While not a primary mission for U.S. forces, understanding information warfare and how it impacts areas of responsibility is something that is taken into consideration in U.S. cyber training and operations, according to Department of Defense officials.

“I think there are two parts to get that,” said Col. Todd Stratton, director of Air Forces Cyber Forward. “One is the more traditional approach of cybersecurity, which evolved from information assurance, which is looking at the confidentiality, the integrity and the availability of your information. That is still a core responsibility for my component, and that continues to be very important to us.

“On the flip side, when you start talking about social media and fake news, it gets to … the key to cyberspace superiority or dominance, which is the people,” continued Stratton. “When it comes down to it, it’s the training you give your airmen and your population, frankly, to think critically.”

[Related: How CYBERCOM’s efforts against ISIS have changed]

It’s enough of a concern for the Army to send a team of researchers to Ukraine to participate in an international, three-year science and technology program aimed at understanding and fighting modern information warfare.

According to an Army release, the group will develop theoretical foundations, methods and approaches toward software tools for situational awareness that enable military forces to monitor for, detect and notify of malicious information injections and information attacks, said Dr. Alexander Kott, Army Research Laboratory chief scientist.

“Information attacks have emerged as a major concern of societies worldwide. They come under different names and in different flavors — fake news, disinformation, political astroturfing, influence operations, etc,” Kott said.

“And they may arrive as a component of hybrid warfare — in combination with traditional cyberattacks (use of malware), and with conventional military action or covert physical attacks.”

At U.S. Cyber Command, much of the information-warfare emphasis is on verifying the security of data and ensuring it’s safe and worthy of essentially being deemed actionable intelligence, according to Brig. Gen. Timothy Haugh, USCYBERCOM director of intelligence.

Speaking alongside Stratton at the Nov. 28 CyberCon event in Arlington, Virginia, Haugh said that idea applies to data whether it’s on military networks or intelligence from elsewhere being used for decision-making.

“Converting that into something that’s decision quality, and trusting in that, is critical. And that’s an area that we have to partner with all elements of the government and industry as we think about what does it mean in terms of trusting the information that’s in front of us to ensure it’s not [biased] in some way and that someone hasn’t manipulated that data,” Haugh said. “We have to ensure we’re making decisions off quality information.”

[Trump elevates Cyber Command; split with NSA still an option]

Not only is the command itself relatively young, but the notion of cyber operations and the international legal framework behind them are also nascent.

Given cyber operations will play a large role in future conflict with the military looking to integrate cyber effects into traditional military operations at all the geographic combatant commands, Congress wants to maintain oversight into global cyber operations.

[What Cyber Command learned from ISIS operations]

[Cyber is being normalized with traditional military operations]

That was partially behind one of the provisions that made it into the conference report of the FY 2018 National Defense Authorization Act to amend the current law requiring quarterly cyber operations briefings, expanding the scope of such briefings.

“When it comes to oversight, I think it’s important from the policy maker’s perspective particular for members of Congress that have been in office for quite some time, we need to understand how cyber operations are changing 21st Century warfare,” Rep. Elise Stefanik, R-NY, said during a panel discussion Nov. 28 at CyberCon hosted by Federal Times.

“Having that quarterly briefing is important form my perspective so that my fellow policy makers continue to see how critical these cyber operations are when it comes to protecting our national security.”

Stefanik said these briefings will be modeled after the quarterly counterterrorism briefings “where policy makers have an opportunity to ask questions about the specific operations or just generally about the regions that they’re covering.”

She added that this model has worked in the counterterrorism context in terms of providing transparency and information to policy makers, something she understands well as the House Armed Services Subcommittee chair that oversees cyber, counterterrorism programs special operations forces, which conducts nearly all counterterrorism operations globally.

Specifically, the NDAA amends current law mandating DoD’s quarterly cyber briefings to include:

• Separate updates for each geographic and functional command that describe; operations carried out as well as hostile cyber activity directed at the command;
• An overview of authorities and legal issues applicable to the operations to include any relevant legal limitations;
• An outline of any interagency activities and initiatives relating to operations, and;
• Any other matters the secretary of defense determines to be appropriate.

