Army cyber unit expands as fast as it can

The Army’s new Cyber Command  is up and running, but it is still a work in progress. Although it achieved full operational status in October 2010, the new command is still in a growth phase, acquiring new personnel and honing its mission to defend the service’s computer networks. The command is also refining and coordinating its operational role with other Army and Defense Department organizations. 

Army Cyber has facilities and personnel at Fort Belvoir, Va., and Fort Meade, Md. However, the service has not yet determined the final home for the command’s headquarters, said Col. Brian Moore, Army Cyber's chief of staff.

When the command was first established, its charter called for a staff of about 500 military and civilian personnel. But when the process of creating Army Cyber was under way, Moore noted that additional missions and functions were added to its list of responsibilities. In turn, the new requirements have increased the number of personnel. The command’s headquarters facility will have a staff of more than 1,000 people when it is complete, but Moore added that subordinate organizations such as the Army Network Enterprise Technology Command (NETCOM), Army Cyber Brigade and First Information Operations Command will bring the total number of personnel to 21,000.

To meet its staffing needs, Army Cyber is attracting a mix of active-duty specialists from around the Army and a variety of civilian experts. To attract civilians, Moore said the command is hosting job fairs in the Washington, D.C., area. The USAJobs website is the official online source for job vacancies. Other resources include the Army Civilian Personnel Online website that provides a public-access site focused on civilian jobs throughout the world in dozens of occupational specialty areas. Moore said Army Cyber's public website will soon be operational, and it will be a resource for people interested in working for the command. “There is a venue for anybody interested in jobs to either attend local job fairs or go to these official sites,” he said.

Training and doctrine

For personnel training and doctrine issues, Army Cyber is using military occupational specialties already established by the Army, said Command Sgt. Maj. Roger Blackwood. He added that these skills are established under the service’s career management field and signals specialist requirements. As the command grows, he said, there will be a need to remain flexible to provide new skills. Army Cyber is not specifically locked into a rigid skills set. Instead, everything is under constant review as the command develops and fine-tunes its tasks, missions and functions, he said.

The command’s mix of civilian and military personnel provides it with additional flexibility. Moore said the advantage of Army Cyber’s civilian workforce is that is offers vital skills and expertise. The civilian staff also permits faster organizational change because it allows the military side of the command to identify new skills sets and requirements to transfer and define to a formal military occupation speciality. “The strength of our organization is in the people. Without soldiers, Department of Defense civilians, and our families, that support us as we do our day to day jobs, we can’t come here and focus on defense of the networks and what’s out there in the cyber domain,” Moore said.

Army Cyber's command structure consists of three deputy commanding generals who work for Maj. Gen. Rhett Hernandez. They are:

• Brig. Gen. Jennifer Napper, NETCOM commander, who is deputy commanding general of network operations at Army Cyber.
• Maj. Gen. Mary Legere, commander of the Army Intelligence and Security Command, who is deputy commanding general for full spectrum cyber operations at Army Cyber.
• Brig. Gen. Jeffrey Smith, Army Cyber’s deputy commanding general of proponentcy.

Moore added that Smith’s areas of responsibility include establishing the necessary skills sets, doctrine and training, personnel and facilities.

The deputy commanders are located across the country. Napper is at Fort Huachuca, Ariz.; Legere is at Fort Belvoir; and Smith is commanding the 5th Signal Command in Germany, but he will be reassigned to Virginia or Maryland this summer to take up his new command. All three deputy commanders have dual responsibilities and answer to two separate command chains, with Army Cyber being one of those two, Moore said.

Personnel challenges

Building the necessary operational and institutional experience will take some time, said James Lewis, a senior fellow at the Center for Strategic and International Studies. He said all the military services are working on personnel and organizational support problems as they build up their cyber commands. The services still face a shortage of skilled personnel to fill their needs.

Cyber operations represent a new type of organizational and force structure, Lewis said. Developing appropriate doctrines will be an important goal for the military. “This is a new domain and activity,” he said.

Army Cyber’s mission is to operate and defend all Army networks. “Our main purpose is to stay ahead of the threat and protect what we have,” Moore said. The command is also responsible for supporting Army network services and the authorities and organizations that use that infrastructure.

The command also is responsible for defending Army networks as the service transitions to a cloud computing model, said Col. Jeffery Schilling, chief of current operations and head of the Army Cyber Operations Integration Center (ACOIC). The cyber command is partnering with the Defense Information Systems Agency to support the Army’s efforts to provide a centralized e-mail service in the cloud.

“We build the defense capabilities and requirements into the service-level agreement,” Schilling said. He said the process is analogous to a contract that outsources a service to a nongovernment organization. In the service-level agreement between Army Cyber and DISA, part of the agreement requires DISA to defend assets in the area of the cloud that belongs to Army Cyber. DISA must also respond to any defensive measures that Army Cyber's ACOIC requests based on detected threats. Schilling described ACOIC as the command’s emergency room responsible for detecting and countering any threats in cyberspace to the network.

ACOIC also coordinates with DISA’s Global Incident Management Center, which support’s the agency’s enterprise services. That communication helps to synchronize network defense in the Army’s cloud at an enterprise level, Schilling said.

Learning relationship

The details of the service-level agreement are a challenge, Schilling said. Because the agreement defines roles and responsibilities, it is critical to clearly specify those issues. “We expect this to be a learning relationship,” he said. As new issues arise that are not covered in the initial service-level agreement, it can be modified to further protect the enterprise, he said.

Recent cyber events, such as the Stuxnet worm that targeted the Iranian nuclear industry, are a catalyst for the Army to evaluate its techniques, tactics and procedures, Schilling said. For all major online incidents, he said the command looks at how it operates to adapt to new threats. “It is our method to evaluate all incidents, whether they happen on our networks or on other networks that we find out about,” he said.

Schilling said Army Cyber is continuously adapting and changing its network defensive procedures to help spot incidents or improve the network's ability to defend against threats such as specialized attack weapons. But he added that cyberspace is an ever-changing environment to which the Army must constantly adapt.