” Rep. Mike Gallagher, R-Wis., the commission’s co-chair, said before the House Armed Services Committee last week.

Former Rep. Patrick Murphy, a commissioner and formerly the undersecretary of the Army, also told the committee last week that the assessment “is the first step to make sure that we get it right to ensure that the [cyber mission force] has appropriately sized forces and is sufficiently capable to achieve its objectives.”

Inglis, before the Senate Armed Services Committee on Thursday, also agreed with the need for the assessment, but acknowledged that “we need to also at the same time make sure that we’ve done everything necessary to create a bigger pie from which we can recruit, and once we recruit to focus hard on how do you retain those people.”