Stefanik noted that this update is part of the process in maturing Cyber Command. “As we’re seeking to mature U.S. Cyber Command, this is a way to ensure that members of Congress and senators are getting the information they need and can ask those probing questions,” she said. “It helps us on a quarterly basis have an understanding of how those operations are changing, how the threats are changing as well.”

Given both how quickly evolve in cyberspace as well as how new the command is, there will undoubtedly need to be continues updates in authorities and responsibilities.

[Authorities Complicate Use of Cyber Capabilities]

“In the same way that we are now better at our diets and sorting out junk food, and better at pollution and keeping our environment clean, we’re going to have to learn new skills of keeping the pollution and junk food” out of cybersecurity, Sen. Sheldon Whitehouse said Nov. 28 at the CyberCon 2017 conference in Arlington, Virginia..

Much of the work in improving cybersecurity across the country lies in the hands of the American people and federal agencies, he added, noting that the U.S. can’t necessarily rely on lawmakers or top leaders to get the job done. It’s particularly pressing as the U.S. faces emerging threats online.

“We have seen in the last election, and we’re going to continue to see … a melding of cyber hacking and weaponized fake news that is used to manipulate American public opinion to the advantage of foreign antagonists — that is a fairly new phenomenon,” Whitehouse said.

“The cyber part is not that complicated; hacking the [Democratic National Committee] was an afternoon’s work for somebody. But the strategy of using that information and running through a weaponized fake news matrix in order to get information out selectively and affect American public opinion isn’t going away.”

Whitehouse highlighted a range a potential ways Capitol Hill lawmakers and U.S. officials could boost federal cybersecurity, including an inspector general-type role that monitors federal agencies and their network security. He added that a “roving IG for cyber” could become an office that serves as a resume-booster for those who work there and a driver of better cyber hygiene throughout the government.

“It was distressing to me when Attorney General [Jeff] Sessions came into the Judiciary Committee the other day and he could not name the person in the Department of Justice responsible for cybersecurity legislation,” Sen. Whitehouse said.

“My guess is there is no such person, but that’s not where we should be. [Director of National Intelligence Dan] Coats and Attorney General Sessions should begin this conversation now … because getting through Congress on this is a mess.”

“The attack surface is going to expand greatly,” said Ret. Maj. Gen John Davis, vice president and federal chief security officer at Palo Alto Networks. “When we start connecting all of these other devices, like devices that are involved in life-saving functions – transportation, cars – when we start connecting these things, we’re opening up a whole different category of impact. I think we will put people’s lives at risk, and I think there will be tremendous impact to national security, economic prosperity, public safety. So, I worry about the direction that this is going in.”

According to Jeanette Manfra, assistant secretary in the Department of Homeland Security’s Office of Cybersecurity and Communications, digital devices are changing the meaning of infrastructure that used to refer only to physical systems.

“In thinking about critical infrastructure, the word ‘infrastructure’ itself sometimes, I think, causes some confusion,” said Manfra. “And when it was originally established it was around the notion of physical threats, counterterrorism, etcetera, and how are we actually protecting the asset, the infrastructure itself from somebody who might want to sabotage that building or use that infrastructure itself to destroy another infrastructure.”

Instead internet connected devices and systems constitute essential services within parts of the critical infrastructure.

“It’s not just about the infrastructure, it’s about ‘what are the critical services and functions that American citizens, residents and increasingly, because of the multinational nature of some of our companies, globally that we depend upon?’” said Manfra.

She added that she divides the cybersecurity problems posed by IoT into three categories: IoT as vulnerable endpoints on a critical infrastructure’s network, consumers buying unsecured IoT devices that could be conscripted into a denial of service or botnet campaign, and IoT devices imbedded in cars or healthcare tools that pose a life-threatening vulnerability.

“I think that’s a very different set of issues,” Manfra said.

“More and more things are connecting to each other, and we’re becoming more and more reliant on that connectivity,” said Davis. “And so I think that what that’s going to result in is difficulty in prioritization of effort.”

James Scott, senior fellow at the Institute for Critical Infrastructure Technology, said that a cybersecurity vetting system, much like how products are rated for energy efficiency, could solve the problem of consumers buying unsecured devices.

