EXPLORING CYBER DEFENCE

By Colonel Rizwan Ali,

United States Air Force
Cyber Defence Branch Head
HQ SHAPE

on cyber
defence
AS A COLLECTIVE DEFENCE NCIA and NATO Headquarters to keep the (1) situational awareness;
organisation, NATO's stance on cyber relies Alliance's cyber defence posture strong. To (2) plans;
heavily on Member Nations to protect their build a strong cyber defence, there are many (3) exercises; and,
own networks and Computer Information elements that need to come together into a (4) business continuity.
Systems (CIS). NATO's r esponsibility is cohesive whole. Some of these elements are
the protection of NATO owned networks. tangible while others are less tangible and Let's go through each of these parts in more
Within this framework, the NATO Commu- require processes and procedures. detail:
nications and Information Agency (NCIA) One way to view cyber defence is to
provides the bulk of the cyber defence ca- think about a walled fortress. Some of you Situational Awareness: If we go back
pability to NATO to include the Strategic may be thinking that a fortress is an out- to the walled fortress analogy, situational
Commands, Allied Command Operations dated analogy when we are dealing with awareness can be viewed as stones that
(ACO) and Allied Command Transforma- cyberspace. I disagree. Using the fortress make up the wall. Each set of stones around
tion. Knowing this basic information, one analogy is a good way to explain the four a fortress has its own unique shape and
may think that Strategic Commands, par- critical parts required in order to build a characteristics. They are likely different sizes
ticularly ACO does not play a major role strong cyber defence in any organisation, depending on the strength required. In the
in NATO's cyber defence. This would be an especially a complex organisation such as same way that the walled fortress is made
incorrect assumption. ACO, and its subor- NATO. Building a robust structure for cyber up of stones of different sizes, shapes and
dinate commands, work very closely with defence takes four basic parts: characteristics, situational awareness is also

32 The Three Swords Magazine 26/2014


for their personnel. The last types of stones operational-level plans, which fit into the
that make up a wall fortress are the smaller strategic plans. Each of these plans has cy-
stones. These stones fill in the gaps between ber defence elements. One key point about
(...) from an operational the large and medium stones. They provide these plans is that without good situational
military perspective, the needed strength to fix any holes in the awareness, as described above, it is very
cyberspace and cyber wall and can be thought of as tactical-level difficult to write appropriate plans. Mili-
situational awareness. NATO as a whole re- tary plans at each level depend on good sit-
defence are very lies in large part on NCIA to provide tacti- uational awareness to know how the plans
similar to the way we cal-level situational awareness. Much of this should be written in order to respond to
conduct sound military information comes from open sources such potential adversaries.
as advisories from major software vendors
operations in the air, and advisories from antivirus vendors which Exercises: So, now that we have built our
land and sea domains." identify vulnerabilities. These advisories of- walled fortress, we can just sit back and
ten recommend specific tactical-level config- relax, right? Of course not! Every walled
made up of varying elements. We can think uration changes to our systems and updates fortress had a legion to defend it against at-
of the large strong stones as the foundation- to our software. If these advisories are not tacks. These troops did not wait for an ac-
al information we need for good situational implemented, adversaries can use these vul- tual attack to begin testing their skills. They
awareness. This foundational information is nerabilities to gain unauthorized access. In practiced their skills regularly to make sure
sometimes referred to as strategic-level situ- short, situational awareness for cyberspace they were ready in case they were needed.
ational awareness. ACO relies on a variety requires obtaining a broad range of products During these practices, the defenders did
of open and classified sources of informa- and fusing these into a cohesive product that not just test their own skills. They also tested
tion to build a strategic-level view of threats the NATO and ACO leadership can use to the walled fortress to make sure fortress was
in cyberspace. The specific sources used are make informed decisions. strong and if the fortress needed reinforc-

"Using the fortress analogy is a good way to explain

the four critical parts required in order to build a strong
cyber defence in any organisation."

not relevant for this discussion. What is im- Plans: Fortress walls need more than just ing, they could find out what type of rein-
portant to know is that this strategic-level irregular stones to be stable. They need forcement was required.
information allows the leadership to look good, strong mortar. There is a critical link- In this same way, the military uses ex-
beyond the immediate vulnerabilities on the age between the stones and the mortar. ercises based on likely scenarios to see if their
networks to see future cyberspace threats. Stones alone do not provide the needed forces are trained properly and ready. Mili-
The medium sized stones can be strength. Mortar alone does not provide the tary exercises also help test defences to see
viewed as operational-level situational stability. Both stone and mortar are needed which need to be strengthened. Addressing
awareness. For ACO, operational-level situ- to be used together to give the wall strength these can take the form of adding additional
ational awareness is handled mostly by the and stability. elements to get better situational awareness
ACO subordinate commands such as JFC In the military, our plans can be or to make the military plans more thorough.
Brunssum, JFC Naples, the Single Service thought of as that crucial mortar in our
Commands, and the NATO CIS Group. cyber defence fortress. The military relies NATO USES a multi-faceted approach
They focus on ensuring they have a good upon many plans to ensure everything re- to cyber exercises. In the first set of exercises,
picture of the vulnerabilities on the net- lated to military operations is considered ACO and subordinate commands incorpo-
works and systems. The identification of prior to conflict. At ACO, we have a number rate cyber scenarios into the existing exer-
these potential vulnerabilities may include of plans addressing scenarios which would cise scenarios. These exercises are large and
determining if there are any single-points- require military action. Cyber is a necessary have more than just cyber defence personnel
of-failure, back-up power and air condition- and vital part of each of these plans. SHAPE participating. The exercises' cyber injects are
ing to network equipment, and if they have handles the development of strategic plans based on likely cyber threats, to include acts
a robust cyber security training programme while ACO subordinate commands develop of aggression, acts of sabotage or even acts of

The Three Swords Magazine 26/2014 33

EXPLORING CYBER DEFENCE

Simply put, the
military needs to
be able to operate
in an environment
where CIS
capabilities are
either degraded
or denied."
The NATO Computer Incident Response Capability (NCIRC) is the nerve
centre of the Alliance's fight against cyber crime. Photograph by NATO.

