While the command’s mission has evolved over the last decade, defense of the nation in cyberspace remains just as important, if not more, than ever before.
“The initial vision for Cyber Command focused heavily on the defense of the military’s networks,” Army Gen. Paul M. Nakasone, who is also the director of the National Security Agency and chief of the Central Security Service, explained.
“The dominant threat at the time was cyber-enabled espionage,” Nakasone said. “However, there was an increasing recognition that the military needed the ability to defend against a significant cyberattack on the homeland. As other parts of the joint force saw what cyber effects offered, Cyber Command grew to support their requirements as well.”
In 2008, the Defense Department experienced an intrusion into its networks — both classified and unclassified. Then-Defense Secretary Robert M. Gates saw it as a warning and knew the department would need to prepare for a future of cyberspace threats that was as dangerous as those in air, land and sea. Gates directed U.S. Strategic Command to establish Cybercom in 2009 as a sub-unified command.
Within less than a year, Cybercom stood up and merged joint components that had previously performed offensive and defensive cyber missions.
“What was clear was that we had only just begun to understand how cyberspace would become a pivotal forum for great power competition,” Nakasone said.
In the last decade, Cybercom has seen increased instances of adversaries operating below the level of armed conflict, from stealing intellectual property to attempting to influence and disrupt democratic processes.
“This has led us to our current focus on persistent engagement as our approach to implement the DOD Strategy of Defend Forward — the idea we must always be active in cyberspace by enabling our partners and acting against our adversaries,” he said.
The Cybercom mission has evolved to address multiple threats: cyber threats to critical U.S. infrastructure; terrorists using the internet to recruit, fundraise, and attack; and authoritarian regimes seeking to influence and disrupt U.S. social cohesion and democratic processes.
Due to the changing nature of warfare and the growing importance of cyberspace to national security, President Donald J. Trump announced in August 2017 that Cybercom would be elevated to a unified combatant command in 2018.
With an expanded mission and additional authorities, Nakasone said, “Cyber Command is prepared to generate cyber effects in a responsible but decisive manner.”
To bring cyber power to bear, Nakasone leads a 133-team “cyber mission force” across the Army, Navy, Air Force and Marine Corps. This force includes 13 national mission teams to defend against the most significant cyber threats to the nation; 68 cyber protection teams to defend DOD networks and systems against threats; 27 combat mission teams to conduct integrated cyberspace attacks; and 25 cyber support teams to provide analytic and planning support.
Cybercom has achieved much in its first decade of existence, including fighting ISIS in cyberspace, supporting forces in Iraq and Afghanistan and defending the 2018 midterm elections.
Even in the last few years, the command has deployed multiple cyber teams around the world to counter malicious cyber actors on critical networks. By outing more than 40 malware samples since 2018, Cybercom has bolstered network security and imposed costs on adversaries in the way of time, money and tools. The command’s most recent initiative is the Cyber 9-Line, an online portal with the National Guard to enable states and counties to quickly diagnose malware within their networks.
“We have delivered success by creating a well-trained force, building teams to defend the nation and mount offensive operations when authorized,” Nakasone said. “Perhaps the mission that was least predictable a decade ago was election security, which is itself only one aspect of a broader revolution in influence operations. Keeping the 2020 elections safe, secure and legitimate is my top priority.”
To support U.S. cyber defense, Cybercom works closely with other federal agencies outside of the DOD, including key partners at the Federal Bureau of Investigation and the Department of Homeland Security.
“With the authorities to act in cyberspace diffused throughout the government, Cyber Command can contribute to whole-of-government objectives by enabling partners like DHS and the FBI with threat information and other resources,” Nakasone said. “Just because Cyber Command can’t act on something doesn’t mean someone else can’t. This is an area that’s seen marked improvement over the last few years.”
Recognizing that the threats of a decade ago still exist today, Nakasone is confident that Cybercom stands ready for challenges in the future.
“The number of bad actors and their sophistication have increased. The return of great power competition means we should expect to see adversary cyber activity not just in terms of espionage, but also in terms of disruption, destruction and, certainly, influence,” said Nakasone.
Part of Cybercom’s success is due to its close and enduring partnership with NSA, he noted. “As the leader of both organizations, I see the speed, agility, and unity of effort that can be brought to bear against hard problems.”
Another key to Cyber Command’s success is the great support from Congress and DOD, as well as the ability to bring in the best cyber operators to work within its ranks.
“We recruit amazingly talented young people into the military’s cyber positions when they could easily separate for more lucrative careers,” he said. “And we’re building better partnerships with industry so those that want to continue to support national efforts in cyberspace can do so. Our alliances and foreign partnerships are second to none. So there’s a lot to be confident about for the future.”
With one decade down, Cybercom looks forward to an even greater impact and contributions in the future.
BY C. TODD LOPEZ, DOD NEWS