“One of the easiest ways to manage that is an EnergyStar-type approach, so you have the device, you have a QR code, you scan your phone over the QR code. That then feeds back to a dynamic database that’s operated by machine learning and artificial intelligence that calculates a score,” said Scott.

Scott added that the critical infrastructure sectors most vulnerable to cyberattack, like healthcare and energy, tend to have “Frankenstein IoT microcosms” of unsecured devices.

Since then, Cyber Command leaders learned how to better employ cyber capabilities, Brig. Gen. Timothy Haugh, director of intelligence at Cyber Command, said during a panel at CyberCon hosted by Federal Times in Arlington, Va., Nov. 28.

Chief among those lessons is “how we approach the intelligence problems, how we approach intelligence sharing, understanding the battlespace and also (ensuring) that traditional things like our targeting process were sound and repeatable within the cyber domain,” Haugh said.

Many military leaders are careful to stress that cyber operations do not occur in a vacuum and must support the other functions and domains of warfare.

“AFCYBER, the way we look at this is that really cyberspace operations is just a part of an all domain plan,” Col. Todd Stratton, director of Air Forces Cyber (forward), said during the panel. “You’ve got air, sea, land and space as well as the cognitive domain but those primary five warfighting domains, cyberspace is just a part of that.”

Stratton said the Air Force’s approach is providing full spectrum, all-domain-integrated effects. “What that means is cyber just doesn’t stand alone. It’s part of a holistic joint campaign plan and it has to be integrated in with a timing and tempo of supported commander,” he said. “It isn’t just cyber war on its own. It’s part of an integrated set of gears … rather than just cyber war standing on its own.”

This mirrors comments from his boss, Maj. Gen. Christopher Weggeman, commander of 24th Air Force/AFCYBER, who told C4ISRNET in an interview last summer that the force doesn’t do cyber for cyber’s sake.

[Air Force cyber boss sets early deadline for full operational capability]

Moreover, the teams being developed underneath Cyber Command, once delivered to their respective combatant commands, serve those joint force commanders’ objectives.

“I try to do this with all the combatant commands, sit down face-to-face: ‘Where are we? Are we meeting your requirements?’ ” CYBERCOM Commander Adm. Michael Rogers told Congress earlier this year. “Cyber Command, in many ways, what we do functions to support others. We exist to enable and support the success of others.

[Cyber is being normalized with traditional military operations]

While cyber isn’t 100 percent analogous to the other physical domains, Haugh said key pillars are applicable.

“There are obvious differences in terms of the difference in geographic approach – cyber does not present the same clean lines in terms of geography but in terms of understanding how an adversary uses capabilities or vulnerabilities that presents those standard lessons that we’ve learned from all the other domains of warfare apply,” he said.

Haugh noted that the stand up of Joint Task Force-Ares, used to fight the Islamic State, created an operational level headquarters that could bring a cohesive approach to Central Command and be able to be focused on speed, outcomes and integration of the multi-domain fight.

The previous commander of Army Cyber Command and JTF-Ares, Lt. Gen. Edward Cardon, told reporters in 2016 that the task force allows greater command and control for the overall global counter-ISIS collation.

[Counter-ISIS Cyber Task Force Provides Greater Clarity, C2]

The partnership between CENTCOM and CYBERCOM has continued to evolve through present, Haugh said, and leaders there have learned how to present options in the context of what Central Command’s desired outcomes are.

Stratton’s predecessor, Col. Robert “Chipper” Cole, has stated previously how within the JTF-Ares and counter-ISIS effort more broadly, CYBERCOM and CENTCOM have a say on potential targets with a CENTCOM targeting board and a JTF-Ares targeting board in which the cyber personnel have to link up with the CENTCOM personnel.

[How Can Cyber Contribute to Multi-Domain Battle?]

And yet, according to Brig. Gen. S.M. Lacroix, a Canadian officer serving as director general of the Secretariat of the Inter-American Defense Board, some sort of unified cybersecurity agreement among the countries in the Americas needs to be reached in the future.

Currently, only eight of the 27 member nations on his board have a formal cyber strategy, and the majority of those have only recently developed strategies.

Getting those nations to agree to spend on cyber defense, let alone agree to work together on projects, is a major challenge.

Click here for more coverage from the 2017 CyberCon!

