CHIPS Articles: Navy Cyber Power 2020

Vice Adm. Kendall L. Card, Deputy Chief of Naval Operations for Information Dominance/Director of Naval Intelligence (OPNAV N2/N6), and Vice Adm. Michael S. Rogers, Commander, U.S. Fleet Cyber Command/U.S. 10th Fleet, signed Navy Cyber Power 2020 (www.public.navy.mil/fcc-c10f/Strategies/Navy_Cyber_Power_2020.pdf), which identifies distinct qualities the Navy must possess to succeed in cyberspace, and introduces methods to build a relevant and extremely capable Navy cyber warfighting force for the future.

U.S. maritime power is comprised of six core capabilities: forward presence, deterrence, sea control, power projection, maritime security and humanitarian assistance/disaster response (HA/DR). In today’s highly networked world, each one of these core capabilities is enhanced by effective Navy cyberspace operations.

Navy Cyber Power 2020 (NCP 2020) is a strategy for achieving the Navy’s vision for cyberspace operations. Navy cyberspace operations provide Navy and joint commanders with an operational advantage by:

• Assuring access to cyberspace and confident Command and Control (C2);
• Preventing strategic surprise in cyberspace; and
• Delivering decisive cyber effects.

NCP 2020 describes the key endstate characteristics that the Navy must create and the major strategic initiatives it will pursue to achieve success. It serves as a guidepost to inform enterprise architecture, investment decisions, and future direction in the cyber realm.

To this end, U.S. Fleet Cyber Command led an assessment of cyber threats, key trends, and challenges adversely affecting Navy cyberspace operations to identify decisive opportunities that will enable the Navy to maintain its advantages in cyberspace. To achieve this vision for cyberspace operations, the Navy will pursue strategic initiatives across four key focus areas: integrated operations; an optimized cyber workforce; technology innovation; and requirements and planning, programming, budgeting and execution (PPBE) and acquisition reform, which are summarized in Figure 1.

The Navy will continue to work with industry, academia, interagency and joint partners, as well with the other services, and allies to maximize cyber integration and ensure the most efficient use of defense resources. To measure success, the Navy intends to establish a set of strategic performance measures for each key focus area to evaluate progress and ensure it is achieving the desired effect.

Collectively, these efforts represent a fundamental change in the way the Navy conducts operations. Success requires an “all hands” effort, from the Pentagon to the deckplate.

Ultimately, the vision for NCP 2020 is that it will allow Navy cyberspace operations to continue to provide Navy and Joint commanders with an operational advantage by assuring access to cyberspace and confident command and control, preventing strategic surprise in cyberspace, and delivering decisive cyber effects.

To defeat threats, one must understand the insidious nature of the threat environment. Cyberspace extends far beyond the traditional boundaries of Navy and joint networks. Practically all major systems on ships, aircraft, submarines and unmanned vehicles are “networked” to some degree. This includes most combat, communications, engineering, and positioning, navigation and timing (PNT) systems.

Additionally, cyberspace extends equally across joint and Navy business and industrial control systems. While connectivity provides Navy platforms and weapon systems with unprecedented speed, agility and precision, it also opens numerous attack points of entry for cyber adversaries.

At the same time, cyberspace provides a low barrier of entry for a wide range of state and non-state adversaries to effectively challenge and hold Navy forces at risk. Over the past several years, Navy networks have been attacked in cyberspace by a broad array of state actors, terrorist organizations, “hacktivist” groups, organized crime, and individual hackers. Motivations include personal gain, information theft, discrediting the United States, sabotage, political gain, denial or degradation of the Navy’s access to cyberspace, and mapping Navy networks.

Attacks have resulted in a leveling of the battlespace for adversaries, compromised security, and imposed stress on systems and personnel. The most troubling of these are advanced persistent threats (APTs) by state and nonstate actors with the capability and intent to relentlessly probe and attack Navy networks as part of a larger antiaccess/area denial (A2/AD) strategy.

The Navy must be able to mitigate the impact of APTs through defensive, and when directed, offensive measures. A large number of lesser cyber threats also affect the Navy’s effectiveness in cyberspace. Failure to adhere to long-standing information technology policies increases the spectrum of threats the Navy must address on a daily basis and distracts from identifying and defending against other threats intentionally targeting the Navy and Defense Department. These lesser threats can be mitigated by strict observance of Navy IT policies.

While it is difficult to predict exactly what the 2020 cyber environment will look like, several key trends provide insight into the future: industry changes, IT efficiency efforts, vulnerability of the commercial IT supply chain, and an increasing complexity in configuration management.

Industry drives the accelerating pace of change in cyberspace, not government. In practically all other areas of warfare, government investments drive innovations in new capabilities and weapon systems. However, in cyberspace, it is industry -- driven by customer demand -- which invests billions of dollars to enhance current and develop new cyber capabilities. Each innovation creates new potential vulnerabilities that adversaries will attempt to use to compromise security.

Conversely, innovation also creates opportunities to advance Navy cyberspace capabilities, but current requirements and budget and acquisition practices are not agile enough to take advantage of them in a timely manner.

