Inside an unassuming office building, a few floors up and tucked into a spread of austere rooms, is Operation Cyber Dragon. The brainchild of Chief Warrant Officer Scott Bryson, the hands-on endeavor authorized by U.S. Fleet Cyber Command aims to fix virtual vulnerabilities — shoring up systems bit by bit — while also fostering a new wave of cybersecurity expertise.

“We’re doing it so that we can continue to mitigate and fortify our attack vectors and secure our networks even better,” Bryson told reporters July 22, while standing among computers, cubicles and colleagues.

Cyber Dragon kicked off in March, with the second phase of the program now underway. In its current form, the operation is focused on fortifying unclassified networks and rooting out common, widespread digital weaknesses: lax security settings, easily guessed credentials, unpatched software and more.

Doing so, officials said, makes its more difficult for hackers to break in and wreak havoc. According to the Navy, some 14,500 issues were initially identified on service networks as in need of addressing. Each could be a foothold for an adversary, especially at a time of heightened cyber conflict. Deputy Chief of Naval Operations for Information Warfare Vice Adm. Jeffrey Trussler in a February memo warned sailors that “cyberattacks against businesses and U.S. infrastructure are increasing in frequency and complexity.”

To tackle such a large and evolving workload, manpower was needed. So Bryson turned to the reserves, including to people not necessarily cyber fluent.

“I went to the reserve forces that we have at 10th Fleet, and I requested some bodies, and I came up with a training plan. And I said, ‘Well, if you give me X amount of sailors for X amount of days, I think that we can get after a percentage of our vulnerabilities, patching and scanning.’ The reserve force came through with the manning, they came through with the space,” Bryson said.

“When we did the posting, it wasn’t limited,” he added. “I said I’ll take anybody.”

Among the dozens of participants were, by day, a long-haul truck driver, a banker and a small-business owner. The operation offers reservists the chance to fulfill annual training requirements while also making a tangible difference.

Cyber Dragon teams have thus far identified and remediated thousands of issues — everything from several “high-profile exposures” to default usernames and passwords to discovering “data where we didn’t want data to be,” according to officials involved with the effort.

“A default username and password means that anybody could could log in and execute on here, on these particular machines. Now, they weren’t national security-related. There was no major issue directly to national security,” said Rear Adm. Steve Donald, the deputy commander of Fleet Cyber Command/U.S. 10th Fleet. “But in some cases, it could have caused harm to individuals, identity theft or something of that nature. We were able to shut that down.”

Teams have also zeroed in on potential spoofing certificates, risky software use and cloud management hiccups. Some 50 sailors have been trained on state-of-the-art attack surface management software, used to discover, classify and assess the security of an organization’s assets, with 100 more expected to undergo the same education in the coming months.

Lt. Blake Blaze, a reservist with a cyber and tech background, said the operation has improved both his understanding of the field and the cybersecurity of the Navy.

“My biggest motivation for staying in the reserves was I wanted to be close to the fight in case things get interesting with some of our near-peer adversaries,” Blaze said. “We’re not directly engaging with the enemy, so to speak, but we are trying to prevent their avenues of access to our networks.”

Both Bryson and Donald said they foresee a bright future for Cyber Dragon. As long as there are bugs to fix and the will to fix them, they said, the operation is viable. And Cyber Dragon’s format makes it mobile and replicable, appealing to workspaces and workforces of all sizes across the U.S.

All that’s really needed is floor space, network connectivity and a few tools from third-party vendors.

“The interesting thing in the IT world or the network world is what’s patched and 100% compliant today might not be patched tomorrow, because vulnerabilities ebb and flow,” Bryson said. “So do I think that this has legs to continue on? Absolutely.”

The other transaction authority agreement, announced July 13 by the U.S. Army, runs through October 2023. Lockheed will provide prototypes mounted into Stryker combat vehicles ready for operational assessment and issuance to an initial unit.

The TLS-BCT is considered a next-generation platform for the Army that brings the service one step closer to satisfying the joint all-domain operations philosophy, a holistic approach to planning and fighting. The system is designed to boost awareness and offer troops more offensive options that can deny or degrade enemy systems.

Officials have said the TLS-BCT will help defeat contemporary threats on an increasingly digital battlefield. Modern warfare often revolves around control of the electromagnetic spectrum, which is relied upon to communicate with allies and identify and suppress adversaries.