nature. The exercises' cyber evaluation teams attack. In ACO, we call the results of these
determine how well the exercise players are "what-if " scenarios for cyberspace "Business
able to continue performing their mission Continuity Plans". Simply put, the military
despite degraded or disrupted cyber systems. needs to be able to operate in an environ-
The second set of exercises is dedi- ment where CIS capabilities are either de-
cated to training and evaluating only the graded or denied. Depending on the poten-
cyber forces and cyber defences. Since these tial threat, "Business Continuity Plans" can
exercises are limited in scope involving only be as dramatic as determining how to con-
NATO's cyber forces, not the broader force duct operations without any CIS support.
structure, a greater amount of tactical-level Or the plan could be simpler involving re-
focus can be achieved to test and validate prioritising other lower priority resources
NATO's cyber defences. Both these types, such as communications links or power
the large-scale full-formation and dedicated generation facilities to keep higher priority
cyber defence exercises are needed to ensure operations going.
all aspects of NATO's cyber defences are
looked at thoroughly.
Conclusion @nato.int
Business continuity: The last piece of Cyberspace and cyber defence, on the sur- WATCH THE VIDEO
building and operating our walled fortress face, seem like complex, new entities that ABOUT CYBER
is to work through what we call "what-if " need their own set of paradigms. But as COALITION. GO TO
scenarios. In these scenarios leaders look you can see from the walled fortress anal- NATOCHANNEL TV.
to see what can be done to continue mili- ogy, from an operational military perspec-
tary operations in case something poten- tive, cyberspace and cyber defence are FURTHER READING
tially catastrophic happens. In a walled very similar to the way we conduct sound For these related stories, visit www.aco.nato.int
fortress, "what-if " scenarios could take the military operations in the air, land and sea * NATO Cooperative Cyber Defence
Centre of Excellence, http://www.ccdcoe.org/
form of determining how the legion could domains. We need to leverage expertise * Attacks from cyberspace: NATO's newest
be controlled even if its primary signalling developed over the centuries in the three and potentially biggest threat, General Philip
Breedlove, SACEUR, http://www.aco.nato.int/
methods were destroyed. Or how will food physical domains and apply these to the saceur2013/blog/attacks-from-cyberspacenatos-
or water be conserved in case of prolonged cyber domain. newest-and-potentially-biggest-threat.aspx

34 The Three Swords Magazine 26/2014

cyberspace is rapidly emerging as a "fifth
dimension" of warfare, even if not
officially recognized as one by nato.

CYBER DEFENCE
IN OPERATIONS
By Peter Hutson
Analyst CIS, JCID
Joint Warfare Centre

Introduction
The cyber defence (CD) capability at the years and responded with a steady stream of - not the Army you might want or wish to
operational level is based upon the concept initiatives and activities to move the cyber have at a later time." This quote reflected
that a Joint Force Commander needs to defence capability rapidly forward. Since his sentiment that a deployed Commander
identify and manage operational risks in- 2011, through its NRF STEADFAST col- cannot wait for the ideal capabilities to be
herent in environments under cyber threat. lective training exercises, JWC has had the in the right place at the right time when a
This article examines the status of the cur- tasking and opportunity to witness those crisis erupts, but one has to deploy and con-
rent NATO CD capability and the unique cyber operational level challenges first- duct operations with the capabilities and
nature and challenges of CD in operations hand, and to watch the development of this resources available. This statement rings
as evidenced in the context of the NATO important capability. true for cyber defence in NATO operations
Response Force (NRF) exercise programme. as well. Despite NATO's remarkable prog-
Most recently in November 2013, Deploying with the cyber ress over the last three years that includes
during exercise STEADFAST JAZZ, JFC capabilities you have development of the cyber defence concept
Brunssum (JFC BS) and its components Static commands and organisations - that and policy, organisational constructs, ca-
completed their operatio nal level collec- is, those NATO entities that have a perma- pability packages, education and training
tive training and received their NRF cer- nent physical infrastructure and enduring requirements, and a comprehensive Bi-SC
tifications in a scenario that included a organisational mission - have enough chal- "Cyber Defence Action Plan" - much work
cyber-contested environment. The scenario lenges on how best to respond to the more remains. Nonetheless, the deploying Com-
reflected some of the asymmetric threats routine cyber threat when conducting their mander must be prepared to deploy and
in the real world, in which cyber attacks peacetime missions. A "deployed" multina- cope within existing means and capabilities.
against NATO are becoming more frequent, tional Joint Task Force (JTF) on its way to
organised, and disruptive. Alongside the war, however, has these same challenges and DOTMLPFI perspective. NATO of-
more traditionally recognised air, land, many more. ten measures the status of its capabilities
maritime, and space domains, cyberspace through the lens of a DOTMLPFI construct;
is rapidly emerging as a "fifth dimension" DURING OPERATION Iraqi Free- that is, through an examination of the matu-
of warfare, even if not officially recognised dom, the U.S. Secretary of Defense Don- rity levels of Doctrine, Organization, Train-
as one by NATO. Acknowledging this per- ald Rumsfeld, responded to a query about ing, Materiel, Logistics, Personnel, Facilities,
vasive and dynamic threat, NATO has ac- a lack of armoured vehicles with the quip and Interoperability. The next several para-
celerated its cyber effort over the last three that "you go to war with the Army you have graphs will examine three of those strands:

The Three Swords Magazine 26/2014 35

EXPLORING CYBER DEFENCE

Cyber Defence Doctrine, Organisation, offer the opportunity to "tease out" the is- (CND)? Where do Information Assurance,
and Training. There is no doubt that NATO sues and bring shortfalls and gaps to the INFOSEC, or CIS Security fit in the context
cyber professionals who are in the "know", forefront. The STEADFAST series has of- of Cyber Defence? What is a cyber-attack as
can point to the flurry of point papers, fered a venue not just for training and en- opposed to a CIS Security Incident?
meetings, draft handbooks, workshops, forcement of tradition skillsets, but also During JWC training events, the de-
conferences, and exercises that suggest and as a "doctrinal laboratory" for focused ex- ployed Commander and his staff have had
indeed, reflect significant progress of CD amination and analysis of capabilities and to delve into often conflicting taxonomy,
as a NATO capability and positive momen- functional areas in the context of a relevant policy nuances, definitions and voids to
tum. Synchronising and streamlining such scenario, and a real staff - which is con- create a baseline from which to go forward.
diverse and short-fused activities amongst fronted with the challenge of planning and In SFJZ 13, JFC BS utilized the following
28 Allies, nonetheless, remains a challenge. executing an NRF mission.(2) diagram in its staff Cyber Defence Working
And, as the most recently certified NRF staff Group Terms of Reference (TOR) to pro-
has witnessed - and as measured against Taxonomy: Linked to the creation of mulgate its understanding of the taxonomy
the DOTMLPFI capability yardstick - op- CD doctrine is the need to have a common and organisational inter-relationships. Such
erational CD is in its relative infancy with cyber taxonomy, which would facilitate the models have varied significantly from exer-
NATO. implementation of NATO Cyber Defence cise to exercise and reflect the need for es-
Policy through a shared understanding of tablishing clarity.
Doctrine: There is little to no NATO CD- terms.(3) Language and words do count in
specific doctrine, much less agreed cyber- the cyber business, as they underpin the Organisation: No standard organisa-
related definitions or taxonomy for cyber logic behind development of staff functions, tional structure or model exists yet for CD
for the deployed Commander. This lack of processes, organisation, and legal tools such in NATO for deployed operations and the
doctrine, however, is made more problem- as Rules of Engagement (RoE). last three operational exercises have reflect-
atic by the fact that there is approved NATO What does the word cyber actually ed different approaches with common
Doctrine for Computer Network Opera- mean? Where does cyberspace begin and themes. As with NATO's C-IED capability,
tions (CNO) and Computer Network De- end for the operational Commander? For one common approach has been to estab-
fence (CND) in the context of Information example, how does a staff differentiate be- lish cross-functional staff entities to harness
Operations Doctrine (AJP 3.10)(1), and for tween virtual cyber Joint Operational Area expertise for application and focus to cyber
Information Assurance within the context (JOA) and the more traditional land, air, problems. These entities require inter-staff
of the AJP-6 series - both of which are not and sea domains defined by terrain and and external coordination mechanisms.
always consistent with approved NATO CD geographical boundaries? How is CD dif- And, most importantly, another common
policy and developing NATO cyber taxon- ferent than Computer Network Defence theme has been the growing recognition
omy. Unfortunately, operational missions
can neither afford to wait for resolution
of doctrinal voids nor for absolute clarity; Cyber Defence Cell AOR
the deployed Commander must interpret
and rationalise which documents are valid
or invalid and which ones should be used
to develop staff functions. The NRF staff
must study top-level documents such as the
Cyber Defence Concept and Policy, distill
nuggets that are relevant to the NRF and
operations, and ultimately translate NATO's
general CD aims and objectives into action-
able plans and SOPs. In the absence of an
approved construct, assumptions must be
made in order for the mission to be planned
and executed.
During the STEADFAST series of
exercises over the past three years, this has
been the default situation that the JFCs
have had to face. Yet, this situation should
neither be surprising nor represented
negatively. As with other new or evolving
capabilities (such as C-IED, Knowledge
Development, or STRATCOM), exercises

36 The Three Swords Magazine 26/2014

and lesson that the CD in the Joint Task NGOs were essential to the assessment, level. To achieve that proper level of focus,
Force (JTF) must be J3-led to best address campaign planning and synchronisation. the following training principles have been
critical operational dependencies and mis- advocated by ACT and put into practice at
sion enablers. Outputs: As there is currently no NATO the JWC:
CD doctrine or standard organisation, the
CD within the JTF HQ: In harmony CD outputs of the above organisational Use a building block approach: Train-
with recent Joint Force Command Naples elements had to be developed based on ing must be progressive and must use a
(JFC NP) work, during SFJZ 13, JFC BS best practices of previous exercises. Some building block approach. The content of
provided one representative example of of the key products included: (a) a Cyber each building block and pre-requisites for
how to organise the staff for cyber defence. Prioritised Asset List (CPAL) including its joint collective training must be defined -
As a first step, JFC BS created a Cyber De- updating and maintenance throughout the supported by a "thread" that ties all building
fence Cell (CDC) under J3 leadership that mission; (b) Cyber Risk Assessment Pri- blocks together and provides broad themes.
was augmented by suitable Host Nation oritization Matrix (CRAM), which identi- JWC uses such a "crawl, walk, and run" ap-
LNOs and available NATO-sourced cyber fies cyber dependencies, "risk owners", and proach to CD training and aims to progress
SMEs. The CDC established, monitored contingency plans; (c) Incident Handling its training to more sophisticated levels.
and assessed changes to the cyber elements System to include WARPs (Warning Advice
within their purview to include assess- and Reporting Points), which were man- Address multiple levels of expertise:
ments on NATO, Host Nation, and other dated at all deployed locations and provided Cyber defence education is required for
critical infrastructure, assets, capabilities, the focus for reporting on CD incidents to all users, but each user does not require
resources and information. With support the CDC; (d) Cyber Common Operational the same level of education. The training
from J6/NCIA(4) staffs, the CDC was res- Picture; (e) CD decision and COA Briefs for programmes must recognise the require-
ponsible for reporting and coordination the Commander and other staff elements; ments for differentiated levels of training,
with NCIRC(5) regarding cyber events. The (f) CD inputs into Fragmentation Orders depending on duty requirements.
J6/NCIA staffs continued to retain primary (FRAGOs) as well as Joint Coordination
responsibility for Information Assurance Orders (JCOs). Use realistic scenarios: Training will test
and INFOSEC, while the J2 staff provided concepts, procedures, organisational con-
the threat picture for cyber as part of their Training: Because CD issues are en- structs, and skill-sets. The Training Audi-
standing tasks. The J3 and J3/5 staffs were during in nature, there is a need to insti- ences must be exercised within the context
responsible for leading in planning and tutionalise NATO-wide CD Education and of realistic, relevant, and updated scenarios
prevention measures, and developing op- Training (E&T) for all NATO bodies, static to reflect potential threats.
tions for response and recovery (the conse- and deployable. The requirement has been
quence management). highlighted and staffed by the ACT in the Encompass the Chain of Command:
The CDC formed the core part of a form of a NATO Cyber Defence Education The cyber defence decision-making pro-
broader standing Cyber Defence Work- and Training (E&T) Plan(7), the NATO cesses must be tested both up and down
ing Group (CDWG) that was comprised of Cyber Defence Awareness Concept and the chain. Due to the speed of the cyber
Chairman: J3 (Chair), J3 (Secretary), J6 (core the NATO Cyber Defence Education and incidents, leadership and operators must
member), J2 (core), J5, LNOs from other key Training Concept.(8) Work is underway prepare to execute the necessary actions.
stakeholders(6) (as required), LEGAD, PAO, to unify and synchronise delivery of CD
and STRATCOM. With this level of partici- education, training, and exercise. The il- Be multi-echelon: Training should be
pation, the CDWG was able to coordinate lustration on the next page from the E&T multi-echelon in nature. Conducting col-
and synchronise its CD activities internally plan clearly outlines the needs, goals, and lective events where multiple levels are syn-
and externally. overall end-state for NATO CD, with an chronised and interacting with each other
acknowledgement of increased challenges within the event is the most effective and
External Linkages: Also as seen in ex- of CD when deploying. In operations, this efficient use of resources. In JWC training
ercise SFJZ 13, the CDWG was respon- usually involves both NATO and non-NA- exercises, not only are multiple NATO lev-
sible for interaction with external entities TO networks. els interacting, but the NRF is also trained
including the Host Nation. The CDWG to interact and coordinate with Host Nation
supported the JTF Commander in: (a) iden- ACCORDING TO THE CD E&T and other external entities.
tification of critical vulnerabilities; (b) pri- Plan, CD is recognised as an enduring
oritisation of risks; and (c) implementation training requirement that will be required Use existing expertise: The expertise
of targeted cyber defence measures with a to evolve with the threats, systems, technol- resident in existing NATO civilian and mili-
view to prevent and mitigate the impact of ogy, and the rotation of personnel. Achiev- tary bodies such as, but not limited to, the
a cyber-attack. Active involvement of liai- ing a "train as you fight" focus requires a NCIRC or ACO for operational knowledge
son officers and inputs from the component suitable training regime that is both tailored and experience should be utilized where
commands, other theatre forces, and IOs/ at the individual and collective training practical and appropriate. Additional ex-

