CDRL 0004 - OPSEC Plan.pdf

UNCLASSIFIED

AFLCMC/HNCP

Unified Platform

Operations Security (OPSEC) Plan

AFLCMC/HNCP

Unified Platform

Operations Security Plan

SIGNATURE PAGE

PREPARED BY:

YADIRA HERNANDEZ, GG-12, DAF

Lead Security Specialist, Unified Platform Cryptologic and Cyber Systems Division

APPROVED BY:

JOHN A. PRIESTLY III, Lt Col, USAF Materiel Leader, Unified Platform Cryptologic and Cyber Systems Division

Contents Record of Changes

A Word from the Materiel Leader (ML)

1. OPSEC Plan Introduction

2. Unified Platform (UP) Overview

3. OPSEC Process

4. Critical Information and Indicators (CII) and Countermeasures Defined

5. OPSEC Contracting Requirements within Acquisitions and Contracting

6. Public Release and Foreign Disclosure

7. Using Hardware or Software Not Owned by the Air Force

8. Transmitting Classified and CUI

9. Threat Information and Sources

10. Browsing the Web and Social Media Platforms

11. Artificial Intelligence (AI)

12. References

Points of Contact

Acronyms and Abbreviations

Record of Changes

Description of Change Date (YYYMM) Reviewed/Approved by

• Not applicable. Initial Document 202006 Gregory Turner

• New ML signed/approved the CIIL 202101 Gregory Turner

• Updated the date of the document.

• Added new CUI requirements.

• Changed FOUO legacy marking to

CUI markings

• Updated signatories

• Removed P1 information.

• Updated Chief Engineer signature block

• Updated ML signature block

202104

Gregory Turner

• Updated the CCSD Public Release and Workflow chart

202105 Gregory Turner

• Updated overall document marking from CUI to unclassified with caveat

202106 Gregory Turner

• Update 2024

• Defined Critical Information (CI)

• Added TikTok and social media concerns.

• Added insider threat

• Added Artificial Intelligence guidance.

• Updated CIIL for each team and section

• Added POCs

202401 Lt Col John Priestly Steven Westbrook Ryan Thompson Sylvia Kirwan

Leo Gentile Joshua Crisp Regina Rudy Mary Mabron

Chris Coy Yadira Hernandez

Pablo Zarate

A Word from the Materiel Leader (ML)

Team…

I want to personally welcome you to one of the most dynamic and innovative teams in the Department of Defense (DoD). Your assignment will be challenging, but very rewarding. You are at the tip-of-the- spear in the software development field and your contributions will provide the warfighter a superior advantage and protect the United States of America against adversaries!

As key members of the team, we need to make sure we secure our nation’s secrets and ensure its security, which is why Operations Security (OPSEC) is so critically important. OPSEC is everyone’s responsibility and is a collaborative effort to ensure the security of the capabilities we deliver and the programs we support. As part of the Unified Platform (UP) team, you must practice and understand the below:

• This plan applies to military, government civilians, and contractors working at UP.

• Follow the Public Release and Foreign Disclosure process before releasing any information to the public or foreign entity.

• Always transmit information using approved systems and networks; encrypt emails for an added layer of protection.

• Do not use privately owned or unapproved information systems (IS) to process classified information or Controlled Unclassified Information (CUI).

• Do not post UP information on outside platforms unless specifically approved by the UP

Materiel Leader (ML) and the UP Security Team.

• Always stay vigilant and aware of your surroundings.

• Absolutely no classified discussions unless inside an approved facility.

• Handle classified, CUI, and sensitive information appropriately. For example, use the

Standard Form (SF) 901 (CUI Coversheet) to transport CUI documents or information.

• Do not throw away program paperwork or products in the trash. Shred all paper documents in an approved government approved shredder.

• Ensure everyone in the building is identified via a UP issued badge or sticker. If there’s any doubt, contact the UP Security Team.

If you have any comments, questions, or concerns, please do not hesitate to come see me.

Welcome to UP!

1. OPSEC Plan Introduction The purpose of this document is to define an OPSEC Plan for UP and its partners. This is a living document and will be updated at least annually or more frequently if necessary. This plan defines the responsibilities and activities UP will implement to eliminate or reduce vulnerabilities from successful adversary exploitation of UP’s Critical Information and Indicator’s List (CIIL) as guided by DoD Manual 5205.02 and AFI-10-701.

