Comprehensive Guide to Cyberspace Operations and Defense Strategies

Physical-Network

The physical network layer consists of the information technology (IT) devices and infrastructure in the physical domains that provide storage, transport, and processing of information within cyberspace, to include data repositories and the connections that transfer data between network components.

Logical-Network

The logical network layer consists of those elements of the network related to one another in a way that is abstracted from the physical network, based on the logic programming (code) that drives network components.

Cyberspace-Persona

The cyber-persona layer is a view of cyberspace created by abstracting and combining data from the logical network layer to develop descriptions of digital representations of an actor or entity identity in cyberspace.

Department of Defense Information Network Operations

Operations to secure, configure, operate, extend, maintain, and sustain Department of Defense cyberspace to create and preserve the confidentiality, availability, and integrity of the Department of Defense information network.

Defensive Cyberspace Operations

Operations that are part of a defensive cyberspace operations mission to protect networks from threats.

DCO-Internal Defensive Measures

Operations in which authorized defense actions occur within the defended portion of cyberspace.

DCO-Response Actions

Operations that are part of a defensive cyberspace operations mission that are taken external to the defended network without the permission of the owner of the affected system.

Offensive Cyberspace Operations

Missions intended to project power in and through foreign cyberspace through actions taken in support of CCDR or national objectives.

Cyberspace Security

Actions taken within protected cyberspace to prevent unauthorized access to, exploitation of, or damage to IT and IS systems.

Cyberspace Defense

Actions taken within protected cyberspace to defeat threats that have or are threatening to breach cyberspace security measures.

Cyberspace Exploitation

Actions that include military intelligence activities, network maneuvering, intelligence collection, and other enabling actions required to prepare for future military operations.

Cyberspace Attack

Actions that create noticeable denial effects in cyberspace or manipulation that leads to denial effects in the physical domains.

Nation State

Cyber-attacks sanctioned by nation states or state-sponsored groups, often using advanced tools and techniques.

Non-Nation State

Groups involved in cyber activities not directly affiliated with a nation-state, categorized as hacktivists, cyber criminals, and extremist groups.

Small groups/Individuals

Individuals or loosely affiliated groups with motivations usually attributed to personal/financial gain or political influence.

Accidents and natural hazards

Unintentional incidents or environmental factors that can disrupt or compromise cybersecurity.

Cyberspace Protection Conditions

CPCONs employ risk-informed decision making to protect assets vital to operational readiness and the accomplishment of DOD missions.

Title 10 - Armed Forces

Focuses on national defense and the role of DOD to man, train, and equip US forces for military operations in cyberspace.

Title 50 - War and National Defense

Focuses on a broad spectrum of military, foreign intelligence, and counterintelligence activities to secure US interests in cyberspace.

Title 32 - National Guard

Focuses on national defense and civil support training and operations in the US.

CCMF

The CCMF conducts Cyber Operations to support the missions, plans, and priorities of the geographic and functional CCDRs.

CMT

Tactical units of the CCMF that support CCDR plans and priorities to project power in support of national objectives.

CST

Provides specialized technical and analytic support for the units of the CMF.

CNMF

The Cyber National Mission Force conducts Cyber Operations to defeat significant cyberspace threats to the DODIN and, when ordered, to the nation.

Defensive Cyber Operations - Response Actions (DCO-RA)

Missions assigned to NMTs, tactical units of the CNMF that defend the DODIN or other blue cyberspace when ordered.

NMT

Tactical units of the CNMF that defend the DODIN or other blue cyberspace when ordered.

NST

Provides specialized technical and analytic support for the units of the CMF.

Cyber Protection Force (CPF)

Conducts CO for internal protection of the DODIN or other blue cyberspace when ordered.

CPT

Conduct intel driven hunts for malicious cyber activity in coordination with network owners.

Defense in Depth Concept

A practical strategy for achieving Information Assurance in today's highly networked environments.

Advanced Persistent Threat

A stealthy threat actor, typically a state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period.

Mission Relevant Terrain Cyber

Both the physical and logical layer aspects of a network that support mission execution.

Key Terrain Cyber

Subset of MRT-C plus elements of adversary cyberspace that comprise specific assets, systems, services, infrastructure, and personas identified as key terrain.

Commander's Critical Information Requirement (CCIR)

A set of information requirements identified by a commander as critical for making timely and informed decisions during an operation.

Cyberspace Threat Hunting

Internal defensive measures that require maneuver within the defended network to identify, locate, and eradicate an APT.

DACO

Directive authority for cyberspace operations, the authority to issue orders and directives to all Department of Defense components to execute global Department of Defense information network operations.

Cyber effect

The disruption, denial, or destruction of computers, info/comms systems, networks, or the info stored on them.

Cyber Operations

The employment of cyberspace capabilities to achieve objectives in cyberspace.

Cyber collection

Conducting operations and activities in or through cyberspace for the primary purpose of collecting intelligence.

Cyber effect enabling activities

Activities that create the conditions for a cyber effects operation to take place.

Cyber effects operation

A set of interlinked activities that use technology and networks to achieve a desired primary effect on a target.

Cyberspace missions

Actions that fall under OCO, DCO, or DODIN OPS that are authorized by a military order.

Cyberspace actions

Tactical-level actions or tasks that employ cyberspace capabilities to create effects in cyberspace.

Cyberspace system operations

Activities necessary to build, secure, operate, and maintain comm. systems and networks, ensuring CIA.

Countermeasures in cyberspace

Methods or techniques used to prevent, detect, and respond to cyber threats and vulnerabilities.

MOP

Measure of performance, an indicator used to measure a friendly action that is tied to measuring task accomplishment.

MOE

Measure of effectiveness, an indicator used to measure a current system state, with change indicated by comparing multiple observations over time.

OE

Operational environment, a composite of the conditions, circumstances, and influences that affect the employment of capabilities.

Fleet Cyber Command

The Navy's lead for cyberspace operations, directing offensive and defensive cyber missions.

Commander, TENTH Fleet

The operational arm of Fleet Cyber Command that executes cyber missions through task forces.

NAVSPACE

The Navy's component to U.S. Space Command, focusing on space-based capabilities.

Joint Force Headquarters-DoDIN

Defends and operates the Department of Defense Information Network.

Cyber Operations-Integrated Planning Elements (CO-IPE)

Embedded teams within combatant commands that help plan and integrate cyber effects into military operations.

Naval Network Warfare Command (NNWC)

Manages and defends Navy communications and network systems.

Defense Information Systems Agency (DISA)

Provides IT and cyber services across the DoD.

Maritime Operations Centers (MOC)

Command-and-control hubs that support operational planning and execution.

Navy Cyber Defense Operations Command (NCDOC)

Leads defensive cyber operations for the Navy.

National Security Agency / Computer Network Operations (NSA/CNO)

Conducts full spectrum cyber operations to support national security.