“The new integrated suite of signals intelligence, electronic warfare, and cyberspace operations provides the warfighter with critical situational awareness of the enemy through detection, identification, location, exploitation, and disruption of enemy signals of interest,” said Ken Strayer, the project manager for electronic warfare and cyber at the Army’s Program Executive Office for Intelligence, Electronic Warfare and Sensors.

The deal announced Wednesday is the latest advancement in the effort, and marks another win for Lockheed.

The Maryland-based aerospace and defense company in September won a $9.6 million second-round contract, beating out Boeing subsidiary Digital Receiver Technology and allowing it to continue development.

At the time, Lockheed said it would spend a few months finalizing hardware and software designs based on previous experience and soldier feedback.

Deon Viergutz, vice president of Lockheed’s spectrum convergence division, on July 14 said he and his team were “pleased to continue” their partnership with the Army and its program “that will help soldiers operate effectively within the electromagnetic spectrum.”

“TLS-BCT is an example of Lockheed Martin’s 21st century security vision in action, taking a cutting-edge program from concept to fully fielded prototype under an aggressive schedule to put this important capability into the hands of the warfighter, helping them be ready for future mission needs,” Viergutz said.

The Army this year identified a power problem associated with new networking tools and older Strykers during a live-fire exercise in Germany. Officials on June 23 told reporters the matter was under investigation and would be fixed, and that a solution may already exist with newer variants.

The Program Executive Office for Ground Combat Systems, which works with Strykers, was looped in to help.

Speaking during a C4ISRNET webcast, Kenneth McNeill said an initiative called “Bring Your Own Approved Device” would allow guardsmen to use personal mobile equipment to perform the same functions in the field that they would otherwise carry out at a desktop in their offices.

“In a typical state, all of our guardsmen, unfortunately, they may not have government-furnished devices — mobile cellphones, iPads,” McNeill said. “It cuts down on time when we’re planning for a mobilization.”

The initiative, which is a collaboration with the Department of the Army and the Pentagon’s cybersecurity office, is in its third phase of a pilot program consisting of a yearlong trial with the largest sample size to date. After this trial, if deemed successful, the initiative will be enacted, McNeill said.

Work began on the initiative before the pandemic, which drove a transition to remote work. The realities of the situation forced the Guard to accelerate its efforts.

“This is another tool in the toolkit that will give us an opportunity to allow our workforce, even after the pandemic, to continue to telework and [perform] remote work that is critical in the National Guard,” McNeill said. “I don’t think we’re going back [to] everyone in the office. I think this is the future of how we’re going to operate here in the government and in the Department of Defense.”

While deployed to the streets of Washington, D.C., following the Jan. 6 insurrection on the Capitol, the National Guard employed a similar capability called Commercial Virtual Remote to carry out the mission that was limited in scope and time.

“Now we will have a capability that really links our force, even before they are called up for deployment,” he said. “This will be a game-changer.”

JADC2

McNeill also discussed an addition to the Joint All-Domain Command and Control concept being implemented by the DoD that would focus on the needs of the National Guard’s mission set. Called “Project Homeland,” the initiative would apply the same capabilities of JADC2 to the domestic front.

JADC2 is a project by the Department of Defense to connect all the sensors from the individual services and compile data collected into a single information network. Previously, each service had their own tactical networks that were unable to interface with each other.

“JADC2 is a warfighting necessity to keep pace with the volume and complexity of data in modern warfare and to defeat adversaries decisively,” the department said in a statement. “JADC2 enables the Joint Force to ‘sense,’ ‘make sense,’ and ‘act’ on information across the battle-space quickly using automation, artificial intelligence (AI), predictive analytics, and machine learning to deliver informed solutions via a resilient and robust network environment.”

Project Homeland would apply those same capabilities during domestic deployments across the 54 states and territories National Guard units and their civilian interagency partners as opposed to the military services and their coalition forces.

McNeill spoke to the challenges the National Guard faced during their humanitarian relief operations post Hurricane Katrina. On the ground, the Guard was unable to talk with the local first responders because they did not have cross-banding communication systems.

“We learned from that experience that we’ve got to think out of the box,” McNeill said. “We’ve got to look at capabilities that can talk to first responders and focus on what we do in the homeland.”

Their target – critical Ukrainian government data.