The Three Swords Magazine 26/2014 37

EXPLORING CYBER DEFENCE

tives supporting SACEUR's Annual Guid-

ance on ETEE (SAGE) and conducted in
JWC-directed exercises. JWC is involved in
the cyber focus area in the Coalition Warrior
Interoperability eXploration, eXperimenta-
tion and eXamination eXercise (CWIX).
It may be helpful to also obtain syn-
ergies with other venues such as STEAD-
FAST COBALT and CYBER COALITION.
Civilian or military training seminars,
conferences, table top exercises, or experi-
ments could be leveraged as well. As an
example, ACT is leading the Multinational
Capability Development Campaign 2013-
2014, which includes a Norwegian and Ital-
ian-led effort to better integrate cyber into
operational planning.

"One of the early

pertise in current and future Cyber Defence Use existing events: Collective training common lessons
issues resides within Nations, selected part- and exercises will use existing events, both
ners, private sector, and academia. For col- cyber and non-cyber, to the maximum ex-
identified by JWC is
lective exercises, JWC leverages all available tent possible. A number of such exercises the tendency of the
Subject Matter Experts, and in particular, already exist within the Crisis Management Training Audience to
regularly has received support from the Exercise Policy and the Military Training
mischaracterise cyber
Cyber Defence Centre of Excellence (CCD and Exercise Programme (MTEP). Cyber
COE) in Tallinn, Estonia, ACO, and ACT. Defence aspects have been in use in NRF defence as a technical
training objectives and the exercise objec- issue only."

The cyber defence team during STEADFAST JAZZ 13.

Photograph by JWC PAO.

38 The Three Swords Magazine 26/2014

Capture lessons: Every aspect of CD train- not affect NATO's exercise. Nonetheless, one DID YOU KNOW
ing must be evaluated and adjustments made might imagine the complex challenges for a
accordingly. Classroom, exercise, experi- deployed Commander if faced with large- NATO Cooperative Cyber Defence Centre
ments, and certifications will be used to con- scale, sophisticated, and well-orchestrated of Excellence (CCD COE) conducts techni-
cal cyber defence exercises, which allows
stantly improve CD E&T. A quality assurance attack. With shorter and faster decision cy- the participants to learn and test the skills
approach that enables continuous capability cles, kinetic and non-kinetic activities and needed to fend off a real attack.
improvement and a feedback loop completes on-going 24-hour operations, information
the learning model. dominance and decision superiority together The first exercise took place in 2008 as
a joint event between Swedish and Esto-
underpin a successful operation. Under- nian universities organised by the Swed-
Unique challenges of standing and being prepared to operate in ish National Defence College and the Es-
deployed operations cyberspace, including legally and politically, tonian Defence Forces. It was followed by
One of the early common lessons identified is essential. the BALTIC CYBER SHIELD in 2010, which
was organised together with Swedish Na-
by JWC is the tendency for members of the tional Defence College with support from
Training Audience (TA) to mischaracterise Conclusion various Swedish institutions and the Esto-
CD as a technical issue only. The TA has al- CD in NATO continues to evolve and nian Cyber Defence League.
ways appreciated the technical aspects of CD progress. The very nature of cyberspace is
Since 2012, the exercise series is called
and the inherent role of J6/NCIA to manage changing warfare. Cyberspace is both vir- LOCKED SHIELDS. The exercise has a
NATO deployed and static networks, but not tual and physical and CD is not limited to game-based approach, which means that
necessarily the NRF operational vulnerabili- NATO-owned networks. CD in operations no organisation will play their real-life role
ties to cyber threats. Operational missions necessitates new ways of thinking, working, and the scenario is fictional. The Centre is
also contributing to the NATO Cyber De-
require awareness that CD is much broader and interacting vertically and horizontally, fence Exercise (CYBER COALITION) since
than NATO networks and NATO exercises and internally and externally, to manage 2009 by helping to plan, develop, and ex-
have persuaded the JFCs to not only treat operational risks. A mission's success may ecute the exercise.
CD as an operational issue, but also recog- be dependent upon a host of enablers such
Read more at www.ccdcoe.org
nise that cyber incidents can have political, as national critical infrastructure, transpor-
strategic, and economic impact not only for tation systems, banking and commercial
NATO, but its Host Nations and Partners. networks, telecommunications, media, and
internet-based social networks. END NOTES:
THIS KEY POINT was clearly high- At an operational level, ACT and (1) AJP 3.10, Allied Joint Doctrine for Information
lighted during SFJZ 13 not only by the exer- JWC are working together with the JFCs Operations, 23 November 2009 (which is currently
cise play, but also by real world cyber-attacks and cyber community of interest to develop under review).
against NATO's Baltic Partners during SFJZ both the CD capability and educate, train, (2) JFC Naples, for example, continues to develop
13. NATO soldiers were deployed in mul- integrate, and exercise that capability into a JTF HQ SOP 218 for Cyber Defence, which will
tiple forward locations, with the JTF Head- realistic and relevant training venues. likely serve to identify pre-doctrinal processes and
quarters located just outside of Riga. During standard working methods before doctrine is in
SFJZ 13, Baltic media and defence officials place.
reported a growing number of cyber-attacks (3) See ACT's report on Cyber Defence Taxonomy
against state administration, defence, and and Definitions dated 15 July 2013.
private sector homepages. False messages (4) NATO Computer and Information Agency.
were posted on the attacked websites saying (5) NATO Computer Incident Response Capability.
that the security parameters of the website (6) NCIA, NCIRC, JLSG, J4, Component Com-
did not comply with the requirements of mands, and representatives from the other boards
the CCD COE. Personnel in the Baltic and such as the Information Operations Coordination
Polish defence sectors received fake emails Board, Joint Defended Assets Working Group, Daily
in the name of the CCD COE. The Latvian Assets Reconnaissance Board, and Force Protection
News Agency reported that a hacker group Working Groups.
"Anonymous Ukraine" was behind the cy- (7) NATO's Cyber Defence Education and Training
ber-attacks; and partly as a consequence to Plan, updated and forwarded to NATO HQ, 4 De-
these events, the Latvian Defence Minister cember 2013.
emphasised the importance of Latvia's in- (8) These updated concepts were forwarded by ACT
vestment in a cyber defence unit for its Lat- to NATO's Emerging Security Challenges Division, 22
vian Home Guard. October 2013; their aims are to provide a framework
These real world incidents were rela- for detailed analysis of the requirements, and analy-
tively small-scale activities that ultimately did sis of the existing CD training opportunities.