2. Unified Platform (UP) Overview UP provides U.S. Cyber Command (USCYBERCOM) Operational Forces a Joint cyber operations infrastructure enabling full-spectrum cyberspace operations at the operational through tactical levels of warfare as part of USCYBERCOM’s Joint Cyber Warfighting Architecture (JCWA). That infrastructure is a set of foundational capabilities that enable synchronization, integration, and interoperability for JCWA components. Specifically, UP delivers a tightly integrated suite of capabilities spanning common/core Information Technology (IT) infrastructure, data platform and associated standards, and common services to enable seamlessly integrated, adaptable, and evolving warfighting capabilities comprised of multiple JCWA components.

• Common/core IT infrastructure includes compute and storage resources, data/message transport, and software development environment that enable rapid development and integration of applications, analytics, visualizations, and capabilities at speed and scale.

• The data platform and associated standards are the integrated set of technologies, standards, and processes to ingest, store, share, enrich, manage, and analyze authoritative data sources in support of offensive and defense operations with intelligence and mission partners (to include private sector).

• Common Services include capabilities such as identity management, common access, collaboration, modeling, and communication capabilities that support integration, interoperability, and inter-program synchronization.

USCYBERCOM requires an interconnected and interoperable infrastructure and set of data-centric capabilities to conduct integrated planning and execution of operations to achieve Combatant Commander prioritized outcomes in cyberspace. USCYBERCOM Operational Forces require the ability to conduct multiple, coordinated, integrated, joint cyberspace operations world-wide. The integrated suite of JCWA capabilities must enable operational forces to make timely decisions, take decisive action, and continually adapt to achieve overmatch against evolving, sophisticated, and motivated adversaries at speed and scale.

UP will achieve its mission objectives through creation of a single, unifying cloud-based infrastructure for Joint Cyber Warfighting Architecture (JCWA) operational users and stakeholders that enables integration of cyber capabilities, systems, infrastructure, data storage and analytics in support of full-spectrum cyberspace operations. Foundational Efforts provide for the research, development, prototype maturation, integration, enhancement, delivery, and enduring product support of the UP capability to ensure responsiveness to warfighter requirements within operationally relevant timeframes. Foundational Efforts provide a flexible, yet disciplined, agile development/security/operations (DevSecOps) platform to generate new capabilities, integrate existing and emerging technologies, incorporate rapid prototyping efforts, and evolve the UP baseline to meet evolving operational priorities.

3. OPSEC Process The OPSEC process is a standardized, continuous, and iterative sequence of steps to identify, analyze, control, and protect sensitive and Critical Information (CI). It is a cyclic approach of denying critical information to an adversary. For a more detailed process description, refer to

AFI 10-701.

Figure 1-1: The OPSEC Cycle

4. Critical Information and Indicators (CII) and Countermeasures Defined Critical Information (CI) is identified by following the OPSEC Cycle and is information that the organization has determined is valuable to an adversary. Indicators are the second part of CII and can be friendly actions or activities readily evident to adversaries. These actions or activities reveal friendly information which can be directly related to operations, activities, policies, standards, and risk mitigation actions. Once CII are identified, countermeasures are implemented for every CII. Countermeasures are steps or ways the organization must uphold to reduce the organization’s vulnerabilities and risk to safeguard CII. The countermeasures implemented are designed to prevent an adversary from detecting CI, provide an alternative interpretation of critical information or indicators (deception), or deny the adversary’s collection system.

Even pieces of unclassified information can hold great value to an adversary. Adversaries can put together small details and indicators, called “aggregation,” to deduce enough information about day-to-day activities and plan to cause damage or irreparable harm to DoD operations.

This is the reason an OPSEC plan and Critical Information and Indicators List (CIIL) and Countermeasures is critical to a thriving organization like UP. UP’s CIIL and Countermeasures are not a part of this unclassified OPSEC Plan. They are in a separate document titled (CUI) UP CIIL and Countermeasures 2024. Please reach out to the UP Security Team if you have any questions.

5. OPSEC Contracting Requirements within Acquisitions and Contracting Per AFI 10-701, The Secretary of the Air Force for Acquisition, Technology and Logistics (SAF/AQ) ensures OPSEC is included in program protection plans to protect CII throughout the lifecycle of Air Force acquisition and research, development, test and evaluation for critical program information.

OPSEC must be considered throughout the lifecycle of the DoD acquisitions and contractor-supported efforts, beginning, middle, end, and beyond. It is essential to integrate OPSEC into the earliest stages beginning with operational capability requirements and continue through the award process, design, development, test and evaluation, fielding, sustainment, and system disposal. An OPSEC requirement within acquisitions and contracting ensures CII are not prematurely released to vendors. This is the reason our CIIL and Countermeasures are separated from this unclassified version of the UP OPSEC Plan. This applies to all types of contracts, including but not limited to service, support, acquisition and fundamental research and grants.

