UNCLASSIFIED

UNCLASSIFIED

Educating the Force on Cyberspace

COL Stephen ElleDirector of Training

US Army Cyber Center of Excellence & Fort Gordon5 August 2015

UNCLASSIFIED

UNCLASSIFIED

To provide TechNet participants an overview on Army efforts to educate the force about the Cyber Domain and Cyberspace through the incorporation of curriculum into Army leader development, training, and education programs.

Purpose

UNCLASSIFIED

UNCLASSIFIED

CYBERSPACE: A global domain within the information environment consisting of the interdependent network of information technology infrastructures, including the Internet, telecommunications networks, computer systems, and embedded processors and controllers. (JP 1-02)

• Part of every unit’s Operating Environment• Instantaneous operational reach – global battlefield

• Man-made domain – ever changing• Physical, logical, and social characteristics• Interdependent with traditional war-fighting domains

Cyberspace as a Domain

UNCLASSIFIED

UNCLASSIFIED

Army Cyber LDE&T Assessment and Implementation Strategy

• Originally developed by ARCYBER Proponent Office and approved by ARCIC 15 December 2013

• Identified gaps between ‘knowledge required’ and LDE&T currently available

• Specified a prioritized implementation plan for changes/modifications in LDE&T programs to include operational cyberspace domain and cyberspace operations across the Institutional, Organizational, and Self-Developmental training domains

• As a result, Cyber/EW added to AR 350-1 list of mandatory training subjects taught in Training Institutions

Background

UNCLASSIFIED

UNCLASSIFIED

1. Very little “Cyber Expertise” across the enterprise; creates Instructor challenges

2. Zero-sum: School curriculums are full; requires diligent coordination with numerous proponents who own the curriculum

3. Very immature area; requires curriculum and lesson plan development from scratch

4. Cyber CoE has yet to grow internal capacity; relying on Contractor support in lieu of new TDA hires

The Challenges

UNCLASSIFIED

UNCLASSIFIED

Institutional LDE&T Mission: Develop/integrate cyber curriculum into Army Initial Entry Training (IET), Professional Military Education (PME), CWO & NCO Education Systems (CWOES & NCOES) and Civilian Education System (CES/AMSC)

BUILD ASSESS BUILD

Institutional LDE&T Status:

ILE

CCC

USAWC

1 hour in Common Core Support 2 Electives Classified Elective in development (ALCOC will inform this effort) Cyberspace added to Mission Command block in Common Core (first 6 weeks of CCC)

DCG PCC ICW ARCYBER, added a 1 hour Cyberspace operations course added (classified) Cyber integrated across the Common Core Numerous Classes / Unclass electives offered

SAMS JTF-level products, SME spt during exercise CEMA Handbook, Planning Aids, Reading List

BOLC-B 1 hour in Common Core

Established Cyberspace Reading List on INTELINK CEMA Handbook, Fundamentals Classes, and Planning Aids on ATN• CDR’s Cyberspace Operations Handbook

Observe/support 3/25 JRTC rotation CEMA Handbook and Staff Planning Aids• Develop Home Station Training Package (Ongoing) (ALCOC will inform this effort (complete August 2015)• Cyber Training Web Page on Army Training Network (Ongoing)

Mission Command Training Program

Operational & SD LDE&T Status:

Self Development Learning Environment

Objective: Transform/Increase Army-wide knowledge of the cyber domain and cyberspace operations while holistically integrating as part of Unified Land Operations.

Operational LDE&T Mission: Integrate Cyberspace curriculum into individual training, collective training, and unit (CTC & MCTP) LDE&T Programs.

Self Development LDE&T Mission: self-development opportunities to educate the Army workforce and Cyber Workforce

CSCB Cyber Pilot and Home Station Training

• Continue to refine Cyber MRX packages/products (Ongoing) (ALCOC will inform this effort)

Other ILE • 2016- incorporate cyber into Warrant, NCO, and Civilian education systems

Army Leader’s Cyberspace Ops Course• all courses developed, lesson plans in final development (31 July 2015 final product to DOT)

Army Cyber Leader Development, Education and Training Programs

UNCLASSIFIED

UNCLASSIFIED

Army Leaders’ Cyberspace Operations Course

• Target: Corp-BCT CEMA Staff Principals (G/S-2, 3, 6, EWO, Fires, Space, and IO leaders).

• Not a programmed CF-17 certification course.• TS/SCI-level Course instructed at Ft Gordon, GA.• May be integrated as part of unit CTC/MCTP

Training Cycles.• Develops knowledge of DODIN Operations,

Cyberspace Threats, and Cyber Capabilities.• A Collective Training event.• A tool to shape staff performance; how to

integrate Cyber effects and capabilities.• Connects leaders to subject matter experts.• Reinforces emerging home station training

initiatives.

Curriculum Roadmap

Leveraging Fort Gordon Capabilities

• Home of the Cyber CoE.

• Available local adjunct instructors, guest speakers, and SMEs.

