U S Department of Defense - Cyber Strategy

THIS PAGE LEFT INTENTIONALLY BLANKI. INTRODUCTION.................................................................................................................................1
II. STRATEGIC CONTEXT......................................................................................................................9
I.Build and maintain ready forces and capabilities to conduct cyberspace operations.......................... 13
II.Defend the DoD information network, secure DoD data, and mitigate risks to DoD missions ......... 13
III.Be prepared to defend the U.S. homeland and U.S. vital interests from disruptive or destructive
IV.Build and maintain viable cyber options and plan to use those options to control conflict
V.Build and maintain robust international alliances and partnerships to deter shared threats and
T h e D e p a r t m e n t o f D e f e n s e C y b e rS t r a t e g y

We live in a wired world. Companies and countries rely on cyberspace for everything fromfinancial transactions to the movement of military forces. Computer code blurs the line betweenthe cyber and physical world and connects millions of objects to the Internet or privatenetworks. Electric firms rely on industrial control systems to provide power to the grid. Shipping managers use satellites and the Internet to track freighters as they pass through globalsea lanes, and the U.S. military relies on secure networks and data to carry out its missions.

The United States is committed to an open, secure, interoperable, and reliable Internet thatenables prosperity, public safety, and the free flow of commerce and ideas. These qualities ofthe Internet reflect core American values of freedom of expression and privacy, creativity,opportunity, and innovation. And these qualities have allowed the Internet to provide socialand economic value to billions of people. Within the U.S. economy alone, anywhere from threeto 13 percent of business sector value-added is derived from Internet-related businesses. Overthe last ten years Internet access increased by over two billion people across the globe.. Yet thesesame qualities of openness and dynamism that led to the Internets rapid expansion nowprovide dangerous state and non-state actors with a means to undermine U.S. interests.

We are vulnerable in this wired world. Today our reliance on the confidentiality, availability,and integrity of data stands in stark contrast to the inadequacy of our cybersecurity. TheInternet was not originally designed with security in mind, but as an open system to allowscientists and researchers to send data to one another quickly. Without strong investments incybersecurity and cyber defenses, data systems remain open and susceptible to rudimentaryand dangerous forms of exploitation and attack. Malicious actors use cyberspace to steal dataand intellectual property for their own economic or political goals. And an actor in one regionof the globe can use cyber capabilities to strike directly at a network thousands of miles away,destroying data, disrupting businesses, or shutting off critical systems.

State and non-state actors conduct cyber operations to achieve a variety of political, economic,or military objectives. In conducting their operations, they may strike at a nations values aswell as its interests or purposes. As one example, in November, 2014, likely in retaliation for theplanned release of a satirical film, North Korea conducted a cyberattack against Sony PicturesEntertainment, rendering thousands of Sony computers inoperable and breaching Sonysconfidential business information. In addition to the destructive nature of the attacks, NorthKorea stole digital copies of a number of unreleased movies, as well as thousands of documents

The RedFlag14-1CyberProtectionTeam worksoncyberdefense procedures inside the Combined Air and Space Operations Center-Nellis, Nellis, NV. The CPT's primary goal is to find and thwart potential space, cyberspace and missile threats against U.S. and allied forces. (U.S. AirForce photo by Senior Airman Brett Clashman)

containingsensitive data regarding celebrities, Sony employees, and Sonys business operations. North Korea accompanied their cyberattacks withcoercion, intimidation,and the threat ofterrorism. The North Korean attack on Sony wasone of the most destructive cyberattacks on a U.S.entity to date. The attack furtherspurredanalready ongoing national discussionabout thenature ofthecyberthreat and the needforimproved cybersecurity.

The increased use of cyberattacks as a political instrument reflects a dangerous trend ininternational relations. Vulnerable data systems present state and non-state actors withanenticing opportunity to strike the United States and its interests. During a conflict, the Defense Department assumes that a potential adversary

will seek to target U.S. or allied critical infrastructure and military networks to gain a strategicadvantage. Beyond the attacks described above, a sophisticated actor could target an industrialcontrol system (ICS) on a public utility to affect public safety, or enter a network to manipulatehealth records to affect an individuals well-being. A disruptive, manipulative, or destructivecyberattack could present a significant risk to U.S. economic and national security if lives arelost, property destroyed, policy objectives harmed, or economic interests affected.

Leaders must take steps to mitigate cyber risks. Governments, companies, and organizationsmust carefully prioritize the systems and data that they need to protect, assess risks andhazards, and make prudent investments in cybersecurity and cyber defense capabilities to achieve their security goals and objectives. Behind these defense investments, organizations ofevery kind must build business continuity plans and be ready to operate in a degraded cyberenvironment where access to networks and data is uncertain. To mitigate risks in cyberspacerequires a comprehensive strategy to counter and if necessary withstand disruptive anddestructive attacks.

Defending the United States in Cyberspace

In concert with other agencies, the United States Department of Defense (DoD) is responsiblefor defending the U.S. homeland and U.S. interests from attack, including attacks that mayoccur in cyberspace. In a manner consistent with U.S. and international law, the Department ofDefense seeks to deter attacks and defend the United States against any adversary that seeks toharm U.S. national interests during times of peace, crisis, or conflict. To this end the DefenseDepartment has developed capabilities for cyber operations and is integrating those capabilitiesinto the full array of tools that the United States government uses to defend U.S. nationalinterests, including diplomatic, informational, military, economic,financial, and lawenforcement tools.

The May 2011 Department of Defense Strategy for Operating in Cyberspace guided the DefenseDepartments cyber activities and operations in support of U.S. national interests over the lastfour years. This new strategy sets prioritized strategic goals and objectives for DoDs cyberactivities and missions to achieve over the next five years. It focuses on building capabilities foreffectivecybersecurityandcyberoperationsto

Next page