“The very things that make mobile devices such a productivity tool are the exact same things that make them a big target for espionage and for malicious activity,” Kiersten Todt — president and managing partner at Liberty Group Ventures and resident scholar at the University of Pittsburgh Institute for Cyber Law, Policy and Security — said Oct. 24 in Baltimore, Md., at the annual MilCom conference hosted by AFCEA.

“We saw most recently [White House] Chief of Staff John Kelly’s phone getting compromised and by all accounts that was likely by a nation-state actor given what he wasn’t able to do.”

Mobile devices that are compromised, she said, can be exploited by adversaries to enable the microphone, allowing them to listen into sensitive conversations, access data that’s going through the smartphones or be able to take pictures of a surrounding area.

“We typically have looked at smartphones as a peripheral device, but I think we all appreciate right now that smartphones we each hold are really the access points into both our personal and professional lives,” Todt, who previously served as executive director of commission on enhancing national cybersecurity, said. “The data that travels through those devices is critical.”

In the military context, a report by the Wall Street Journal earlier this month charted how Russia targeted the smartphones of NATO soldiers, with the goal of gaining operational information, gauging troop strength and intimidating soldiers.

Personal devices brought onto the battlefield can be exploited allowing adversaries to geolocate positions and direct fires upon their positions.

“This might be the clearest example yet of how our reliance on networks and connected devices has created new threats to national security,” retired Rear Adm. Bill Leigher, Raytheon DoD Cyber Programs director, said. “This should make it clearer than ever that nation-states have brought the fight to new terrain — our commercial networks and the devices people use every day.”

Complicating matters even further is the combination of social media posting through smartphones. A Russian sailor broadcast the position of his ship’s previously unknown location to much of the world when he posted a selfie off the coast of Syria complete with the geo-tag active.

The military is trying to engrain best practices into the ranks of their enlisted soldiers with a recognition that it starts at the highest levels first.

“How do we train our soldiers to understand the vulnerabilities and what our Ukrainian partners are realizing that by using your personal cellphone what that opens you up to,’ Maj. Gen. Patricia Frost, director of the Army’s Cyber Directorate, said during a panel discussion in Augusta, Ga., in August. “If we — this is the leader level — will not recognize the vulnerabilities that we’re bringing into the environment and the threat vector that we’re introducing, how do we expect our soldiers at the most junior level to be disciplined.”

She noted that they might being to use the National Training Center as a teaching moment, saying if X number of soldiers brought their personal devices to NTC, leaders could say they targeted them, brought indirect fires on their position as to demonstrate the threat vector they’ve introduced.

“I have been at forums at field grade and higher level where we’ve told everyone we’re going to go classified, leave your cellphones in a designated place and we scan the room and more than 50 percent to 75 percent still brought their cellphone into the room,” Frost said.

“Right now we have to appreciate the mobile devices are an endpoint priority equal to — or I would argue even more so — important than the laptops and the desktops that we each use,” Todt said.

“Being able to develop the policies around protecting the information on our mobile devices and importantly protecting the data is what has to happen. Critical information has to be the priority for looking at how we secure devices, data and how we’re securing our workforce.”

Within that construct, a team controller sits within what is called the white cell, or the brain of the exercise, understands the team’s objectives and controls the pace of the exam, the team lead said. No fewer than three individuals are embedded with participants to observe their actions and input them into a database. A training analyst works with the opposing force, or OPFOR, to create a visualization to show the blue team how it performed.

This visualization — which is a subset taken from a tool in a control room that shows all network traffic and activity in blue (friendly), gray (cyber no man’s land) and red (adversarial) space — allows assessors a literal playback of how the blue force reacted during a particular event to determine if it was the correct course of action.

Participants and OPFOR are playing on a synthetic network or range that has to be developed prior to the exercise. One range lead told C4ISRNET during a walk-through at the exercise that they build all the networks — to include virtual networks for members playing in remote locations — and vulnerabilities, meaning they purposefully built in vulnerabilities for the OPFOR to exploit. The network was only patched up to December 2016, affording the OPFOR all the vulnerabilities that were relevant and unpatched at that time. Moreover, the range can also take down security measures if they want to simulate bad business practices or bad systems administrators.

Teams are assessed against certain criteria. And while being tested to the point of failure makes it an unfair fight by design, teams do debrief with the OPFOR every evening to provide limited insight for the next day’s exercises. The OPFOR and exercise leads are “bending over backwards” for the participants to ensure the right training is occurring, a blue team lead said.

This means teams can request to run through particular scenarios again if they feel they need additional practice.

For example, the OPFOR team lead pointed out that perhaps a blue team never experienced or didn’t have much training on a data exfiltration operation, so they’ll run such a mission. If the team didn’t catch it, they’ll rerun that again in coordination with all involved and maybe make it easier the next time, if necessary, or provide a little bit of extra intelligence.

It could be the team’s skill sets of dealing with data exfiltration are spot on, C4ISRNET was told, but maybe the intel lead wasn’t paying attention. There are multiple factors that could be blamed for a failed data exfiltration response, and the OPFOR in conjunction with exercise planners and assessors must pinpoint where the failure occurred, try to correct it and see how they perform again.