As the multi-pronged invasion commenced, cruise missiles struck a Ukrainian governmental facility housing servers full of important data. At the same time, Russian cyber operatives conducted “wiper attacks” on computer networks – attempting to delete all the stored information.

Despite the sophisticated and holistic nature of the Russian attack, the Ukrainian data survived the onslaught. For a week earlier, it had been virtually smuggled out of the country. The data which had once singularly been stored on physical servers, had been uploaded to the cloud.

“The key to a country’s digital resilience in wartime is the ability quickly to move data outside the country while still connecting to and relying on it for a government’s digital operations,” according to a report from Microsoft on the cyber lessons of the Ukrainian war. “One reason these kinetic and cyberattacks have had limited operational impact is because digital operations and data have been disbursed into the public cloud,” it said.

Microsoft, which competes with Amazon, IBM, Salesforce and other software and computer networking companies in providing cloud services to governments, published the report, “Defending Ukraine: Early Lessons from the Cyber War,” on June 22.

Prior to the Russia-Ukraine war, a data protection law prohibited the Ukrainian government from utilizing the cloud to store and process data, forcing all the data to be centralized and vulnerable, according to the report. The law was amended just days before the invasion to permit the very same information to be housed on the cloud.

The cloud is a system of decentralized, networked computer servers spread out all over the world. Stored data, often encrypted and secure, is housed in duplicate across multiple servers and can be accessed via the internet from any location. The redundancy means that even if one server is destroyed, the data is not lost because it is copied elsewhere.

Governments around the world have been exploring the idea of adopting the cloud for official use. The Pentagon awarded Microsoft a contract for just that reason in 2019 before rescinding it less than a year later. New DoD contracts for cloud computing are expected to be awarded this year.

“It’s also important to think about the longer-lasting lessons that come from these efforts,” the Microsoft report said. “The last few months in Ukraine illustrate the very different defense needs that prevail during a war.”

COVID literally re-wrote how business was conducted. As individuals moved from offices to homes or other places, endpoints proliferated, expanding the attack surface.

Russia’s recent invasion of Ukraine catapulted cybersecurity to the forefront of public and private agendas. And the attack objective has changed from extortion and espionage to destruction. The invasion exposed the cybersecurity threat raising the stakes to ensure the security of networks and critical infrastructure.

There are examples demonstrating how those who wish our nation harm are significantly ramping up their willingness and capability to launch cyber attacks. The increased intensity and sophistication of attacks against some of the U.S.’s largest financial institutions demonstrate that cyberspace has blurred the lines between instruments of national power.

The coordinated cyberattacks executed by Russia as part of its strategy in invading Ukraine prove the readiness of adversarial state actors to engage in cyber warfare against any target deemed even potentially threatening. A sense of urgency ensuring that steps are taken to protect networks, including Operational Technology, is paramount. That should be top of any CIO’s and CISO’s ‘To Do’ list.

Consequently, the U.S. government’s focus on cybersecurity has ramped up. In a March 2022 executive statement, President Joe Biden warned of the potential for Russia to conduct malicious cyber activity against the U.S. and encouraged the private sector to harden their cyber defenses.

The Biden Administration has taken deliberate action to confront these growing threats, including a focus on securing the electric, oil/pipeline and water sectors. The Cybersecurity and Infrastructure Security Agency launched the ‘Shields Up’ initiative, offering recommendations for corporate leaders to thwart ransomware.

CISA’s Binding Operational Directive 22-01 provides a catalogue of vulnerabilities that are being actively exploited in the wild. Further, the fiscal 2022 National Defense Authorization Act tasked the Department of Defense with establishing implementable baseline cybersecurity requirements for OT, highlighting the need to harden these devices against cyberattacks.

While I was at DoD and DHS, I viewed Comply-to-Connect and Continuous Diagnostics and Mitigation as a path to enforce Zero Trust principles. Protecting access to data resources was a perpetual concern. What compelled me to think that way was the emphasis in the C2C policy to assess an endpoint’s security posture before granting any access to resources on the network and then to continuously monitor the security of the endpoint. C2C is a foundational building block of Zero Trust ensuring secure access to data.

The C2C and CDM programs offer an opportunity to move out quickly by maximizing existing resources. For instance, DISA’s funded C2C program offers the ability to discover, identify, and categorize all six categories of endpoints defined by Cyber Command. This includes platform information technology such as ICS, SCAD and medical devices. By leveraging C2C, the cyber readiness of networks and OT devices are improved and objectives in the FY22 NDAA can be met.

