Iowa Cyber Protection Team Maj Brian Dutcher Director of Operations, 168th Cyber Operations Squadron Overview

• Cyber Mission Force • Defensive Cyber Operation Capabilities • Air National Guard Cyber Protection Teams • 168th Cyber Operations Squadron Domestic Operations • Domestic Ops Example - Cyber Shield 2016 • Power of the Citizen Airmen Cyber Mission Force Defensive Cyber Operations (DCO)

• Mission Focused, Threat Specific, & Intelligence Driven • Capabilities • Identify Key Terrain-Cyber (KT-C) • Discover, Detect, Analyze, & Mitigate Threats (includes insider threats) • DCO-Internal Defensive Measures (IDM) • Hunt on friendly cyber terrain • “Stop the arrow” not the archer • DCO-Responsive Actions (RA) • Reactive defense – “Stopping the shooter” • Mission of National Mission Teams under USCYBERCOM CPT Area of Operation CPT Employment

PLAN SURVEY SECURE PROTECT RECOVER

 OPORD  Msn Analysis  Mitigate Risk  Dynamic Defense  Re-Baseline  Mission Plan  Map Terrain  NPDE  Response  Hand-Off  Assessments Coordination  PDE

• CPTs execute three distinct missions (Survey, Secure, Protect) – Survey Mission -- Plan, Survey – Secure Mission -- Plan, Survey, Secure – Protect Mission -- All stages

• Each employment stage is dependent upon the previous one

• Each CPT squad has a unique role during each stage Cyber Protection Teams (CPT)

CYBER LEADERSHIP C2, Planning CPT Intelligence Mission Protection Defensive Cyber Cyber Threat Cyber Readiness (CR) Cyber Support (CS) (MP) Infiltration (DCI) Emulation (CTE) • Conducts • Map Key Terrain- • Lead for Id TK-C • Conducts recon to • Coordinate, collect, compliance analysis Cyber (TK-C) • Conducts Id preexisting or & share threat • Provides detailed • Provides input to comprehensive active threats intelligence & TTPs baseline evaluation RMP mission/risk • Performs post • Instructs on threat • Coord/Conduct • Assists in RMP analysis exploitation TTPs participative & non- implementation • Lead for Risk Mgt forensics • Conducts PDE and participative • Provides training to Plan (RMP) • Composes damage NPDE penetration Defense Evaluation local defenders • Lead for MSN assessment testing (PDE/NPDE) Defense Plan (MDP) • Assists in RMP & • Emulates threats • Recommendations MDP • Assists in RMP & to RMP & MDP • Supports PDE & MDP • Ongoing monitoring NPDE • Assists in technical response actions Force Packages By the Numbers

Scope Configuration Employment Equipment 5 solo missions 35 7 2 formations 200+

Mission-ready cyber Member teams consisting of Can be either employed Industry-standard tools are professionals 1 Team Lead individually or as a utilized by teams on 1 Infrastructure Tech coordinated multi-team standalone mission systems 1-2 Analysts package (local and remote capable) 3-4 Cyber Operators Air National Guard Cyber Protection Teams • Federal: Support the 24 AF operations with trained and ready cyberspace protection teams (CPT) to fill USCYBERCOM's Cyber Mission Force taskings • State of Iowa: Ensure cyber preparedness and incident response for rapid internal state-level and national coordination needed to defend against cyber incidents across local, state and private industry partnerships 168th Cyber Operations Squadron Force Packages for the State of Iowa

CYBER LEADERSHIP Authority for force planning, coordination, synchronization, and execution

SURVEY/ASSESS PREVENT/RESPOND INVESTIGATE/EMULATE TRAIN/DEVELOP Evaluates/sustains compliance Improves defense and Detects, illuminates, and Identifies, plans, and conducts and readiness augments response emulates threats training for local defenders •Conducts compliance analysis •Conducts comprehensive •Identifies preexisting or active •Reviews effectiveness of ops, •Provides detailed baseline mission/risk analysis threats policies, and procedures evaluation •Performs vulnerability •Instructs on threat TTPs •Evaluates training needs and •Enhances/establishes assessments •Performs post exploitation develops training plan compliance monitoring •Enhances/implements forensics •Performs immediate onsite •Evaluates technical and risk mitigations •Composes damage assessment training and recommends mitigation measures; •Augments incident response •Conducts penetration testing future formal instruction highlights shortfalls and documents findings Force Packages Development Philosophy

Capabilities Tasks Structure KSAs Cyber Shield 2016 Background • Two-week defensive cyber operations (DCO) training exercise • Over 900 participants from state government agencies, federal agencies, industry partners, and academia • 16 members from the 132d Cyber Operations Squadron (COS) participated in a variety of roles • Mission Protection (Blue Team) • Cyber Threat Emulation (Red Team) • Exercise Technical Analysis (White Team) • Intelligence Fusion Analysis • JAG Leadership Cyber Shield 2016 Lessons Learned

• Relationships are critical; need for advance • Teams need a strong balance of technical planning and partnering before incident arise skills and non-technical skills • Industry Partner (i.e. acquaintance with our critical • Technical infrastructure industry partners systems in advance of a • Network Traffic Analysis cyber event) • Windows / Linux Command Line • Agencies (FBI / Law Enforcement) • Network / Server / Host Administration • Legal (JAG) • Cyber Incident Response • Intel • Malware Analysis • Other states • Triage /Incident Response Digital Forensics • Ability to effectively adapt to uncertainties is • Non-Technical crucial • Teamwork • Composure • Loss of network / range functionality • Communication Loss of critical services (domain controller, web server, • • Indicators of Compromise and link analysis firewall, IDS/IPS) • Assertiveness, Leadership, & Followership • Having to obtain supported partner’s approval for network hardening requests • Ability to learn Cyber Shield 2016 Legality

• Cyber Shield JAG Mission • Cyber Law Key Tasks • To ensure the legality of our defensive cyber • Anticipate and identify potential legal issues; JAs operations prepared Cyber Shield legal resources guide • Protect States/DoD/service members from liability • Train cyber teams to recognize cyber legal issues • Integrate Judge Advocates (JA) with CPTs and engage JAG based on pre-approved actions • Enhance partnerships with federal and state • Embed JA with CPT to maximize JA training in Cyber agencies involved in cyber operations operations; learn the area of operations • Maximize training for JAs and operators in domestic • Draft documents to ensure successful coordination cyber operations and cyber law and understanding between the National Guard, the agency partner and interagency partners • Iowa Air National Guard FY17-18 Cyber Law Next Steps • Cyber Operations Squadron (COS) Concept of Operations legal review • Cyber MOU/MOA's with Iowa State University and State of Iowa OCIO using the Iowa Communications Network, Minnesota Air National Guard (ANG)/Army Computer Network Defense Team, MidAmerican Energy, U.S. Air Force Academy Computer Science Department/Cyber Innovation Center • Iowa NG Cyber MOU and non-disclosure agreement template for future Cybersecurity support • Legal Review of Cyber Airmen Status to support T10 Missions The Power of the Iowa Citizen Airman

• Technical Expertise IT Pro • Business Acumen • Industry Leadership Skills

• Military Training & Expertise Airman • Military Leadership • Dedication, Esprit de Corps • Patriotism

Citizen • Well-rounded and Dynamic Airman • Technically Savvy • Seasoned Longevity Questions