The Department Of Defense Cyber Strategy

In July 2011, the U.S. Department of Defense (DoD) issued the DoD Strategy for Operating in Cyberspace, which outlines five strategic initiatives: 1) Treat cyberspace as another operational domain; 2) Employ new defense operating concepts to pro--tect DoD networks; 3) Partner with other U.S. government agencies and the private sector; 4) Build relationships with U.S. allies and interna--tional partners to strengthen cyber security; and, 5). Leverage the national intellect and capabilities through cyber workforce training and rapid techno--logical innovation. First, the monograph explores the evolution of cyberspace strategy through a series of government publications leading up to the DoD Strategy for Operating in Cyber--space. It is seen that, although each strategy has differ--ent emphases on ideas, some major themes recur. Second, each strategic initiative is elaborated and critiqued in terms of significance, novelty, and practicality. Third, the monograph critiques the DoD Strategy as a whole.

In July 2011, the U.S. Department of Defense (DoD) issued the DoD Strategy for Operating in Cyberspace, which outlines five strategic initiatives: 1) Treat cyberspace as another operational domain; 2) Employ new defense operating concepts to protect DoD networks; 3) Partner with other U.S. Government agencies and the private sector; 4) Build relationships with U.S. allies and international partners to strengthen cyber security; and, 5) Leverage national intellect and capabilities through cyber workforce training and rapid technological innovation. First, the monograph explores the evolution of cyberspace strategy through a series of government publications leading up to the DoD Strategy for Operating in Cyberspace. It is seen that, although each strategy has different emphases on ideas, some major themes recur. Second, each strategic initiative is elaborated and critiqued in terms of significance, novelty, and practicality. Third, the monograph critiques the DoD Strategy as a whole. Is it comprehensive and adequate to maintain U.S. superiority in cyberspace against a rapidly changing threat landscape? Shortcomings in the strategy are identified, and recommendations are made for improvement in future versions of the strategy.

Along with the rest of the U.S. government, the Department of Defense (DoD) depends on cyberspace to function. DoD operates over 15,000 networks and seven million computing devices across hundreds of installations in dozens of countries around the globe. DoD uses cyberspace to enable its military, intelligence, and business operations, including the movement of personnel and material and the command and control of the full spectrum of military operations. The Department and the nation have vulnerabilities in cyberspace. Our reliance on cyberspace stands in stark contrast to the inadequacy of our cybersecurity -- the security of the technologies that we use each day. Moreover, the continuing growth of networked systems, devices, and platforms means that cyberspace is embedded into an increasing number of capabilities upon which DoD relies to complete its mission. Today, many foreign nations are working to exploit DoD unclassified and classified networks, and some foreign intelligence organizations have already acquired the capacity to disrupt elements of DoD's information infrastructure. Moreover, non-state actors increasingly threaten to penetrate and disrupt DoD networks and systems. DoD, working with its interagency and international partners, seeks to mitigate the risks posed to U.S. and allied cyberspace capabilities, while protecting and respecting the principles of privacy and civil liberties, free expression, and innovation that have made cyberspace an integral part of U.S. prosperity and security. How the Department leverages the opportunities of cyberspace, while managing inherent uncertainties and reducing vulnerabilities, will significantly impact U.S. defensive readiness and national security for years to come.

The U.S. relies on the Internet and the systems and data of cyberspace for a wide range of critical services, leaving all of us vulnerable in the face of a real and dangerous cyber threat. State and non-state actors plan disruptive and destructive cyberattacks on the networks of our critical infrastructure and aim to steal U.S. intellectual property to undercut our technological and military advantage. The Department of Defense (DOD) is responsible for defending the U.S. from attack, including attacks that may occur in cyberspace. This cyber strategy, DOD's second, focuses on building cyber capabilities and organizations for DOD's three cyber missions: to defend DOD networks, systems, and information; defend the U.S. homeland and U.S. national interests against cyberattacks of significant consequence; and support operational and contingency plans. Figures. This is a print on demand report.

