Cyber Security Operations AFS

[Cyber] Security Operation Specialists 1D7X1Ds are the go-to experts for cybersecurity. Either in the Wing Cybersecurity Office running RMF, COMPUSEC, TEMPEST/EMSEC, and REMSEC programs or in the Wing COMSEC Office running the COMSEC operations for the base.

Your job as a 1D7X1D can pretty much be defined by the five terms Confidentiality, Integrity, Availability, Authentication and Non-repudiation.

You need to understand classification levels of Unclassified, Confidential, Secret, Top Secret and the classification amplifiers of CUI, SCI, and SAP.

Your job as a 1D7X1D is to maintain a secure AF cyber environment; balancing risk and rewards.

Official Publications

Pubs give us our guidelines and come from many levels.

• The OPR is responsible for keeping pubs up to date.

• The certifying/approving official for pubs must be military or civilian employees and use AF Form 673 to coordinate issuance, supersession, or recission of pubs.

• Pubs remain in effect even if certifying/approving official vacates their position.

A publication becomes obsolete when another publication supersedes it, when the OPR rescinds it, or when it expires.

• Rescission - remove the publication from circulation without being replaced

• Supersession - action by which a new/revised publication is issued to replace the older version.

• Expired Publications – only apply to temp pubs (ex. AFPM, GM) and must expire NLT one-year from pub date.

Pubs can be directive or non-directive

• Directive pubs – may contain compliance statements; comply or get a waiver

Will contain “COMPLIANCE WITH THIS PUBLICATION IS MANDATORY”

Must be available on e-pubs (unless restricted)o Can require official forms

• Non-directive pubs – informational or suggestive guidance; compliance is expected but not mandatory

Cannot require forms

e-Publishing is the official repository for pubs/forms issued by wings/bases and above

• All unclass non noncontrolled pubs will be hosted here

If classified or controlled, then title will be listed unless title is classified

• E-pubs also hosts “other publishing resources” link

• Pubs are organized by series (ex. 14-Intelligence series, 17-Cyberspace series)

• Opening paragraph holds key info on purpose, applicability, and higher references for more info

• Paragraphs and sub-paragraphs are numbered for ease of reference; key for directing others to the answers

Cyber Tasking’s

USCYBERCOM designs the cyber force structure, training reqs and certification standards...enables the Services to build the cyber force required to execute assigned missions.

USSTRATCOM/USCYBERCOM issues orders via various formats that include but are not limited to TASKORDs and OPORDs.

• AF CTOs - operational type orders issued to perform specific actions at specific time frames in support of AF and Joint requirements.

• CCOs - build/shape the portion of cyberspace to be employed in support of a Combatant Command (CCMD) operation or in response to adversary actions.

• TCNOs - downward-directed operations, security, or configuration management-related orders...direct fix action...compliance tracked and mandatory.

• MTOs - routine tasks that enhance network security with a medium to low risk associated with the task.

• SPINS - provide amplifying instructions for planning, execution, and assessment of AF CTOs and CCOs.

• C4 NOTAM - closely related to TCNOs with the primary difference being that they are informative in nature are used to disseminate network information that does not direct specific action to be taken or compliance to be tracked.

Collaborative Environments

You won’t be able to know it all, use your collaborative tools

• IACE via SharePoint - primary cybersecurity/IA support resource for the Wing Cybersecurity Office…cybersecurity/IA ideas, questions, discussions, and hosts dynamic content for information sharing...find answers, share ideas, and improve on AF IA and Cybersecurity.

• Cybersecurity Collab via Teams – faster Q&A + mentorship & networking across career field

• Combat Crew Comm Collab via Teams – issues specific to CCC

• AF IC Cybersecurity Collab via Intellink – cybersecurity/IA resource if dealing with AF SCI or ISR programs

• Cyber Airmen Crosstalk Forum via MilSuite – collab environment for all 1D career field managed by CFM team