“It’s hard,” Lacroix said. “It’s not easy, and what I would say to that is that our organization essentially only provides technical advice based on requests from either the Organization of American States or member states themselves. There is no mechanism for us, really, to force a country to get interested in cybersecurity and have it play some higher priority list for their domestic issues.”

Lacroix is hoping to see smaller countries in Latin America look at what the larger economies are doing and take cues from those nations.

“I think when they see a Brazil and Columbia and Mexico jump on board and develop fairly robust cybersecurity policies, other countries will jump in,” he said, before acknowledging the hard reality that “whether they have the resources and expertise to do so is a separate conversation.”

Indeed, it’s hard for a nation with a fairly small budget for defense to prioritize cyber spending when they may not be a target. And while a major incident, such as widespread hacking of a banking system or a cyberattack on the military, would likely cause those nations to get active, until then, there isn’t a huge incentive for them to preemptively take action.

Lacroix is hopeful the nations in South America that are investing in cyber will be able to encourage their neighbors to start thinking through potential risks before an incident occurs.

He points to Brazil, who is investing heavily in information technology. But even there, economic realities come to the fore, with Brazil’s budget falling due to decreasing oil prices. To try and mitigate that, Lacroix is looking at potential public-private partnerships, with an emphasis on education about why cyber is an area worth investing in.

“We are educating the leaders of today and tomorrow so they can make the right decisions in terms of acquiring whatever infrastructure they would require to implement their own cybersecurity policies,” he said.

A potential point of concern for the U.S. and Canada, whose militaries naturally play an outsized role in such discussions, comes in the form of China and, to a lesser extent, Russia.

Both nations are investing in Latin America, with Chinese firms in particular taking an active role in building the digital infrastructure many nations need. The U.S. is constantly wary of letting Chinese or Russian technology into even slightly sensitive areas; imagine what it means for a U.S. ally to be connecting to American networks and military files on a Chinese-built cyber infrastructure.

Lacroix acknowledged that could be a concern for the northern American countries, but said that there is no real way to stop it.

“I think that we can have all sorts of nefarious ideas as to what China and others are doing in the region, but I think what they are mainly doing is filling a gap or filling a void,” he said. And while he “suspects” there are various defense organizations looking at the implications, it wasn’t something his organization directly tackles.

Those are the characteristics that a panel of federal and industry representatives said they value in hiring cyber workers during the CyberCon 2017 conference held Nov. 28.

Finding and training workers versed in cybersecurity has long been sticking point for federal agencies. According to an April 2017 report from the Government Accountability Office, the federal government needs to hire more than 7,500 workers in those areas.

But members of the CyberCon panel said there have always been more empty seats than qualified people to fill their jobs. Instead, with the rapid pace of change in the industry, employers want to hire workers who demonstrate specific characteristics, rather than those who come only with technical skill sets.

“You can’t be inside the box,” said Harry Wingo, a faculty member at the college of information and cyberspace at the National Defense University. Wingo once managed a program to help Google hire more military veterans. “You have to have the confidence to advise that combatant commander and say, ‘That’s the way to go.’”

Workers also need to be able to adjust on the fly.

“When the attack vectors change, they can change with it,” said Deborah Pierre-Louis, the director of the State Department’s office of policy, liaison and training.

But none of the workforce issues facing cyber leaders will change overnight, or even in a few short years. Hiring is just part of the solution, said Trent Teyema, chief of cyber readiness at the Federal Bureau of Investigation.

“We’re not going to hire our way out of this,” he said.

Teyema pointed to two strategies the FBI has used to bolster its staffing. First, the agency has worked to ensure employees are in the room for more personalized training and not just watching virtual sessions. Secondly, the intelligence agency has specifically targeted high school and college students for internships and eventual full-time jobs.

Finally, experts such as Joey Muniz, a technical solutions architect for Cisco, said employers need to incentivize good behavior and should not be above shaming employees for inadvertently dangerous acts.

For example, Muniz pointed to a “wall of shame” at Cisco for users who click on fake phishing emails. By calling out those users, Muniz said, companies and agencies can tangibly show employees how their actions could lead to additional expenses, providing a valuable lesson in the process.