SUMMARYIn 2011, the Department of Defense (DoD) released its Strategy for Operating in Cyberspace, which officially recognized cyberspace as an operational domain akin to the traditional military domains of land, sea, air, and space. This monograph examines the 2015 DoD Cyber Strategy to evaluate how well its five strategic goals and associated implementation objectives define an actionable strategy to achieve three primary mis-sions in cyberspace: defend the DoD network, defend the United States and its interests, and develop cyber capabilities to support military operations. The topic of U.S. Federal cyberspace activities is well-documented in many sources, thus this mono-graph serves as a primer to provide senior policy-makers, decision makers, military leaders, and their respective staffs with an overall appreciation for the complexities, challenges, opportunities, and risks asso-ciated with the development of military cyberspace operations. This report is limited to unclassified and open source information; any classified discussion must occur at another venue. This monograph focuses on events and documents from the period of about 1 year before and 1 year after the 2015 strategy was released. This allows sufficient time to examine the key policies and guidance that influenced the development of the strategy, as well as follow-on activities for the impacts from the strategy. This inquiry has five major sections that utilize differ-ent frameworks of analysis to assess the strategy:1. Prima Facie Analysis: This section is by inten-tion only a superficial overview of the strategy. It explores the strategy and its public face as presented by DoD and addresses: What is the stated purpose of the strategy? What are its con-tent and key messages?2. Historical Context Analysis: The official roots of the DoD cyber strategy go back more than a decade, and this section reviews the docu-ment's contents within the context of other key historical national defense guidance. The sec-tion focuses on two questions: Is this strategy consistent with previous strategies and current policies? What unique contributions does it introduce into the evolution of national security cyberspace activities?3. Traditional Strategy Analysis: This section eval-uates eight specific premises for good strategies that include the familiar elements of ends, ways, means, and risk. It also addresses three ques-tions: Does the strategy properly address spe-cific DoD needs as well as broader U.S. ends? Is the strategy appropriate and actionable? How may joint combatant commanders view the strategy?4. Analysis of Subsequent DoD Action: This section explores the DoD cyber strategy's connections and influences to DoD guidance that followed its release. It will focus on two questions: How are major military cyberspace components--joint and Service--planning to implement the goals and objectives of the DoD cyber strategy? What plans has the Army put in place to sup-port the strategy?5. Whole of U.S. Government Analysis: This sec-tion examines DoD cyber activities from the per-spective of a whole-of-government approach to national cybersecurity. This analysis focuses on two questions: Does the strategy support U.S. Executive direction? Does the strategy inte-grate with other the cyberspace-related activi-ties of other U.S. Government departments and agencies?This monograph concludes with a section that inte-grates the individual section findings and offers rec-ommendations to improve future cyberspace strategic planning documents.

The United States is committed to an open, secure, interoperable, and reliable Internet that enables prosperity, public safety, and the free flow of commerce and ideas. The Internet was not originally designed with security in mind, but as an open system to allow scientists and researchers to send data to one another quickly. Without strong investments in cybersecurity and cyber defenses, data systems remain open and susceptible to rudimentary and dangerous forms of exploitation and attack. Malicious actors use cyberspace to steal data and intellectual property for their own economic or political goals. Governments, companies, and organizations must carefully prioritize the systems and data that they need to protect, assess risks and hazards, and make prudent investments in cybersecurity and cyber defense capabilities to achieve their security goals and objectives. Behind these defense investments, organizations of every kind must build business continuity plans and be ready to operate in a degraded cyber environment where access to networks and data is uncertain. To mitigate risks in cyberspace requires a comprehensive strategy to counter and if necessary withstand disruptive and destructive attacks. The United States' Department of Defense (DoD) is responsible for defending the U.S. homeland and U.S. interests from attack, including attacks that may occur in cyberspace. This book examines the DoD's cyber security strategies; provides US Cyber Command with strategic direction to ensure unity of effort as duties are performed in the service of the nation; and discusses international strategies for cyberspace.