The Three Swords Magazine 26/2014 39

EXPLORING CYBER DEFENCE

S TEPPING
TONES
FOR TRIDENT
EXERCISES

CYBER DEFENCE
TRANSFORMATION
By Lieutenant Colonel H. Todd Waller, United States Air Force; Lieutenant Colonel Joel Gourio, French Air Force
Joint Effects Section
Joint Warfare Centre

THE JOINT WARFARE Centre ent approach after experiencing cyber injects
is preparing to conduct a new series of during STEADFAST exercises and subse-
operational level exercises, beginning with quently treated CD as an information assur-
TRIDENT JAGUAR this spring and reach- ance and mission assurance issue with spe-
ing a climax with the high-visibility exercise cial emphasis on the management of risks to
TRIDENT JUNCTURE 15 in support of the operation and the overall mission. More
NATO's Connected Forces Initiative. specifically, both JFCs initially struggled
Given the importance of cyber de- to manage CD injects within J6 and they
fence (CD) to the Alliance, an appreciation eventually adopted a J3-led approach. J3
of the cyber lessons of STEADFAST (the aspects of CD and the inherent role of the leadership was more successful in char-
predecessor to TRIDENT) is essential for J6 and NATO Communications and Infor- acterising the threat operationally; mar-
achieving a higher level of CD across Alli- mation Agency (NCIA) to manage NATO shalling full Battle Staff support to include
ance operations. This article captures the deployed and static networks. Not so intui- in-demand specialities such as LEGAD,
seven most significant findings (which we tive was the fact that NATO Response Force STRATCOM, POLAD; and in supporting
will call "stepping stones") of the last four (NRF) operational vulnerabilities to cyber the Commander's decision-making via ac-
STEADFAST exercises in which CD was in- threats could extend beyond NATO net- tionable products.
troduced and played prominently. works. The cyber-contested environments
created for STEADFAST exercises enabled Recommendation: Continue J3-led CD
(1) CD is much more than a technical the Joint Force Commands (JFCs) to see with a mission assurance emphasis and with
issue: Operational Battle Staff Training CD more operationally. In fact, both JFC full support from the Battle Staff. J6 should
Audiences readily appreciated the technical Brunssum and JFC Naples adopted a differ- continue its focus on information assur-

40 The Three Swords Magazine 26/2014

 sion of CD into the appropriate Allied Joint (4) WANTED! Comprehensive cy-
Doctrines, with caution not to rush doc- ber defence education and training:
trine development, recognising the value A number of NATO entities such as the
of allowing the JFCs to wrestle with the CD NATO School Oberammergau, the CCD
challenge in the absence of an overly pre- COE, and the Centre of Excellence for the
scriptive guidance. TRIDENT provides an Defence Against Terrorism offer courses
ideal laboratory for NATO Battle Staffs to that address the technical and legal aspects
explore Joint Task Force-level CD solutions. of CD and cyber terrorism, but there are no
courses that survey NATO CD policy, stra-
(3) Cyber defence SMEs are the key to tegic guidance, and organisation which puts
A+ performance: The quality of CD play it into an operational context. There are no
ance. Incorporate operational CD findings in exercises depends on the quality of the courses that introduce cyber incidents in a
into strategic documents. For example, a exercise script and Subject Matter Expert comprehensive way that include informa-
more comprehensive taxonomy is required (SME) support during exercise planning tion and mission assurance considerations.
than the current MC 0571 definition of CD, and execution. The pool of CD SMEs with-
which is "the application of security mea- in NATO is limited, however, operational
sures to protect CIS infrastructure compo- CD expertise is emerging in the JFCs with
nents against a cyber-attack." STEADFAST as a catalyst. The Cooperative
Cyber Defence Centre of Excellence (CCD
(2) Operational level cyber defence is COE) and the NATO Computer Incident
emerging and needs nurturing: CD di- Response Capabi lity (NCIRC) are also
rection and guidance across NATO exists at sources of CD expertise, but their support
the strategic level, but the operational level is subject to competing requirements. TRI-
guidance is limited. Consequently, the JWC DENT JUNCTURE's ability to provide an
approach to CD has been to create realis- effective means to test and refine CD exper-
tic cyber threats and incidents without be- tise in a simulated operational environment
ing overly prescriptive in how HQs should to include tactical, operational, strategic CD
respond. This has allowed the Joint Task reporting mechanisms makes it a valuable Recommendation: Establish CD Educa-
Force and component command HQs to le- CD venue for all NATO CD stakeholders. tion and Training in NATO that addresses
verage the intellectual capital of their staffs operational and technical aspects. Incorpo-
to work through the problem and gener- rate NATO CD policy, strategic and opera-
ate innovative solutions. Accordingly, JFC tional level documents and CD organisation
Naples produced Standard Operating Pro- into training curriculums. Incorporate CD
cedure 218/Cyber Defence, which was ap- into existing training venues (i.e. Opera-
proved by SHAPE in August 2013, and was tional Planning Course at NATO School).
further adapted by JFC Brunssum for use Encourage broad NATO Command Struc-
in STEADFAST JAZZ 13 (SFJZ 13). ture (NCS) and NATO Force Structure
(NFS) participation to include CIS and non-
Recommendation: Establish a Bi-SC CIS professionals.
Working Group to nurture a common CD
understanding and include all CD stake- Recommendation: Establish TRIDENT (5) Empower cyber defence during Cri-
holders across the Alliance. Ensure Al- as a priority with support from key CD sis Response Planning (CRP): As a disci-
lied Command Transformation and Allied stakeholders. Use TRIDENT to rehearse pline across the Alliance, CD is still emerg-
Command Operations (ACO) appreciate and refine CD reporting mechanisms. The ing and this is most evident during the
the CD findings obtained during SFJZ 13 JFCs should provide SME support for each planning phase of an operation. The JFCs
and incorporate them into strategic CD other's certification exercises, enabling each made progress by defining planning activi-
documents. ACO and its subordinate com- command to gain value from every NRF ties and products in SOP 218, but planning
mands should continue to refine SOP 218. certification exercise. Establish and imple- efforts to date are immature. Crisis planning
The JFCs should integrate CD into daily ment NATO training to increase the pool activities are by nature high-pressure events
battle rhythms and continue to mature of CD SMEs. Leverage CCD COE expertise with short timelines and many required
their CD concepts in and out of exercises to develop a corporate knowledge base for products. This environment can be at odds
with consideration of cyber threat impacts operational CD. with the creative and innovative thinking
to static HQ operations. The NATO Stan- necessary to develop the most resilient plans
dardization Agency should consider inclu- for cyber-contested battlefields. A number

