Confronting Cyberspace’s Growing Terrain
The cyber strategic landscape continues to increase in size, with both China and Russia leveraging new technologies to spread disinformation and misinformation among global populations and exploit devices designed to ensure personal freedoms, said Air Force Lt. Gen. Kevin Kennedy, Joint Force Headquarters-Cyber (JFHQ-C) commander, at RMCS23 the previous day.
China, in particular, aims to steal warfighting secrets of the U.S. defense industrial base, which is why DOD is extending its defensive umbrella to include operational weapon systems, critical infrastructure and private sector partners.
“As an early step, we are addressing our technical debt, disadvantages stemming from past underinvestment in our cyber infrastructure,” Kennedy said.
Examples of this include the Air Force 561st Network Operation Squadron’s initial experiments with zero-trust tools and microsegmentation, and Space Force acquisition teams’ integration of cyber into planning and demands that capabilities be secure.
JFHQ-C is currently improving the detection and disruption capabilities of sensors within fielded operations and weapons systems not traditionally connected to the larger network, as well as building greater command and control capabilities for shared risk awareness that will inform all commanders’ decision-making.
While the Air Force remains in the zero-trust pilot phase and is just beginning to consolidate networks, standardization and programming work will soon become its focus, and that will require funds and training, Kennedy said.
EXPLORE: What agencies should know about establishing zero trust in a hybrid work environment.
F-35 Design Theft Energized DOD’s Cyber Oversight and Response
“The hardest things in cybersecurity start off with identity and access management,” Matthews said. “We’ve got to verify who you are before we trust you, and what I’m concerned about, as we move to zero trust, is really the administration of the zero-trust framework.”
Managing roles-based access is a different cyber skill set, and the Air Force is still in the process of coding positions to the DOD Cyber Workforce Framework.
DOD’s strong partnership with industry is critical as ever in the new zero-trust paradigm, and Kennedy pointed to the F-35 aircraft as an example.
The Pentagon suspects China exploited the networks of nuclear defense contractors to steal F-35 designs years in the making and accelerate the design and production of its own J-31 aircraft by years if not a decade.
Following the theft, the Air Force adopted more integrated solutions for cyber oversight and monitoring of the F-35 in the form of the Autonomic Logistics Information System, which monitors the health of the fleet and shares a broad information set with a “specific but large” audience, Kennedy said.
DOD further developed four lines of effort it plans to apply to all its systems: defining and assessing its cyber terrain, applying a cyber architecture to it, implementing a cyber service provider strategy and documenting the resulting framework.
“This may sound straightforward and foundational, and it is. But the difference is the enterprise-level attention and the integrated solutions,” Kennedy said. “Single units, single services, single industry partners and single nations will not be able to achieve the necessary level of resilience of the F-35 enterprise.”
To learn more about the 2023 RMCS event, visit our conference page, and follow us on Twitter at @FedTechMagazine to see behind-the-scenes moments.
