NATIONAL CYBER DEFENSE CENTER A Key Next Step toward a Whole-of-Nation Approach to Cybersecurity National Security Perspective James N. Miller | Robert J. Butler NATIONAL CYBER DEFENSE CENTER A Key Next Step toward a Whole-of-Nation Approach to Cybersecurity James N. Miller Robert J. Butler Copyright © 2021 The Johns Hopkins University Applied Physics Laboratory LLC. All Rights Reserved. This National Security Perspective contains the best opinion of the author(s) at time of issue. It does not necessarily represent the opinion of JHU/APL sponsors. The views expressed are solely those of the authors and not of any US governmental agencies or departments. NSAD-R-21-003 NATIONAL CYBER DEFENSE CENTEr iii Contents Figures .........................................................................................................................................................................................v Tables ...........................................................................................................................................................................................v Summary ..................................................................................................................................................................................vii Cyber Threats to US National Security ........................................................................................................... 1 Cyber Threats below the Level of Armed Conflict ................................................................................................2 Cyber Attacks in Crisis or Conflict ...............................................................................................................................4 Linkages between Cyber Threats above and below the Threshold of Armed Conflict ..........................5 US Cyber Defense Strategy .............................................................................................................................. 7 What an NCDC Would Do ...............................................................................................................................11 Cyber Deterrence .......................................................................................................................................................... 12 Active Cyber Defense................................................................................................................................................... 14 Offensive Cyber Actions in Support of Cyber Defense .................................................................................... 15 Cyber Incident Response ............................................................................................................................................ 16 Preparing for and Conducting Coordinated Cyber Defense in Crisis or Conflict ................................... 18 Prioritizing Engagement with Key Partners ........................................................................................................ 19 Identifying Escalation Risks That Could Arise in Day-to-Day Execution of Campaign Plans ............. 19 Prioritizing Key Private Sector and International Partner Engagements .................................................. 19 NCDC Supporting Function: Provide a Continuous Net Assessment Process ........................................ 24 Accelerating Technology Insertion ......................................................................................................................... 26 What an NCDC Would Not Do .......................................................................................................................26 NCDC Organizational Relationships, Structure, and Staffing .................................................................27 NCDC in the ONCD ....................................................................................................................................................... 27 Organizational Structure of an NCDC .................................................................................................................... 27 Leadership and Staffing of an NCDC ...................................................................................................................... 29 Creating a National Cyber Cadre ............................................................................................................................. 31 NCDC Relationships with the NSC and DHS ........................................................................................................ 31 Organizational Placement and Physical Location ............................................................................................. 35 iv THE JOHNS HOPKINS UNIVERSITY APPLIED PHYSICS LABORATORY How an NCDC Would Operate .......................................................................................................................35 Process Flow for Routine NCDC Requests ............................................................................................................ 36 Process Flow for Time-Urgent NCDC Proposals ................................................................................................. 37 Setting Conditions for Success ................................................................................................................................. 39 Conclusion ........................................................................................................................................................39 Appendix A The Evolution of US Cyber Defense Strategy ................................................................................. 41 Appendix B Alternative Models for a Whole-of-Nation Approach to Cyber Defense .............................. 53 Bibliography ........................................................................................................................................................................... 67 Acknowledgments ............................................................................................................................................................... 77 About the Authors ............................................................................................................................................................... 77 Figures Tables NATIONAL CYBER DEFENSE CENTEr v Figures Figure 1. Private Sector Active Cyber Defense in the Gray Zone ....................................................................... 22 Figure 2. Potential Organizational Structure of NCDC ........................................................................................... 29 Figure 3. NCDC Proposal Requiring NSC Review and Presidential Approval ................................................ 37 Figure 4. Time-Urgent NCDC Proposal Requiring Approval Only of FBI Director ........................................ 38 Figure B-1. Organizational Relationships between NCDC and NSC ................................................................. 64 Tables Table 1. ONCD’s Statutory Responsibilities Relevant to NCDC ........................................................................... 27 NATIONAL CYBER DEFENSE CENTEr vii Summary A National Cyber Defense Center (NCDC) would plan and coordinate US government cyber defense operations below the threshold of armed conflict while also conducting contingency planning, and if necessary coordinating national cyber defense operations in the event of armed conflict.T he center would plan and coordinate across four key lines of operation, which are essential both below the level of armed conflict and in crisis or war: cyber deterrence, active cyber defense, offensive cyber operations in support of defense, and cyber incident management. To be most effective, the NCDC should be placed in the Office of the National Cyber Director (ONCD), which was established by Congress in late 2020 as a new element of the Executive Office of the President. Serious and Growing Cyber Threats to US National Security Both state and nonstate adversaries are conducting sustained cyber-enabled campaigns that aim to advance those adversaries’ interests and undermine the interests of the United States. The fabric of American society and the US political system are under attack in cyberspace, as Russia and other countries are conducting cyber-enabled disinformation attacks to sow domestic discord and undermine democracy in the United States. China’s cyber-enabled theft of US intellectual property has been estimated to cost the United States 1–2 percent of its gross domestic product annually. The US government and private sector are also vulnerable to disruptive and destructive cyber attacks, as exemplified by Iran’s distributed denial-of-service (DDoS) attacks on Wall Street from 2012 to 2013 and North Korea’s 2014 cyber attack on Sony Entertainment and its WannaCry ransomware attacks of 2017. Cyber crime costs US firms hundreds of billions of dollars per year; cyber ransomware attacks threaten business operations, and those targeting the health care industry have disrupted hospitals and put patients at risk. The failure to stem cyber intrusions, as exemplified by Russia’s massive SolarWinds hack discovered in late 2020 and the hack of Microsoft Exchange discovered in early 2021 (and attributed by many to China), poses incalculable risks to American security. In addition to the day-to-day challenges from malicious cyber activity below