How Does Active Cyber Defense Secure DoD Networks?

TL;DR

Active cyber defense depends on operating Department of Defense networks as one coordinated system and partnering with government and industry. U.S. Cyber Command combined previously separate operational and network warfare capabilities, while cooperation with DHS and the defense industrial base addresses dependencies beyond military networks. The strategy aims to strengthen defenses before destructive cyber tools become widely used.

Transcript

Oh, thanks. I just learned what good game meant. When I was coming out, she said, "I'll, I'll let you know. I'll give you the good game sign." That's a joke, I'm sorry. I, I know I'm not supposed to have humor on these things. Uh, I'll tell you, it's a privilege and honor to be back here again. Uh, two years ago I was here, uh, then as the director... Read More

Key Insights

• Cybersecurity is a team responsibility because Department of Defense operations depend on cooperation among U.S. Cyber Command, the National Security Agency, DHS, other government organizations, state and local governments, and private industry rather than the capabilities of one isolated organization.
• Technological growth creates both opportunities and vulnerabilities because connected devices, social networks, expanding storage, enormous communication volumes, and advances in natural-language processing increase what networks can accomplish while also expanding the systems and information that defenders must secure.
• Cyber threats can involve exploitation, disruption, or destruction. Exploitation includes the loss of intellectual property and secrets, disruptive attacks can prevent governments or networks from functioning normally, and destructive tools represent a serious prospective danger that stronger defenses should address before widespread use.
• DoD network defense operates at substantial scale because the department has about 15,000 networks, receives more than a million scans per day, experiences over 20,000 malicious email attacks per month, and faces more than 1,000 other attacks per month.
• Network inspection is a major operational burden because the Department of Defense scans approximately 90 terabits of data and roughly 150 billion packets entering and leaving its networks each day, requiring coordinated capabilities rather than fragmented defensive responsibility.
• Military cybersecurity extends beyond military-owned networks because defense operations depend on external infrastructure, including the power grid and broader network services. The defense industrial base also requires protection because private companies produce equipment used by the Department of Defense.
• The 2008 classified-network breach was a wake-up call because a thumb drive helped produce what the transcript describes as perhaps the largest breach of classified military networks, demonstrating that internal devices and user practices can undermine otherwise protected environments.
• U.S. Cyber Command unified previously separate capabilities by combining Joint Task Force Global Network Operations with Joint Functional Capabilities Command Network Warfare. The resulting organization reached full operational capability at the end of October 2010 and began operating and defending DoD networks as one team.

Questions & Answers

Q: What is active cyber defense for Department of Defense networks?

Active cyber defense is presented as a coordinated approach to operating and defending Department of Defense networks against exploitation, disruption, and possible destruction. It requires unified military capabilities, stronger defenses, awareness of activity across networks, and teamwork with organizations outside the department. The approach also recognizes responsibilities to support DHS and cooperate with private industry while safeguarding civil liberties and privacy.

Q: Why was U.S. Cyber Command established?

U.S. Cyber Command was established in 2009 to bring separate Department of Defense cyber capabilities into one organization. Joint Task Force Global Network Operations and Joint Functional Capabilities Command Network Warfare were merged so the department could operate seamlessly as one team. The command was intended to change military culture, conduct, and defensive capability after serious network incidents exposed weaknesses in the existing structure.

Q: How large was the Department of Defense cyber defense mission?

The Department of Defense had about 15,000 networks under its operational and defensive responsibility. Those networks were scanned more than one million times per day, received over 20,000 malicious email attacks per month, and experienced more than 1,000 other attacks per month. Defenders also scanned approximately 90 terabits of data and roughly 150 billion packets entering and leaving the networks each day.

Q: How did cyber threats evolve from exploitation to disruption?

Cyber exploitation involved continuing theft or loss of intellectual property, secrets, and other information, along with criminal activity. Disruptive attacks became especially visible in 2007 when a distributed denial-of-service attack targeted the Estonian government during conflict over the Tallinn monument. Other disruptive attacks later affected Georgia, Latvia, Lithuania, Azerbaijan, and Kyrgyzstan, indicating a broader change in network threats.

Q: Why does DoD cybersecurity require partnerships outside the military?

Department of Defense systems do not operate independently from civilian infrastructure or private industry. Military missions rely on the power grid and the broader network, so failures in those systems can prevent the department from doing its job. The defense industrial base also produces military equipment and must be secured through industry partnerships. The department additionally has an obligation to support DHS in its mission.

Q: What did the 2008 thumb-drive breach change in DoD cybersecurity?

The 2008 thumb-drive incident caused what the transcript describes as perhaps the largest breach of classified Department of Defense networks. It served as a wake-up call and a catalyst for organizational change. The breach supported the decision to combine different cyber components, alter military culture and conduct, and improve the capabilities used to defend networks against threats introduced through ordinary removable devices.

Q: How does rapid technological growth affect cybersecurity?

Rapid technological growth expands both the usefulness and vulnerability of networks. The transcript points to new mobile devices, social platforms, increasing storage, vast email and packet volumes, and improvements in natural-language processing. These developments enable communication, organization, and automated problem solving, but they also create more data, users, systems, and dependencies that defenders must monitor and protect through combined expertise.

Q: Why did the speaker describe cybersecurity as a team sport?

Cybersecurity was described as a team sport because no single military command or government agency can secure all the networks and infrastructure on which national defense depends. U.S. Cyber Command and the National Security Agency need cooperation across government, including DHS, state and local governments, and the private sector. Shared responsibility is particularly important for communications systems, critical infrastructure, and the defense industrial base.

Summary & Key Takeaways

• Rapid growth in connected devices, communication, storage, and automated language processing creates valuable opportunities alongside serious vulnerabilities. Social networks can organize activities and influence political events, while expanding data volumes increase the difficulty of securing information systems. The central challenge is applying combined government and industry expertise to network defense.

• Cyber threats have progressed from exploitation toward disruption, with destructive attacks presented as the next major concern. The transcript cites distributed denial-of-service activity against Estonia and disruptive attacks affecting several other countries. Meanwhile, military systems face frequent scanning, malicious emails, other attacks, and the operational burden of inspecting enormous data volumes.

• The Department of Defense established U.S. Cyber Command by merging network operations and network warfare organizations into one command. Its mission includes directing and defending thousands of DoD networks, supporting DHS, protecting dependencies such as the power grid, and partnering with the defense industrial base while respecting civil liberties and privacy.