• Ability to observe Joint Cyberspace Operations & ISR in native environments.

• Eliminates “homestation” distractions.

Pilot• BPT execute first Pilot

4th QTR FY15.• Design to Inform: - Optimal Course Length - Resources Required - Exportability (BCTP, MCTP, WFX MTT’s)• Build – Assess - Build

Draft Curriculum

Senior Leaders’ Cyberspace Operations Orientation

• Target: GO/SES, Commanders, Nominative CSM’s, and CW5’s.

• 1-Day TS/SCI Course instructed at Ft Gordon, GA.

• Model after existing Senior Leader Courses (e.g., ISR, DCG PCC).

• Create common knowledge of Cyberspace Operations, the Threat and the integration of Cyber effects and capabilities.

• Review Cyberspace Authorities and Law.

Source: CSA Quarterly Cyber Update, 14 May 15

Cyberspace Operations Leader Courses

UNCLASSIFIED

UNCLASSIFIED

ARCYBER

780th MI BDE

7th SIG CMD

1st IO CMD

Electronic Warfare School

• Army Leaders Cyberspace Operations Course

• Senior Leaders Cyberspace Operations Orientation

INSCOM

Cyber School

Signal School

Cyber Protection BDE

• Army Cyberspace Operations Planning Course (ACOPC) (N9)

• EW courses

• various courses

Subject Matter Expertise

Operational products

Observer / Trainer feedback

• Research and related products

• various courses

Subject Matter Expertise

Feedback from lessons learned

Best practices

Intelligence Center of

Excellence

Subject Matter Expertise

Instructor TTPs

FORSCOM

• Doctrine• Training

Course Development Community

UNCLASSIFIED

UNCLASSIFIED

Introduction

Course Introductions

DODINDependency

CyberspaceThreat

Friendly Force Capabilities

CAPSTONEExercise

Scenario Exercise

(MDMP & Execution)

DAY 4Understand key friendly force actors and their

capabilities and activities that enable the creation of

effects in designated cyberspace.

Read Ahead discussion

Exploitation Vignette

Senior Leader Opening Remarks

Cyber Collaboration

History of Cyber Conflict

DODIN Operations

DCO(DCO-IDM /

DCO-RA)

Electronic Warfare

Cybersecurity

CEMA

Planning Exercise

Cyber Threat Actors and Cyber

Threat Vectors

Intelligence Support to

Cyberspace Operations

Cyber Attack Lifecycle

Planning Exercise

Cyberspace Policy/Authorities

CERF Process

Joint Cyberspace Organizations and

Cyber Mission Forces

Targeting in Cyberspace

Offensive Cyberspace Opns

Planning Exercise

DAY 3Understand the complexity of the cyber threat, and the friendly force intelligence capabilities and activities that combat those threats.

DAY 2Understand the critical role of the DODIN and how it

enables or otherwise underpins the exercise of

mission command.

DAY 1Conduct a review of the

course objectives and read ahead materials, and set

conditions for the remainder of the course.

DAY 5Provide a unique setting to enable staff integration and

synchronization during planning and execution in a simulated command post

environment.

After Action Review

Approved on June 2, 2015

ALCOC Curriculum Roadmap

UNCLASSIFIED

UNCLASSIFIED

Course(s)* Learning outcomes Time*

DCG PCC, AWC, SCP, WOSSE, SMC

Evaluate, coordinate, and apply aspects and capabilities of Cyber, Signal, Intelligence, and Electronic Warfare

2-4 hours

CGSS, SAMS, CCC, WOILE, WOAC, SLC

Plan, coordinate, synchronize, integrate, and conduct (as appropriate) cyber electromagnetic activities through Cyber, Signal, Intelligence, and Electronic Warfare means

2-4hours

BOLC, WOBC, ROTC/USMA, ALC, WLC, AIT, BCT

Identify and describe aspects of Cyber, Signal, Intelligence, and Electronic Warfare in the context of cyber electromagnetic activities

1-2 hours

Pre-commissioning Familiarize with aspects of Cyber, Signal, Intelligence, and Electronic Warfare

2 hours

DA Civilian Identify and describe cyber electromagnetic activities and aspects of Cyber, Signal, Intelligence, and Electronic Warfare

2 hours

Work to be done…….

* Denotes estimated range of time required in the academic setting

EXAMPLE

Determining Learning Outcomes

UNCLASSIFIED

UNCLASSIFIED

1. Establish Learning Outcomes for all cohorts and continue curriculum development.

2. Establish Cyber Community of Interest (i.e. Working Groups, Warfighting Forum, Lessons Learned/Best Practices Forum/to include Joint)

3. Leverage available Cyber Planner Course and other Joint curriculums to fill immediate Subject Matter Expert shortfall pending arrival of Cyber CoE support elements

4. Develop Army Leader’s Cyberspace Operations Course (CSA directed)

5. Continue to improve current efforts and shift focus to Warrant Officer Education System (WOES), NCO Education System (NCOES), and Civilian Education System (CES)

Way Ahead