Air Force’s New Cyber Defense Strategy: Addressing Persistent Threats

The U.S. Air Force is actively developing a comprehensive campaign plan focused on defensive cyberspace operations, aimed at bolstering the protection of military installations and critical utility infrastructure against burgeoning digital threats. This initiative is underscored by mounting concerns regarding vulnerabilities posed by actors gaining sophisticated access, particularly those affiliated with China.

Emerging Cyber Threat Landscape

Recent intelligence has highlighted the activities of state-sponsored malicious cyber groups, notably Volt Typhoon and Salt Typhoon, which have raised alarms within U.S. security circles. These entities have established enduring access to critical infrastructure—specifically, sectors vital for national security such as telecommunications, energy, and water resources.

• Duration of Access: Volt Typhoon has reportedly maintained access for over five years without disruptive action, suggesting a strategic intent potentially aimed at destabilization in the event of a geopolitical conflict, notably regarding Taiwan.
• Strategic Implications: According to Lt. Gen. Thomas Hensley, commander of the 16th Air Force, this capacity for sustained intrusion highlights the risk of escalating cyberattacks that could be executed in conjunction with kinetic military operations, representing a significant shift in the landscape of warfare.

Vulnerability of Critical Infrastructure

The Air Force recognizes that cyber threats are not confined to conventional IT systems but extend into operational technology networks that underpin national infrastructure.

• Historical Context: Past incidents like the Stuxnet attack on Iran’s nuclear facilities in 2010 and Russia’s cyber operations against Ukraine’s power grid illustrate how cyber capabilities can disrupt physical systems and contribute to broader military objectives.
• Operational Risks: The blend of cyber capabilities with grounded military strategies emphasizes the need for a dual-focus on both traditional kinetic defense and robust cyber resilience.

Base Defense and Cybersecurity

Traditionally, military base defense discussions have concentrated on kinetic threats, such as missile strikes. However, Hensley stresses the importance of integrating cyber defense into these discussions.

• Interdependencies: Many U.S. bases are reliant on public utilities for operations. Cyberattacks targeting these utilities could jeopardize base functionality, underscoring the need for a holistic approach to security.
• Mission Impact: Bases may rely on backup generator power for a limited timeframe, necessitating proactive measures to secure public infrastructure.

Cybersecurity Initiatives and Collaborations

To address these multifaceted threats, the 16th Air Force is adopting a more integrated approach involving Cybersecurity Service Providers (CSSPs) and Cyber Protection Teams (CPTs).

• CSSPs: Operating under the 688th Cyberspace Wing, these units provide continuous monitoring of networks critical to command-and-control and weapon systems. They are tasked with incident response in the event of detected anomalies.
• CPTs: Under the jurisdiction of the 67th Cyberspace Wing, these teams focus on tactical point defense, utilizing advanced tools to identify, mitigate, and eliminate threats within networks.

This coordinated strategy is foundational to creating a Defensive Cyberspace Operations (DCO) plan that harmonizes network monitoring with direct defense measures.

Partnerships with Public Utilities

Recognizing the shared vulnerability with public utilities, the Air Force is pursuing cooperative research and development agreements (CRADAs) with utility companies situated near military bases.

• Agreement Types:
  • Information Sharing: Facilitates intelligence on adversary activities within utility networks.
  • Best Practices: Enables the exchange of tactics and techniques for eradicating cyber threats.
  • Deployment of Sensors: Aiming for persistent monitoring on utility systems, although sensitive to regulatory frameworks governed by the Department of Homeland Security.

Involving National Guard resources may ease regulatory complexities, creating vital connections between military and civilian cybersecurity efforts.

Conclusion

The evolving digital threat landscape necessitates a paradigm shift in military strategy toward a comprehensive approach that integrates traditional defense with cybersecurity. The Air Force’s initiatives underline a proactive posture in safeguarding military readiness and critical infrastructure from sophisticated cyber adversaries. As the lines between cyber and physical warfare continue to blur, a unified defense strategy remains essential to enhance resilience against disruptive threats.