How Does Persistent Cyber Engagement Work?

TL;DR

Persistent engagement improves national cyber defense by enabling government agencies, allies, and private industry with threat indicators while positioning authorized forces outside the United States to understand and counter adversaries. The approach responds to corrosive threats that operate below armed conflict, including intellectual property theft, exploitation of personal data, and interference with democratic processes.

Transcript

Please welcome Olivia Gazis. Good afternoon to everyone. Uh, thank you for having me. It's a delight to be here, and I think it's a very good sign that so many of you have made it to Wednesday. Uh, without further ado, I wanna introduce our guest of honor. It's a pleasure to introduce to you the Commander of US Cyber Command and Director of the Nat... Read More

Key Insights

• US Cyber Command has three missions: defending Department of Defense systems and weapons platforms, supporting joint force commanders against online adversaries, and helping defend the nation in cyberspace through cooperation with other federal organizations.
• The National Security Agency has two central areas of focus: collecting and analyzing foreign intelligence, and advancing cybersecurity for national security systems and the broader internet.
• NSA and Cyber Command have different authorities and missions, but their shared leadership supports speed, agility, and unity of effort when pursuing outcomes in cyberspace.
• Corrosive cyber threats create strategic harm over time by stealing intellectual property, exploiting personally identifiable information, and interfering with democratic processes while remaining below the level of armed conflict.
• Persistent engagement is a proactive, forward-leaning defense posture designed for an environment in which adversaries repeatedly enter networks, steal information, and conduct cyberattacks with minimal response.
• Enabling partners is one component of persistent engagement, and it involves sharing information such as indicators of compromise with federal agencies, allies, private industry, social media companies, and states.
• Acting outside the United States is the second component of persistent engagement, allowing Cyber Command to understand adversary behavior, provide indications of hostile intent, and take authorized action when necessary.
• The 2018 midterm election effort demonstrated a whole-of-government approach in which Cyber Command supplied observed threat indicators to the Federal Bureau of Investigation and Department of Homeland Security for further sharing.

Questions & Answers

Q: What are the main missions of US Cyber Command?

US Cyber Command has three main missions. It defends Department of Defense data, networks, and weapons platforms. It supports joint force commanders by helping combat adversaries online in locations such as Afghanistan and Iraq. It also contributes to national defense in cyberspace by cooperating closely with the Department of Homeland Security and the Federal Bureau of Investigation.

Q: What does the National Security Agency do in cybersecurity and intelligence?

The National Security Agency focuses on foreign intelligence and cybersecurity. It collects, analyzes, and reports information for policymakers and warfighters while supporting the security of national security systems and the broader internet. Its comparative strengths include cryptanalysis, working against difficult foreign targets, and processing the tremendous quantities of data encountered in modern intelligence operations.

Q: What is a corrosive cyber threat?

A corrosive cyber threat is hostile activity that operates below the level of armed conflict and produces strategic damage over time. Examples discussed include repeatedly stealing intellectual property, obtaining personally identifiable information that can later be leveraged, and conducting influence or interference operations intended to disrupt democratic processes. A single incident may appear tactical, but repeated activity can harm an entire nation.

Q: How have cyber threats changed over time?

Cyber threats initially emphasized penetration of classified systems for espionage. They then expanded into disruptive attacks against networks and businesses, followed by destructive operations such as the 2014 attack that damaged Sony Pictures. The more recent concern is corrosive activity, which persistently targets intellectual property, personal information, and democratic processes while staying below the threshold of armed conflict.

Q: What is persistent engagement in cybersecurity?

Persistent engagement is Cyber Command's proactive and forward-leaning approach to defending national cyberspace. It has two parts: enabling partners with relevant threat information and acting outside the United States to understand adversaries. When necessary and authorized, Cyber Command can also act against those adversaries while supplying policymakers and warfighters with indications of their activities and possible intent.

Q: How does Cyber Command enable its government and private-sector partners?

Cyber Command enables partners by sharing information obtained from observing adversary behavior. During work to secure the 2018 midterm elections, it provided indicators of compromise to the Federal Bureau of Investigation and the Department of Homeland Security. Those organizations could then share the information with relevant parties, including social media companies and states, to strengthen their defensive efforts.

Q: Why are NSA and Cyber Command led by the same person?

The combined leadership supports speed, agility, and unity of effort in cyberspace, where intelligence and military activities can contribute to the same directed outcomes. The NSA provides foreign intelligence and cybersecurity capabilities, while Cyber Command focuses on military objectives and support to warfighters. Whether to retain or divide the leadership arrangement is ultimately a policy decision made by the president.

Q: How do NSA and Cyber Command resolve potentially competing objectives?

NSA and Cyber Command focus on the outcomes directed by policymakers and senior leaders rather than treating intelligence and military objectives as inherently conflicting. NSA collects, analyzes, and reports foreign intelligence and also operates as a combat support agency. Cyber Command examines targets supporting warfighters or broader objectives. Their shared focus helps align distinct authorities and capabilities toward the most beneficial authorized result.

Summary & Key Takeaways

• US Cyber Command has three principal missions: protecting Department of Defense data, networks, and weapons platforms; supporting joint force commanders against online adversaries; and defending the nation in cyberspace. Its domestic defense role requires close cooperation with the Department of Homeland Security and the Federal Bureau of Investigation.

• The National Security Agency focuses on foreign intelligence and cybersecurity. Its comparative strengths include making and breaking codes, collecting intelligence against difficult foreign targets, and handling large volumes of data. Although NSA and Cyber Command possess different authorities and missions, both operate in cyberspace and pursue outcomes directed by senior leaders and policymakers.

• Cyber threats have progressed from espionage and disruptive attacks to destructive and corrosive activity. Persistent engagement addresses this environment through two connected functions: enabling partners with actionable threat information and acting outside the United States, when authorized, to understand adversaries, inform policymakers and warfighters, and counter hostile cyber operations.