Contractors for defense systems acquisition programs, as well as other types of DoD contracts, will practice OPSEC to protect critical information and indicators as specified in government contracts and subcontracts.

In regard to ensuring OPSEC program managers and contracting officers understand their responsibilities, the “CLC 107 OPSEC Contract Requirements” course is located on the Defense Acquisition University website. The course introduces the basic elements of OPSEC, identifies the role of OPSEC within DoD, and recognizes the OPSEC responsibilities of program managers and contracting representatives for establishing contracting services. This course is mandatory for OPSEC practitioners and contracting representatives who review contracts.

Training is essential and required during the onboarding phase for all UP members. Please reach out to the UP Security Team if any questions on this training requirement.

6. Public Release and Foreign Disclosure All information intended for public release or foreign disclosure must be evaluated for classified content, Controlled Unclassified Information (CUI), and CIIL. In support of OPSEC, doing so ensures OPSEC sensitive information is not being disclosed.

Some examples of information that requires public release or foreign disclosure review may include resumes, articles for newspapers, award write-ups, program web pages, memorandums of agreement, memorandums of understanding, and slides for briefings that may be released to the public or foreign entity.

https://www.dau.edu/ https://www.dau.edu/

All UP members are responsible for coordinating with the HNCP OPSEC Coordinators to perform, review, and approve all program information to be considered for public release or foreign disclosure prior to release of information. Personnel who release information without the appropriate approval are subject to security action.

7. Using Hardware or Software Not Owned by the Air Force If processing program information on contractor-owned/operated hardware and software, it must meet all security requirements for government-owned hardware and software including antivirus software with current signature files. For security "best practices,” ensure operating systems, firewalls, and anti-spyware software are also current.

If Controlled Unclassified Information (CUI) will be stored or processed, the information system (IS) will comply with NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. It is a contractual requirement for the information systems of any non-federal entity (i.e., contractors, vendors, suppliers) that processes, stores, transmits, or protects CUI for the Department of Defense (DoD). Do not use privately owned IS or unapproved systems to process classified information or CUI. Privately owned IS contaminated with classified information must be confiscated and sanitized. If it cannot be sanitized, then it must be disposed of in accordance with Air Force Manual (AFMAN) 17-1301, Computer Security.

Do not use foreign-owned or operated joint or coalition IS to process sensitive, classified or CI unless required by international treaties or security agreements. Government-owned sensitive information must remain on removable media and be marked and protected according to the sensitive category (e.g., CUI) program directives. Also, comply with AFMAN 17-1203, Information Technology Asset Management and AFI 33-332, AF Privacy and Civil Liberties Program, for processing Privacy Act information.

Refer to AFI 17-130, Cybersecurity Program Management for additional guidance. For transmission of classified processing in a sensitive compartmented information facility environment, refer to the DoD Joint Security Implementation Guide.

8. Transmitting Classified and CUI Use secure approved methods to transmit classified information and Controlled Unclassified Information (CUI). Examples include the use of a Secure Fax, Secure Terminal Equipment, National Secure Telephone System, Secure Internet Protocol Router Network, Joint Worldwide Intelligence Communications System, National Security Agency Network, etc. Ensure the devices are properly keyed and operated in the secure mode at the appropriate level and the recipient has the clearance, access, and need-to-know before discussing or transmitting classified information.

Per DoD Manual 5200.01, DoD Information Security Program, Volumes 1-4, and AFI 17-130, Cybersecurity Program Management, electronic transmission of CUI (voice, data, or facsimile), shall be by approved secure communications systems whenever practical. Therefore, the program's CUI must be protected during transmission (e.g., use DoD Public Key Infrastructure encryption on Non-Security Internet Protocol Router Network, especially if leaving the Government .mil domain (e.g., transmitting data between the UP personnel to contractors, etc.).

9. Threat Information and Sources Detailed intelligence/counterintelligence threat information can be found in the following documents:

• Program Protection Plan (PPP)

• AF Office of Special Investigations (AFOSI) Local Threat Assessment for Joint Base San Antonio - Lackland AF Base or the location where operations are occurring.

• Defense Intelligence Agency's (DIA) at www.afosi.af.smil.mil or http://www.dia.smil.mil/

• Baseline Threat Assessments (Criminal, Cyber, Economic Crime, Foreign Intel and Terrorist) can be found at www.afosi.af.smil.mil/Default.aspx.