The Three Swords Magazine 26/2014 41

EXPLORING CYBER DEFENCE

of limiting factors were identified during As a result, the "train as you fight" approach
CRP events to include: (1) a limited un- is not fully implemented, however, employ-
derstanding of CD operational relevance; ing real exercise cyber attacks could degrade
(2) a lack of confidence in producing cyber the exercise network to the detriment of
threat analysis; (3) a lack of understanding meeting all exercise Training Objectives.
of available CD resources (i.e. Rapid Re-
action Teams, contract support, national Recommendation: Limit CD in TRI-
support); and (4) a limited understanding DENT to simulated incidents until ACO's
of strategic/political-level cyber sensitivi- implementation of CD is more mature. Use
ties and how these could influence mission other exercises, such as CYBER COALI-
accomplishment. TION, CWIX and STEADFAST COBALT,
Recommendation: Establish Bi-SC CD to conduct testing of computer networks.
Working Group to synergise CD activities, Explore the costs and benefits of linking
facilitate information sharing, and develop such exercises (perhaps as part of the Con-
common objectives. Standardise CD play nected Forces Initiative) in order to better
in NATO exercises to the extent that sup- replicate the "train as you fight" concept
ports those common objectives. Develop a without incurring excessive risk to the TRI-
repository of CD Lessons Learned for use DENT exercise network.
across the Alliance. A repository of MEL/
MIL products would be useful for exercise
planning staffs.
Recommendation: Update the Com-
prehensive Operations Planning Directive (7) Achieve more realistic CD training
to include CD. Fill the CD training void. without excessive risk: CIS is provided
Conduct CD planning during day-to-day to support exercises without being part of
JFC activities. Continue to mature planning the "tested" Training Audience. CD injects
products and processes (e.g. Cyber Priori- are scripted/simulated and do not involve
tised Asset List and Cyber Risk Assessment the introduction of malicious software that
Matrix generation). Establish coordination could be used to test real exercise networks.
between JFCs, component commands, and
NFS elements. The NATO Intelligence Fu-
sion Centre should provide cyber threat
analysis support to NCS and NFS and train
intelligence personnel how to conduct such
analyses. Encourage Ope rational Liaison
Reconnaissance Teams (OLRT) to make CD
a priority during TRIDENT. Assign CD staff
during CRP that have the capacity to think
creatively and to teach/coach the planning
staff to do likewise.

(6) Create a playbook for all cyber

defence-related exercises: Coordina-
tion and information sharing between the
various NATO cyber defence-related ex-
ercises (TRIDENT, CYBER COALITION,
STEADFAST COBALT, CWIX, CMX, etc.)
have been limited. Unity of effort could
enhance the consistency and efficiency of
CD-related exercise planning and execu-
tion activities across the Alliance.

Use TRIDENT to rehearse and refine cyber defence reporting mechanisms.

CJOC TRJR 14, Menorca, Spain. Photograph by JWC PAO.

42 The Three Swords Magazine 26/2014

TO OPERATIONALIZE
CYBERSPACE

By Lieutenant Colonel Florian De Castro, United States Air Force

Chief Nuclear Operations and Cyber Defence Cell
HQ Allied Joint Force Command Naples (JFC NP)

Due to the lack of a common definition or now. In the past, people were able to move this distance coincides with the maximum
taxonomy, the terms internet, world-wide freely from one land or maritime area to range a cannon shot could be fired and the
web, cyber and cyberspace will be used in- another similar to how we can move from area that a nation can protect from shore(1).
terchangeably throughout this article. one website to another. Over the years, we As technology and commercial interests

I
sub-divided continents under different advanced, the concept of territorial waters
names such as the Americas, Eurasia, and were legally defined and led to 12 nautical
T HAS ALWAYS BEEN as- Africa but these are all the same landmass miles (22 km) as the suitable internation-
sumed that the internet or cyberspace i.e. they are all one land that is part of the ally accepted limit(2).
domain is considered without borders, Earth's crust. The same can be said for the The same can be said for air with the
and for a relatively brief period in the oceans since they are all the same body of development of air routes, air corridors and
early 1990s, it was. But by 1996, the water. In military terms, we operationalized air defence identification zones (ADIZ).
raw, unfiltered internet that most people and sub-divided the different domains since In the early days of the air domain, a pilot
think of now has started disappearing. The it allows us to manage these vast areas more could fly anywhere. The development of ra-
same technology that allows for global in- easily. The two newest domains started this dar, fighter interceptors and surface to air
terconnection has created the cyberspace process about one hundred years ago for air, missile (SAM) combined to produce an in-
borders and boundaries that most people and fifty years ago for space. The operational tegrated air defence that quickly restricted
do not know already exist. These are the development of the air and space domains unauthorised flights at less than 70,000 feet
same borders and boundaries that national was patterned after the land and maritime. (21.3 km). It took the 1960s shoot-down of a
governments, and by extension the milit- In order to further develop the cyberspace U-2 to acknowledge that the idea of an Open
ary, need to further develop in order to ac- domain we will have to draw suitable analo- Sky now has limitations and nations can and
complish their defensive missions. To truly gies from the other domains. will protect their sovereign airspace(3).
accomplish cyber defence, NATO will need For the land domain, the develop-
to operationalize the newest domain of cy- ment of cities and roads led to national WHILE IT CAN BE argued that space
berspace as was done with the other four borders and in military context, armed is vaster than cyberspace, space is not with-
domains of land, maritime, air, and space. checkpoints to defend those borders. In out its own limits and boundaries. We have
the maritime domain, the concept of ter- subdivided space around the Earth into three
THERE WAS A time in human history, ritorial waters was institutionalised. From orbital regimes of Low Earth Orbit (LEO),
about twenty thousand years ago, that the the 17th to 18th centuries, territorial wa- Medium Earth Orbit (MEO) and Geosta-
land and maritime domains were seen as ters were roughly three nautical miles (5.6 tionary Earth Orbit (GEO)(4). Each orbital
vast and borderless as cyberspace is seen km) wide. For some European countries regime has their particular military advan-

The Three Swords Magazine 26/2014 43

EXPLORING CYBER DEFENCE

tages and disadvantages similar to other

domains. In the last twenty years, space has
become as congested, contested, and com-
1A. DOMAIN EVOLUTION OF WARFARE
petitive as the other domains(5). This con-
gestion and competitiveness can be seen in
the GEO orbit due to the limited number
of available orbital slots. The commercial
value of these orbital slots eventually led to
development of international laws advocat-
ing for using space for the benefit of all. Yet,
despite international consensus of peaceful
uses of space, it has not prevented nations
from developing offensive and defensive
military capabilities similar to those seen in
the other domains(6). Figure 1A depicts the
time it took for each domain to evolve and
mature, while Figure 1B how quickly cyber
has evolved compared to the air domain.