On the civilian side, leveraging existing tools acquired through CDM can assist agencies in meeting the goals outlined in the Zero Trust Executive Order.

The cyber domain will continue to be dynamic. Leveraging existing, off-the-shelf tools can make a difference more quickly and provide the confidence to operational commanders and leaders in government that networks and OT are protected. After all, availability of relevant information is key to mission success.

Don’t assume trust. Don’t fall prey to rogue devices. Getting quickly to a Zero Trust architecture is more important than ever. Implementing C2C is a means available now to continuously identify and control access for all endpoints connecting to the network, making a comprehensive Zero Trust architecture achievable.

John Zangardi is CEO of Redhorse Corporation and a former CIO of the Department of Homeland Security and Department of the Navy, and a former acting CIO of the Department of Defense.

“To date, we have not seen specific attacks on the U.S.,” CISA Director Jen Easterly said April 28. “What we are concerned about is the fact that Russia’s malicious cyber activity is part of their playbook.”

President Joe Biden shortly warned in March that evolving intelligence showed Russia was planning potential stateside cyberattacks. He also said the magnitude of Russia’s cyber capacity “is fairly consequential, and it’s coming.”

Lawmakers and analysts expressed similar concerns as Russia invaded Ukraine in late February. Such attacks have yet to materialize, Easterly testified before a House appropriations subcommittee Thursday.

“To date, thankfully, we have not seen attacks manifest here,” she said. “But we are very concerned that as the war drags on, there may, in fact, be retaliatory attacks given the very severe sanctions we have imposed on the Kremlin, the U.S. and our allies.”

Russia has long used cyberattacks to project its forces and influence events beyond its borders. Its push into Ukraine was preceded by a tide of malicious hacks that crippled government websites and scrambled communications. Ukraine continues to be assailed in the digital domain, with cyberattacks trebling compared with the year prior, according to the State Service of Special Communication and Information Protection.

Russia has denied responsibility.

The cyber threat the U.S. faces, Easterly said, likely comes in three forms: international spillover, something like the NotPetya fiasco of 2017; criminal ransomware attacks, like those that paralyzed the Colonial Pipeline and JBS Foods; and deliberate action taken by “Russian state-sponsored actors” against critical infrastructure including the communications, energy and medical sectors.

“The threat environment isn’t getting any less dynamic, less complex, less dangerous,” Easterly said, “and the threat actors are not getting any less sophisticated.”

Bryan Vorndran, assistant director of the FBI’s cyber division, last month told Congress that Russia is a “formidable foe.” He confirmed reports of Russia increasingly scanning U.S. critical infrastructure — moves that could precede a hack.

“As these adversaries become more sophisticated and stealthier, we are most concerned about our ability to detect and warn about specific cyber operations against U.S. organizations,” Vorndran said in written testimony submitted to the House Judiciary Committee. “Maybe most worrisome is their focus on compromising U.S. critical infrastructure, especially during a crisis.”

CISA, part of the Department of Homeland Security, leads efforts to understand, manage and reduce risks to U.S. cyber and physical infrastructure. The agency regularly works alongside the FBI, the National Security Agency and international partners.

President Joe Biden’s fiscal 2023 budget blueprint included $2.5 billion for CISA, approximately 18% more than what was requested in 2022. Easterly on Thursday said the suggested investment “really recognizes the criticality of our mission and provides the resources that we need to achieve it.”

The president’s budget also included some $11.2 billion for Pentagon cyber, nearly 8% over the administration’s previous ask.

“While the Russian invasion of Ukraine has not yet spilled over into cyberattacks that affect governments and businesses in the United States, President Biden has warned all Americans of evolving intelligence that Russia may soon launch cyberattacks against the United States,” House Judiciary Committee Chairman Jerrold Nadler, D-NY, said during an oversight hearing.

Members of Congress and experts voiced concerns about Moscow’s cyber reach and long-term intent as its attack on Ukraine was staged and then unfolded.

House Intelligence Committee Chairman Adam Schiff in late February told reporters “one pressing concern” was Russian cyber tools bleeding beyond the bounds of Ukraine. “The other possibility,” the California Democrat added, “is that Putin lashes out at the United States and NATO, and in this kind of hybrid warfare, it deploys cyber tools to attack American companies or American infrastructure.”

