NATIONAL HARBOR, Md.—The Air Force is shoring up its cyber defenses both on and off base for critical infrastructure such as water and electrical power, and industry experts are calling for more, even specialized, dedicated microgrids offsite to support USAF operations in case of a total blackout caused by cyberattacks.
“We have spent years protecting and defending the tip of the combat spear, but right now, ladies and gentlemen, our adversaries have decided to focus time, resources, and interest on the hand that wields the spear, and that’s where we have to focus,” retired USAF Lt. Gen. Chris “Wedge” Weggeman said Sept. 16 during a panel discussion at AFA’s Air, Space & Cyber conference.
Weggeman, now working in cybersecurity with Deloitte, also said that while the issue is new, the process of mission assurance is well esablished.
“We really don’t need a new playbook. It’s really the same playbook,” Weggeman said. “You’ve just got to know: what does this capability do in terms of enabling my mission? What happens when an adversary takes it away from me, and how long does it take me to recover? And do I have the ability to fight?”
For a long time, the military’s cybersecurity efforts have focused on information technology, or IT—the software and computers that manage data. Increasingly, though, experts are worried about operational technology, or OT—the tech that controls physical equipment and systems.
Airmen from the 16th Air Force at Joint Base San Antonio-Lackland, Texas, recently announced partnerships with research centers, government entities, and private sector organizations to help defend their OT where it touches Air Force assets.
“We are getting after it—workforce development, capabilities, intelligence, and everything else we need to execute this mission,” Brig. Gen. Jason Christman, 16th Air Force OT lead, said in a release.
The move delivered an OT Certification Joint Qualification Record in a two-month timespan. Next steps call for the 16th Air Force team to push the certification across the joint force and share “threat telemetry and defense strategies” with program partners.
The work also included standing up an OT Cyber Defender Schoolhouse within the 16th Air Force, according to the release.
Identify and Defend
The first challenge the service has, Weggeman told Air & Space Forces Magazine after the panel, is “to earnestly and quickly determine the critical mission resilience or redundancies and resiliencies and dependencies we have with [operational technology], and a lot of that OT lives outside of our fence line.”
“We can’t just say there’s a fence line, so I don’t do anything about it,” said Weggeman, former Air Forces Cyber commander and director of strategy, plans, and policy at U.S. Cyber Command.
Another panelist, retired Army Col. Candice Frost, pointed to a recent project that could help model efforts to protect public works OT from cyberattack. Project Watershed 250 in Texas, which launched in August, is combining state assets with the White House’s Office of the National Cyber Director to prevent water and wastewater facilities from cyber-attacks.
Future work must include ways to segregate services such as water and electrical, provide backups, and potentially build offsite electrical “microgrids” to keep bases powered if their main power feed is “cut” via a cyberattack, said Frost, now vice president for mission engagement with Parsons.
“Defend the ecosystem, not just the base, because the base is the stronghold, but the ecosystem supporting it is the area that we see in industry that needs the most support,” Frost said.
Identifying critical OT is the first step; then leaders must work to make it resilient. Older equipment, what Weggeman calls the “hand-carved wooden shoe problem,” is somewhat protected from cyberattack because it’s old and not connected.
But increasingly, the retired three-star said, much of the OT supporting a base is being connected to the internet, “which is good because we know how to do that, but also terrifying because an adversary can get in now.”
Weggeman said that while great strides have been made in improving recovery time on the IT side, ways to quickly recover when OT goes down are lagging.
“We have less operational readiness to derive the mission back to where it needs to be from the OT perspective,” Weggeman said.
