The National Guard will conduct the 2020 edition of its annual Cyber Shield Exercise completely online in response to the COVID-19 pandemic.
“The mission of Cyber Shield is to develop, train, and exercise cyber forces in the areas of computer network internal defensive measures and cyber incident response,” National Guard Bureau spokesperson Wayne V. Hall wrote in an Aug. 31 email to reporters. “These capabilities facilitate National Guard Cyber Teams’ abilities to conduct missions to coordinate, train, and assist federal, state, and industry network owners that are threatened by cyberattack.”
The exercise, slated for Sept. 12-27, is projected to include more than 800 Guard personnel from at least 41 states and the District of Columbia, plus U.S. government and private sector partners, according to Illinois National Guard spokesperson Lt. Col. Brad Leighton. NGB expects Air National Guard personnel to comprise about 20 percent of its uniformed participants, he said.
Most Guard personnel will participate remotely, with Microsoft Teams being the main platform used during the exercise, Army Col. Teri D. Williams—commander of the Virginia Army National Guard’s 91st Cyber Brigade and the officer in charge of Cyber Shield 2020—told reporters during a Sept. 2 NGB media call about the exercise. Troops will also have access to email, a ticketing system, and a chat capability, she added.
In contrast with last year’s iteration of the exercise, which featured a single, extended cyber scenario, this year’s event will feature a collection of single-day cyber events and training exercises, said George Battistelli, exercise director and chief of the Army National Guard’s IT Security, Compliance and Readiness Division.
“At the end of the day, we will tear down, we will reconstitute, and have another event and another scenario for the next day, and so on,” he told reporters during the same call.
Battistelli said this format serves two purposes. First, he said, it allows the Guard “to baseline everybody’s training from a DCOE [Defensive Cyber Operations Element] perspective.” Next, it ensures that regardless of Guard members’ cyber strengths and weaknesses, that they all get “on the same page.”
Williams said the Guard intentionally incorporated knowledge gaps and skills shortfalls that were identified via the Command Cyber Readiness Inspection Program into this year’s exercise.
According to Battistelli, this program examines risk posture and open vulnerabilities. He said this year’s exercise will take “open vulnerabilities and potential open exploits” that were trending across the Guard and intentionally attempt to exploit them. That way, he said, commanders can get a specific look at how bad actors—internal or external, alike—could intrude into their networks and gain illicit access.
Illustrating these cause and effect relationships between CCRI findings and network weaknesses also serves as a reality check for commanders, he said, since it forces them to take seemingly low-risk hypotheticals more seriously.
Both Battistelli and Williams were hesitant to divulge the specifics of Cyber Shield 2020 scenarios, as well as the particular kinds of information and cyber skills the exercise will test, for fear of potentially tipping off participants to the challenges that lie ahead.
However, Batistelli said participating personnel could expect to see phishing—which he said “continues to be the number one attack vector”—as well as insider threats. This year’s exercise also will include a greater focus on information operations, he added.
“The first part of the week will focus on … a lot of the things that you see in the news, and … then later in the week, we focus a little bit more on some of the newer technology,” Williams said. “We certainly jump into the … industrial control [systems] … portion of the exercise.”
While a full list of participating ANG wings wasn’t available by press time, Leighton told Air Force Magazine that all three of the Illinois ANG’s wings will be taking part. A small number of Coast Guard, Marine Corps, and Navy personnel are also signed up for the exercise as of Sept. 2, he added.