“If we don’t hear chatter over the course of the day, we’ll generally encourage that: Take a break and do like a mini catch-up so everyone’s on the same page to give us a pulse of how things are going,” a blue team lead said. “At that point, it’s: Take a deep breath; it’s OK; what else do you want to focus on today? Some of the guys have been up front to say: ‘I want to dig into this tomorrow.’ OK, we will work with the mission owner to get you that time to do what you want to do.”

Going off script

While there is a script, so to speak, to which the the exercise tries to follow, there are specific things everyone must learn and experience, according to a blue team lead.

However, the script isn’t structured like: “A,” then “B,” then “C,” then “D,” another blue team lead said. “A” might happen and the team must react. “So they’re like: Well, ‘B’ doesn’t really follow, but we have ‘A’ sub one and hopefully we’ll get them back on track to what we want to see from them.”

There also are specific injects available to assessors and the OPFOR that can be used to force the blue teams to perform a certain action. “I didn’t really see this out of you, but I want to see

this

out of you, so how do I make that happen?” the team lead said.

“I don’t feel like I’m being attacked by OPFOR. I feel like I’m being presented with potential scenarios I might really face,” another blue team lead told C4ISRNET. “I don’t feel like I’m being personally attacked by anybody, I feel like I’m very much in a scenario where I’m being presented with as much realism as possible. OPFOR isn’t there to attack you — they’re providing opportunity for things to react to.”

While an extremely tactically focused exercise, teams might be asked in a scenario to provide mission assurance to the mission owner, who needs to make sure team members can communicate with other assets, be it a naval vessel or otherwise.

“There’s one thing or two things that are absolutely critical for the mission to be successful. The rest of it is just a mitigation effort by the teams,” an exercise leader said. “We have to make sure this stuff is working, then do damage control on the rest of it. That’s the problem set they’re given.”

The operational tempo for the exercise stresses participants to the point where they are left with nothing but the ability to rely on their basic skills, a participant said. If there’s one super star that might carry things, this situation kind of highlights that, C4ISRNET was told. The exercise is compressing what might occur in a month’s time into six days.

Officials provided less details regarding offensive team activities and validation efforts. Their activity is tailored differently because their play is somewhat unique, one exercise leader said. “There’s one team, and that aspect of it is it’s highly tailored to them, but they’re being assessed against their objectives and mission sets. That’s an aspect of the exercise,” an official explained.

“What’s unique about how they’re doing it in this exercise is they’re doing it together,” another lead said. Protection teams, support teams — which provide analysis and intelligence — and mission teams — which conduct offensive ops — are all working against the same adversary in conjunction.

“They’re feeding one another, which is hard to do,” an official said. “But the value they get out of it is hard to beat.”

“This is key in a space that is ever-changing,” Morrison noted. “Cyberspace today is not going to be what cyberspace is tomorrow.”

Cyber Quest will assist the Army in its requirements process. Morrison pointed out that the service is in the midst of developing requirements for a number of operational gaps identified for the exercise.

This will allow the Army to have solid operational concepts that underpin requirements and better inform the acquisition process.

One of the areas of which the Army will focus is the world of cyber and the electromagnetic spectrum. “The traditional acquisition model will not work. I’ll be that definitive,” Morrison said, adding that the service is trying to shorten the timeline here.

“If we develop requirements today, and seven years from now we’re trying to field a capability in the cyberspace domain, it simply will not work. We’re behind before we even start.”

The 40 capabilities brought to Cyber Quest by 27 vendors this year were tested in scenarios developed by Army Training and Doctrine Command that incorporated many of the threats that would originate from near-peer adversaries.

Everything was done with an eye toward the near-peer adversary, according to Lt. Col. Stephen Roberts, the lead project officer for this year’s Cyber Quest exercise. Capabilities and measures were made to look like those seen in the battlefield, he said, so they could be assessed against specific real-world threats.

Morrison said some scenarios were built in where critical systems were “spoofed,” meaning the adversary was actually trying to make forces think something was happening inside the operational environment that wasn’t actually occuring.

Solutions for defensive cyber operations capabilities were also tested. Some of these solutions “are things that would be utilized to defend our networks and provide an operational edge for us to not only detect new attacks against our network but then also remediate those attacks in a rapid fashion,” Roberts said.

Currently, it takes hours or days to detect or remediate these issues at the tactical edge. he noted. The service is trying to get that time frame down to minutes.

The exercises also served to conduct risk-reduction efforts for government-developed solutions and programs. Program managers and program executive offices put forth programs of record while labs such as the

Communications-Electronics Research, Development and Engineering Center

provided four separate systems within the EW space, Roberts said.

Morrison said these government solutions were undergoing operational assessments of capabilities being examined by acquisition teammates deeper than where current programs of record are. This, he said, allows soldiers to get their hands on kits to provide feedback and take the right risk-reduction direction.