SCHOOL THESIS

More documents

Recommendations

Info

B. COA #1 DESCRIPTION (FULL NORAD CYBER CONFERENCE PARTICIPATION) 1. Definition Under this COA, NORAD’s role would be to fully participate in all cyberspace event conferences in order to increase the Command’s internal situational awareness regarding in-progress, military-related cyber events. 2. Discussion NORAD currently participates in “Cyber Watch Conferences” which provide cyber technicians a standardized venue to discuss and troubleshoot detected system anomalies. However, during advanced “Cyber Event Conferences” and “National Event Conferences,” practitioners report Canadian participation is denied approximately 50 percent of the time due to discussions involving non-releasable (US-only) classified cyberspace compartmented information. Accomplishing this COA eliminates those restrictions, makes classified cyber event information fully available to appropriate Canadian military personnel, and improves NORAD’s own cyberspace situational awareness and ability to gauge any associated mission impacts. 3. Advantages Allows full cyber event information exchange to both U.S. and Canadian personnel assigned to NORAD. Enables NORAD full situational awareness regarding cyber events that might affect the NORAD warning and control missions. Uses existing technical conference procedures. Does not change existing relationships with USCYBERCOM. Does not require a change in the NORAD Agreement and/or Terms of Reference negotiated between the U.S. and Canada. 56
4. Disadvantages and Proposed Solutions Some classified cyberspace threat information and technical “tactics, techniques, and procedures” (TTPs) are not currently releasable to Canadian personnel. (Change DOD classification guidance to allow Canadians full access to cyberspace threat information and TTPs.) NORAD regional headquarters currently must drop off threat conferences during classified discussions. (Change DOD conference procedures to allow NORAD regional headquarters to remain on cyber event conferences during classified discussions.) Modifies existing conference checklist procedures. (Modify cyberspace conference checklists to reflect full NORAD participation.) C. COA #2 DESCRIPTION (NORAD ALL-DOMAIN WARNING PRODUCTION) 1. Definition Under this COA, NORAD’s role would be to fuse applicable North America military-related cyber event information with current NORAD aerospace and maritime operational information to produce all-domain warnings to the U.S. and Canadian governments. 2. Discussion Assuming the issue of releasing classified cyber event information to NORAD Canadians was successfully resolved (proposed in COA #1), this COA directs NORAD to fuse military cyber event information with current aerospace and maritime warning information to produce timely, all-domain warnings to the U.S. and Canadian governments using existing NORAD binational military relationships and established warning processes. This COA would allow Canadian cyber forces to become involved in the NORAD notification process. As technical cyber event information would initially be analyzed by USCYBERCOM, then provided to NORAD for further amalgamation, there would be no change to the existing relationships between the two commands. 57
Page 1 and 2:
NAVAL POSTGRADUATE SCHOOL MONTEREY,
Page 3 and 4:
REPORT DOCUMENTATION PAGE Form Appr
Page 5 and 6:
Approved for public release; distri
Page 7 and 8:
ABSTRACT For more than fifty years,
Page 9 and 10:
TABLE OF CONTENTS I. INTRODUCTION..
Page 11 and 12:
1. Advantages, Disadvantages and We
Page 13 and 14:
LIST OF FIGURES Figure 1. North Ame
Page 15 and 16:
LIST OF TABLES Table 1. Cyberspace
Page 17 and 18:
LIST OF ACRONYMS AND ABBREVIATIONS
Page 19 and 20:
EXECUTIVE SUMMARY Since 1958, North
Page 21 and 22:
ACKNOWLEDGMENTS I feel very fortuna
Page 23 and 24:
I. INTRODUCTION A. PROBLEM STATEMEN
Page 25 and 26:
This thesis then developed three co
Page 27 and 28: II. OPERATIONAL OVERVIEW A. INTRODU
Page 29 and 30: Based upon the remarkable success o
Page 31 and 32: Later, because of growing concerns
Page 33 and 34: 3. Cruise Missile Warning While ICB
Page 35 and 36: C. NORAD’S NEW MARITIME WARNING M
Page 37 and 38: When asked about the pending NORAD
Page 39 and 40: Director Clapper then identified to
Page 41 and 42: Level 2. Software tools that can be
Page 43 and 44: First, the Tallinn group developed
Page 45 and 46: More importantly, the NATO definiti
Page 47 and 48: DODIN Operations. “Operations to
Page 49 and 50: As can be seen, the topic of “cyb
Page 51 and 52: 3. U.S. Northern Command Created in
Page 53 and 54: 5. U.S. Cyber Command Created in 20
Page 55 and 56: Figure 16. DND and SJS Crests. 2. S
Page 57 and 58: 4. Canadian Forces Information Oper
Page 59 and 60: Figure 19. Cyber Event Conferences.
Page 61 and 62: Finally, the NORAD and USNORTHCOM C
Page 63 and 64: III. LITERATURE REVIEW A. INTRODUCT
Page 65 and 66: Maritime warning consists of proces
Page 67 and 68: Initiative #10. Define and develop
Page 69 and 70: of peace and crisis, and develop th
Page 71 and 72: c. National Military Strategy (2011
Page 73 and 74: This publication discusses cyberspa
Page 75 and 76: MINDFUL that in the years since the
Page 77: IV. COURSES OF ACTION DEVELOPMENT A
Page 81 and 82: Requires negotiating new cyberspace
Page 83 and 84: E. SUMMARY This chapter identified
Page 85 and 86: V. COURSES OF ACTION ANALYSIS A. ME
Page 87 and 88: 2. COA #1 Synopsis COA #1 is a prom
Page 89 and 90: Requires negotiating new cyberspace
Page 91 and 92: DISADVANTAGES SOLUTIONS WEIGHT Modi
Page 93 and 94: Under this COA, existing classified
Page 95 and 96: Change DOD conference procedures to
Page 97 and 98: VI. FINDINGS AND RECOMMENDATIONS A.
Page 99 and 100: Finally, COA #3 proposes a joint NO
Page 101 and 102: LIST OF REFERENCES “2014: Piracy,
Page 103 and 104: Lawson,Sean. “DOD’s ‘First’
Page 105 and 106: ———. Joint Publication 3-12R
Page 107: INITIAL DISTRIBUTION LIST 1. Defens
show all

SCHOOL THESIS

Create successful ePaper yourself

Delete template?

Save as template?