IT efficiency efforts continue to drive consolidation and standardization of service networks across the DoD. The goal of these efforts is to create a Joint Information Environment. The JIE will consist of a shared IT infrastructure that provides: a single, joint network architecture for each security level, consolidation of data centers and network operations centers, and a comprehensive security architecture. The capabilities to enable information sharing, collaboration, and interoperability will be provided as enterprise services across the DoD. Long-term savings from these efforts are expected, but the transition costs and additional bandwidth requirement costs will likely further strain existing budgets.

However, IT efficiency efforts also provide a unique opportunity to mitigate cyber risks. Network consolidation will reduce the number of defensive fronts and provide an opportunity to design in defensive measures from the start. It will also create greater opportunity for unity of effort across the DoD and the development of common doctrine and tactics, techniques and procedures (TTPs) across joint cyberspace operations.

The commercial IT supply chain, for both hardware and software, is increasingly outsourced overseas, particularly to Asia. Each node within the global IT supply chain presents adversaries with an opportunity to introduce a cyber threat or exploit the system for their own purposes. IT hardware and software developed all or in part overseas are used by Navy forces every day. The Navy acquisition system must have greater visibility and more effective controls across the entire supply chain.

As the Navy continues to evolve its warfighting capabilities, an expanding number of critical shipboard and airborne systems, including combat, communications, engineering and PNT systems, are becoming increasingly networked. This creates enormous configuration management challenges and increases the avenues for adversaries to deliver cyber attacks. The mindset of what is considered “part of the network” needs to expand to include all devices, systems, and components.

System development will require increased coordination within and across the systems commands to ensure interoperability and defensive measures are built in during the design stages.

Navy cyberspace operations face several challenges typical of other emerging warfare disciplines in the Navy’s history, such as air and undersea warfare. Once again, a look at Figure 1 illustrates some of the more prominent challenges across the areas of operations, workforce, technology, requirements and PPBE and acquisition. Exacerbating these four challenge areas is a constrained budget climate. Overcoming these challenges will require careful prioritization of requirements and resources, tough fiscal choices, and program alignment decisions.

The future of U.S. maritime power depends heavily on the Navy’s ability to achieve its vision for cyberspace operations. Strategy for achieving this vision is based on careful consideration of the threats, trends, and challenges facing the Navy in cyberspace. Success requires a comprehensive approach across the four focus areas that will yield desired outcomes:

• Fully integrated Navy cyberspace operations in support of achieving Joint Force objectives;
• Navy and joint cyberspace operations driven by an effectively recruited, trained, and positioned workforce;
• Industry, academia, and joint partnerships that assist in rapidly updating Navy cyberspace capabilities to stay ahead of the threat; and
• Enhanced cyber budgeting and acquisition to meet the Navy’s cyber operational needs.

In association with the work being done in support of the four focus areas, the Navy intends to evolve cyberspace doctrine, TTPs, and operational plans to take full advantage of cyber capabilities across the full range of military operations. Further, the Navy will fully exercise all aspects of cyberspace requirements and operations in battle exercises, unit inspection, and all Fleet Readiness Training Plan (FRTP) phases in tandem with other warfare areas to facilitate the transition of cyberspace operations into a seamless component of maritime operations.

While the Navy maintains a workforce of cyber professionals who are proficiently skilled, appropriately trained, and effectively positioned to carry out cyberspace operations in support of Navy and joint commander objectives, the Navy must continue to develop a comprehensive cyber training and education model that can rapidly adapt to industry advances and evolving joint commander needs. The Navy must continue to be able to rapidly respond to evolving cyber needs through robust training and an agile force model that ensures the Navy’s cyber workforce remains optimally aligned and personnel resources are used most efficiently.

The Navy will be working to overcome cultural barriers impeding the full integration of cyber capabilities through communication, training, incentives, enforcement of policies and effective governance. This effort will focus on increasing awareness of cyber threats and continually improving cybersecurity practices across the Navy.

To diminish the challenges of emerging technologies, the Navy plans to institute a robust pilot program to aggressively seek out and test emerging cyber technologies in real world and cyber ranges, assess their operational impact, and be able to quickly integrate them across the Navy. This will require a coordinated effort across the Navy that focuses cyber technology pilots and demonstration projects on the most pressing operational needs.

The Secretary of Defense’s strategic guidance highlights the critical role cyberspace operations play in the success of the Joint Force across all mission areas. The Navy’s success in the maritime domain depends upon its ability to project power and prevail in cyberspace. The NCP 2020 strategic initiatives provide the ways and means to achieve and sustain the Navy’s advantage in cyberspace. To assist with implementation of Navy Cyber 2020, OPNAV N2/N6 and U.S. Fleet Cyber Command/U.S. 10th Fleet will issue a supporting roadmap detailing lead and support organizations for each strategic initiative and the major actions necessary to accomplish them. However, as cyberspace evolves Navy’s leadership will periodically assess this strategy to ensure it effectively guides the Navy’s efforts to maintain an operational advantage in cyberspace. When necessary, the Navy will adjust course to respond to, if not anticipate, change that continues apace.

FOR MORE INFORMATION

FLTCYBERCOM/10th Fleet - www.fcc.navy.mil