IN ORDER FOR NATO to re-adjust

its perspective, the Alliance will need to
consider cyberspace as it does the other
domains. There are three intertwined devel-
opmental concepts that must be addressed input debugging, matching streams via but the technology and air defence concept
with regards to cyber. These are situational headers, content, and/or timing as well as still took time to organise, conceptualise.
awareness; legal-international consensus on employing reverse flow and performing It took time to construct a detection net-
cyber taxonomy, rule of law and warfare; network ingress filtering(7). Most of these work with sufficient sensors, communica-
and the means of enforcement. These con- terms are probably foreign and may as well tion sites, ground visual observers, and
cepts are not fully developed for cyberspace be another language. So the easiest way to fighter interceptor bases. One could argue
and it is through these concepts that we de- operationalize or translate is via an anal- that cyber attribution is so difficult since
veloped practical military perspective and ogy to the other domains, specifically the one would have to trace back the activity
utilisation for the other domains. air domain. Attribution is difficult because through multiple countries. That the con-
In all domains, the military cannot of the lack of situational awareness. cept of "radar" in cyberspace cannot be used
engage an adversary that it cannot detect. In What cyberspace needs is the air do- since it would mean going into other coun-
fact, the issue of attribution is one of the ma- main's equivalent to radar and an air de- tries' potentially sovereign areas. But how is
jor challenges of cyberspace. From a techni- fence concept. However, the radar equiva- that different from current radar technology
cal point of view, attribution would require lent for cyber has yet to be fully developed and concepts? Radar does not end at the
in-depth knowledge of gateways, internet and matured. The technology exists for cy- geographic or political borders; in fact, one
protocol, store logs and traceback queries, ber just as it was for the radar in the 1940s, can detect radar emissions from neighbor-
ing countries in all domains. In other words,
radar does not stop at the borders, so should
cyber's "radar" need to stop at the cyber bor-
ders? Cyber's "radar" would allow the track-
ing of the adversary to its source emitters
that may have been routed through several
countries' internet service providers (ISP)
and gateways. To increase situational aware-
ness, cyber would require the equivalent
to an aircraft's identify-friend or foe (IFF)
"What cyberspace transponder. Of course, this would require
needs is the air some update to how internet protocol (IP)
domain's equivalent data packets are addressed and routed.
Figure 2A shows the current compo-
to radar and an air sition of IP data as it goes through the in-
defence concept." ternet(8). Why not add an additional source

44 The Three Swords Magazine 26/2014

 one can stream digital movies and media
anywhere there is an internet connection,
1B. EVOLUTION OF CYBER WARFARE but this is not the case. The commercial en-
(Paralleled militarisation of other domains) tertainment industry has established elec-
tronic borders and has applied the same
digital rights management to its property on
the internet as it has with its physical prod-
ucts. Most media services coded as Region
I cannot be accessed from certain Region
II European IP points and some streaming
media are not available at all. Yes, there are
ways to go around these restrictions, but for
the most part, the commercial entertain-
ment industry has been able to enforce its
restrictions in cyberspace. The taxonomy
for the commercial entertainment industry
is the same regardless of whether it is in the
physical or cyberspace domain. In fact, even
the prices are the same.

FOR THE LAST CONCEPT, means

of enforcement, the old saying, "the best
defence is a good offense" or at least "active
location tag, to the IP data thus allowing for also do. These national and international defence" describes every military domain to
increased situational awareness as shown laws developed as each domain matured include cyber. Soldiers cannot accomplish
in Figure 2B? To accomplish this would re- and commerce increased. The problem with their missions wearing just body armour.
quire legal and international cooperation cyber is that while the other domains have Soldiers require weapons to accomplish
and consensus with regards to cyberspace. had time to develop, the use of cyber as part their stated military objectives. Even Bal-
For the second area, legal-interna- of a military operation do not have the same listic Missile Defence utilises an offensive
tional consensus on cyber taxonomy, rule of luxury of time. NATO could pioneer the in- system for defence(9). All military strategies
law and warfare, there must be a common ternational operationalization and normali- and strategists from Machiavelli to Clause-
framework for definitions and understand- sation of cyber so that it is treated similar witz describe this dual need. In Chinese
ing regarding cyberspace. What are the to the other domains. One example of in- philosophy, one cannot have a Yin without
terms of references? How is legal warfare ternational normalisation can be seen in the a Yang. NATO has established a capable de-
defined for cyberspace? What is considered commercial entertainment industry, televi- fence for most cyber threats, but that is just
an act of war? Each of the other domains has sion and movies. Most are familiar with the the first step and what needs to quickly fol-
these common frameworks defined. Air and different regions with regards to DVDs such low is the development of "active defence"
space derived their legal and international as Region I for the USA and Region II for capabilities. NATO must realise that the
principles largely from their predecessors, Europe, Region III for Asia and so forth. offensive capability of cyber surpasses any
land and maritime, which cyberspace can With the internet or cyberspace, in theory, defensive capability that can be implement-

Figure 2B: Cyber IFF example

Figure 2A: Sample encapsulation of application
data from UDP to a Link protocol frame

The Three Swords Magazine 26/2014 45

EXPLORING CYBER DEFENCE

ed. The area that needs to be defended is so

vast that it does not matter how "resilient"
the cyber network is. NATO will not be able
to "deter" the most determined adversaries
without an offensive capability. The military Project Lead: Norway, Italy
analogy is that NATO has built the equiva- Project Contributors: Austria, Canada,
lent of a Cyber Maginot Line against a Cy- PROJECT Denmark, Finland,
ber Blitzkrieg. One should not infer that the TEAM Hungary, Netherlands, Spain, Sweden,
Maginot Line is not needed, but that the Switzerland, United Kingdom and EU
Blitzkrieg is equally needed. We must not Project Observers: NATO, United States
forget that although NATO is a defensive
Alliance, the Alliance possesses equal mea-
sure of defensive and offensive capabilities.