Schiff had not seen evidence of such Russian efforts at the time. Fresher information, however, suggests “the magnitude of Russia’s cyber capacity is fairly consequential, and it’s coming,” President Joe Biden said March 21. The U.S. Cybersecurity and Infrastructure Security Agency has echoed the message.

Biden had previously said the U.S. would respond to Russian aggression in cyberspace. Exactly what that would entail was not clear.

Bryan Vorndran, the assistant director of the FBI’s cyber division, on March 29 told Congress Russia was a “formidable foe.” He also confirmed reports that Russia was increasingly scanning U.S. critical infrastructure, moves that could precede a hack.

“Russia is one of the two most capable cyber adversaries we face globally,” Vorndran said, answering a question from Rep. Sheila Jackson Lee, a Texas Democrat. “Whether they have the ability to completely destabilize our country and win a war is a whole different conversation.”

The Russian foreign ministry on Tuesday accused the U.S. of “waging a large-scale cyberattack” against the country, specifically targeting “government agencies, media outlets, critical infrastructure and vital facilities.” The ministry said those responsible — inspirers, operators and culprits — would be held to account.

Vorndran in written testimony described cybersecurity as a national security imperative, a matter he further said is underlined by ongoing international tumult.

The Department of Defense’s fiscal year 2023 budget request, revealed March 28, included $11.2 billion for cyber — some $800 million, or nearly 8%, more than the Biden administration’s previous ask.

Pentagon officials emphasized the continued spending in the domain and on related capabilities, like U.S. Cyber Command’s Cyber Mission Force teams.

“The administration’s defense topline includes $276 billion for investment,” Deputy Secretary of Defense Kathleen Hicks said. “That includes procurement and research, development, test, and evaluation. Those resources deliver the combat credibility today and into the future that we need across air, sea, land, cyber and space.”

“Today, my administration is issuing new warnings that, based on evolving intelligence, Russia may be planning a cyberattack against us,” Biden said March 21 at a Business Roundtable quarterly meeting. “As I said, the magnitude of Russia’s cyber capacity is fairly consequential, and it’s coming.”

U.S. Deputy National Security Adviser for Cyber and Emerging Technology Anne Neuberger said there was “no evidence of any specific cyberattack that we’re anticipating for” during a White House briefing the same day. Rather, she said, there is “some preparatory activity that we’re seeing,” which needed preempting.

Signs of potential malign activity spurred ongoing advisories as well as classified talks with companies last week.

“Bottom line, this is about us, the work we need to do to lock our digital doors and to put the country in the best defensive position,” Neuberger said. “As the president has said, the United States is not seeking confrontation with Russia. But he has also said that if Russia conducts destructive cyberattacks against critical infrastructure, we will be prepared to respond.”

The private sector owns and operates much of the critical infrastructure in the U.S.

The vital systems have been hit before: In 2021, ransomware incidents battered 14 of 16 U.S. critical sectors, including the defense industrial base, according to the federal government. The Colonial Pipeline was attacked, for example, as was meat supplier JBS.

“Let me be absolutely clear about something. It’s not just your interests that are at stake with their potential use of cybersecurity,” Biden told CEOs at the roundtable meeting. “It is the national interest at stake.”

Members of Congress, industry executives and analysts alike have said Russia poses a serious cyber threat to those it targets. Moscow uses the domain to project its force and meddle in foreign goings-on, according to the U.S. Cybersecurity and Infrastructure Security Agency.

“We do continue to see Russia conducting both, as you know, significant malicious activity in Ukraine, major kinetic attacks, which have disrupted and killed lives, as well as cyber activity,” Neuberger said.

Ukrainian systems have suffered more than 3,000 distributed denial-of-service attacks, jumbling communications and hampering operations, according to its government. The State Service of Special Communication and Information Protection of Ukraine on March 16 said the number of digital attacks perpetrated against the country’s “vital infrastructure hasn’t decreased since the beginning of the war.”

Russia has denied responsibility.

CISA earlier this year issued a “Shields Up” notice, cautioning organizations to prepare for disruptions or attempted intrusions. The Department of Homeland Security agency suggested Russia’s renewed invasion of Ukraine could bleed west, specifically on the cyber front.

“One of the tools he’s most likely to use, in our view, is cyber, cyberattacks,” Biden said of Russian President Vladimir Putin. “They have a very sophisticated cyber capability.”