Addressing CyberCon 2017 — hosted by Federal Times Nov. 28 in Arlington, Virginia — Brig. Gen. S.M. Lacroix, director general of the Secretariat of the Inter-American Defense Board, noted that collectively ensuring a better cybersecurity ecosystem abroad, and in his case the Americas, makes the U.S., Canada and North America a safer place to live, to do business and ensure prosperity.

While the cybersecurity agenda is being discussed more and more, he noted that investing in defense runs up against many competing priorities of nation states. In Canada’s case, this includes health and education, while for many Third World or developing nations “investing in cybersecurity is a great idea and probably somewhat essential, but it doesn’t compete very well against other pressing priorities.”

The desire to invest in cyber is increasing, but these competing priorities pose challenges, he said. In addition to mere spending, he noted in his presentation that education, training and recruitment are also critical to success.

Within the Western Hemisphere, only eight nations have “something that resembles a cybersecurity strategy.” These nations include Mexico, Chile, Costa Rica, Paraguay, Colombia, Jamaica, Panama and Trinidad and Tobago.

Some of these strategies are quite sophisticated and resourced while some are essentially “a piece of paper with a lot of words on it.”

More importantly, he said, 16 of the countries in the Western Hemisphere have absolutely nothing in terms of a strategy.

Lacroix was also careful to express that this is not a military problem; adding the military is part of the problem and the solution. Government needs to be involved but, importantly, industry must be a critical member at the table.

While meaningful legislation may not be in the immediate future, at least one congressman believes there are ways lawmakers can improve cybersecurity, particularly in the civilian federal government.

The first: Institute a serious stress test for the National Institute of Standards and Technology’s cybersecurity framework, a de facto standard for federal cybersecurity used across agencies.

“Does the NIST framework process provide adequate cybersecurity that we in the Senate can simply rely on and not have to engage?” Sen. Sheldon Whitehouse said Nov. 28 at the CyberCon 2017 conference in Arlington, Virginia.

“All of us have had the experience of working together on something and coming away happy with the process because it’s so undemanding and easy to get along with versus being happy with the process because it is in fact, although demanding, providing serious cybersecurity to America’s infrastructure. I don’t think we know the answer to that question.”

A second possibility for Congress to aid federal cybersecurity is establishing a sort of “a roving inspector general focused on cybersecurity with white hat penetration authority.” Duties of that role could include targeting federal networks and monitoring for vulnerabilities at agencies.

Theoretically that role would help prevent the kind of breach seen at the Office of Personnel Management in 2015, “before all of our records got co-opted by the Chinese for OPM … that was something we should have realized,” Whitehouse said.

“We can’t expect requisite expertise to do this well be spread across 73 different inspectors general. So call it an inspector general, call it a special investigator, call it a GAO group — I care less about where it’s located than the fact that someone has to have the job actually testing whether what agencies say about their cybersecurity is really true. We don’t have that effectively now.”

The third potential area for Congress to pitch in on cybersecurity: public awareness. Whitehouse said he doesn’t believe the American public is acutely aware of cybersecurity dangers, partly because the chief players being targeted — private industry and the —government — each have their own reasons for masking the problem.

“If you’re a private corporation that just got hacked to bits you don’t want competitors [or possibly even] shareholders to know … so there’s not a lot of good information coming out,” Whitehouse said. “On the government side we are demons for classifying stuff; we overclassify like fiends and the result is it’s very hard to get government reports out as good as, say, the McAfee Red Dragon report.”

Perhaps, he suggested, the answer to that problem is a designated government spokesperson of sorts dedicated to sharing such information.

“We need a ‘discloser in chief’ or a ‘storyteller in chief’ — somebody who has the authority to declassify so they can actually negotiate with the principals and have authority at the table,” Whitehouse said.

“And their job should be every quarter or every six months to tell the story of what happened in the last quarter … you can say, ‘This is what kind of problem we had in the electric utility grid,’ and you can work through the process of making sure that what should be classified stays classified.”

Whitehouse additionally advocated for an international “coalition of the willing” that eschews nations going cyber-rogue, instead building consensus among partner nations to establish global cyber norms and standards.

“Start with Five Eyes, bring in other countries that are amenable and grow from there,” he said. “I don’t think the Russians or Chinese will ever negotiate in good faith, so why bother? Set terms for the rest of the world and they’ll begin to comply.”