"THE SUPREME ART of war is to

subdue the enemy without fighting"... Sun
Norway co-leading the
multinational project
Tzu's quote describes the potential future
of cyber as a war-fighting domain. While
NATO has planted the seed for this potential
future, the Alliance must continue the opera-
tionalization of cyberspace to co-equal the on cyber defence and
operational planning
other domains by addressing the three devel-
opmental concepts of situational awareness;
legal-international consensus on taxonomy,
rule of law and warfare; and the means of en-
forcement. Only then can NATO develop the By Siw Tynes Johnsen
proper military perspective and utilization Norwegian Defence
for cyberspace. Research Establishment (FFI)

MODERN SOCIETIES ARE GROWING INCREASINGLY

dependent on cyberspace, and modern armed forces are no ex-
END NOTES:
ception. Cyberspace influences operational activity in all of the
(1) While the three nautical mile/cannon-shot warfighting domains. Despite this, there is still a gap in the knowl-
rule applied more for the Mediterranean countries edge of those aspects of the cyber domain with an impact on op-
and Holland versus the Scandinavian countries, it erational planning and execution. In its aim to fill this gap, Norway
served as a suitable accepted compromise between has taken on the leadership role of a multinational project team
the different countries at the time. seeking to integrate cyber defence into joint operational planning.
(2) Law of the Sea - how 12 nautical mile became NATO's Joint Warfare Centre (JWC) is a highly valued partner in
the accepted definition for a nation's territorial waters. this project, and has provided a crucial multinational perspective.
(3) On May 1, 1960, CIA pilot Francis Gary Powers
was shot down over the USSR. Multinational Capability Development Campaign
(4) LEO is considered up to 2,000 km, MEO from This particular project is part of the Multinational Capability De-
2,000 km up to 35,786 km and GEO is at 35,786 km. velopment Campaign (MCDC) 2013-2014, and the Norwegian
(5) Space is now congested due to man-made project team consists of personnel from the Norwegian Defence
waste left behind as satellites are launched or the Research Establishment (FFI) who are using FFI's technologi-
growing number of inactive satellites. cal and analytical competencies. MCDC is a continuation of the
(6) The 2007 Chinese anti-satellite (ASAT) test is the Concept Development and Experimentation (CD&E) campaign,
latest example of the further militarisation of space. formerly known as the Multinational Experiment (MNE) series.
(7) Techniques for Cyber Attack Attribution. MNE-7, which was the final campaign in the MNE series, dealt
(8) http://en.wikipedia.org/wiki/Internet_Protocol with securing freedom of action in the global commons and iden-
(9) The original design for the Patriot System is as a Sur- tifying their interrelationships. The MCDC 2013-2014 campaign
face to Air Missile (SAM) system. A defensive weapon is the next logical step and focuses on combined operational ac-
used to offensively strike at approaching enemy aircraft. cess. Operational access is defined by the United States' Joint Op-

46 The Three Swords Magazine 26/2014

erational Access Concept (JOAC) as "the ect also aims to produce a handbook where first draft of the guidelines and handbook
ability to project military force into an opera- contexts and circumstances in the cyber to the participants to consider and com-
tional area with sufficient freedom of action domain, focusing specifically on situational ment on. The third and final workshop,
to accomplish the mission." The JOAC states awareness and operations, are defined, dis- before stepping into the experimentation
that the emergence of the cyber domain as cussed, and analysed. This handbook could phase, focused on editing the final version
an increasingly contested domain makes serve as an educational tool for stakehold- of the guidelines and handbook. This work-
joint and combined operations more com- ers and parties with an interest in joint op- shop was hosted by the Norwegian Armed
plicated, and potentially increases the vul- erations and cyberspace, and would provide Forces Cyber Defence at the Jrstadmoen
nerability of a joint force in need of access. more comprehensive information to mili- Camp, right outside the town of Lilleham-
The cyber efforts within MCDC are tary professionals with a keen interest in mer, in March 2014. In September, during
co-led by Norway and Italy, and the two exploring the cyber domain. the experimentation phase, the multina-
countries are separately responsible for one tional group will travel to Spain, where the
out of two strands of Concept Development Process operational planning coordinators will test
and Experimentation. The part of the proj- The Concept Development Process has and evaluate the products developed. The
ect led by Italy focuses on challenges related been led by the Norwegian Defence Re- crucial feedback gained from this phase will
to data analysis in the cyber domain and search Establishment, on the one hand, and help make the products as useful and appro-
open source intelligence. Through extended MCDC Partner Nations and organisations priate as possible for use in real operational
discussions with national and international participating actively, on the other. In turn, planning processes. The project sign-off will
partners ahead of the project's starting date, partners also host multinational workshops be marked by an integration workshop in
it became evident that there were still issues that allow the participants to get together to Austria in October 2014, where the lessons
remaining in terms of integrating the cyber discuss and share their knowledge. learned from the experiment will be added to
domain into the joint Operational Planning The first workshop of this kind took both the guidelines and the handbook.
Processes. A majority of the MCDC par- place at the European Defence Agency in
ticipants use NATO's Comprehensive Op- Brussels, Belgium, in October 2013. The
erational Planning Directive (COPD) when focus was on networking and conceptual Contact information
planning joint and combined operations, discussions with the aim to identify the Are you interested in learning more about
which makes MCDC an ideal forum where guideline's contents as well as that of the the Norwegian Defence Research Estab-
one can find solutions for this process. Oth- handbook. The second workshop was held lishment's work in the area of cyberspace
er planning processes follow similar steps, in Bern, Switzerland, in December 2013. and operational planning? Don't hesitate to
which would make it easier for nations to This time the group brought a more hands- contact the project leads: Siw Tynes Johnsen
adapt the product to fit national needs. on, detailed approach to the table, as the ([email protected]) and Ragnhild
Norwegian team had provided a rough, Siedler ([email protected]).
Operational Planning Products
The aim of this project is to develop two
supporting documents, which would sup-
port the multinational planning processes
such as the COPD, and to inform the plan-
ning coordinators of issues related to the
cyber domain. These documents seek to
increase cyber situational awareness and
better inform a combined joint force of the
cyber aspects of the operational environ-
ment. The first document is the guidelines
for cyber integration throughout the COPD
planning, Phases 14b. It is a document in-
tended to serve as a step-by-step guide for
the planning coordinator, pointing to where
and how specific cyber aspects should be
considered. What is perhaps especially
crucial is to address the cyber elements as
early as in Phase 1, which focuses on achiev-
ing situational awareness. The goal for this
document is to be concise in order to make Central at Jrstadmoen, for the protection of
it useful for a planning coordinator who is critical infrastructure. Photograph by Sindre Srhus.
working towards tight deadlines. The proj-

The Three Swords Magazine 26/2014 47