• Counterintelligence Support Plan (CISP)

• Validated Online Life-cycle Threat (VOLT)

Please reach out to the UP Security team if access to the above documents is needed.

OPSEC threats are categorized by specific intelligence disciplines that may be used by an adversary to gain CI. Below is a description of intelligence disciplines that are applicable to UP:

• Human Intelligence (HUMINT): Information obtained from individuals who know or have access to sensitive foreign information that has implications for U.S. security interests.

• Geospatial Intelligence (GEOINT): Exploitation and analysis of imagery and other geospatial information to describe, assess and visually depict physical features and geographically referenced activities on earth.

• Open-Source Intelligence (OSINT): Information of an intelligence value that is available to the public.

• Signals Intelligence (SIGINT): Information derived from intercepted communications and electronic data transmissions.

• Trash Intelligence (TRASHINT): Recovery of sensitive but unclassified information about US military operations and capabilities via "dumpster diving."

An insider threat is any person who has or had authorized access to or knowledge of an organization’s resources, including personnel, facilities, information, equipment, networks, and systems and uses said knowledge to cause harm to the organization. Personal factors such as greed, financial need, anger, and revenge can all be signs that government employees, contractors and even military personnel may be an insider threat. Some examples of behavioral indicators that insider threats display that may indicate spying activity include, but are not http://www.afosi.af.smil.mil/ http://www.dia.smil.mil/ http://www.afosi.af.smil.mil/Default.aspx limited to, the mishandling of information, deterioration of work performance and attitude, purchasing high value items or unexplained wealth.

It is important that all UP personnel stay vigilant and take the time to know the members of their team to understand the different personalities that make up the team. Doing so, can not only improve the quality of relationship and experience working in UP, but can also help you identify behavioral indicators for suspected insider threat activity. All UP personnel are responsible for reporting any suspicious activity to the UP Security Team.

10. Browsing the Web and Social Media Platforms When browsing the web and social media platforms, all UP personnel are responsible for not posting Personally Identifiable Information (PII), Controlled Unclassified Information (CUI), classified information, Critical Information (CI), and any information that may have the potential to damage UP operations.

The following are recommended tips that all UP personnel should follow when browsing the web and social media platforms:

• Adjust privacy settings on all accounts and select options that limit access and viewability by unknown personnel.

• Do not use TikTok, as seen in the TikTok Concerns and Vulnerabilities (OPSEC Program article; March 2023). If purchasing a new phone, ensure TikTok is not preloaded in your new device. If it is, ensure you uninstall the TikTok app.

• Turn off geolocation on all social media sites or apps on all personal devices.

• Keep passwords secure. Do not share passwords.

• Treat emails, links, and files carefully as they may be phishing attempts.

11. Artificial Intelligence (AI) Artificial Intelligence (AI) is the technology that mimics human intelligence to perform tasks and cognitive functions as associated with human minds. AI has proliferated across the private and public sectors. Some AI tools may collect data on users that may be intrusive. For example, platforms may collect data on a user's age, name, location, online activity, and photo metatags for the purpose of creating a more targeted advertising experience.

Most AI tools, with some exceptions, such as Chat Generative Pre-Trained Transformer (Chat GPT), one of the most popular AI chat boxes, are not allowed to be used for classified and CUI.

The SAF/CND developed a list of approved AI solutions for use on government funded equipment and DAF networks. For additional information on approved government AI tools, please reach out to the UP Security Team.

https://www.dni.gov/files/NCSC/documents/nittf/OPSEC_Advisory_TikTok_Concerns_and_Vulnerabilities.pdf

12. References

DoDM 5205.02, DoD Operations Security (OPSEC) Program Manual, 3 November 2008, Incorporating Change 2, 29 October 2020

AFI 10-701, Operations Security, 24 July 2019, Incorporating Change 1, 9 June 2020

NIST 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, February 2020, Includes updates as of 20 January 2021

AFMAN 17-1301, Computer Security (COMPUSEC), 06 March 2019

AFMAN 17-1203, Information Technology Asset Management (ITAM) and Accountability, 13 September 2022

AFI 33-332, Air Force Privacy and Civil Liberties Program, 10 March 2020, Corrective Actions Applied on 12 May 2020

AFI 17-130, Cybersecurity Program Management, 13 February 2020

DoDM 5200.01, DoD Information Security Program, Protection of Classified Information, 24 February 2012, Incorporating Change 3, 28 July 2020 https://www.esd.whs.mil/portals/54/documents/dd/issuances/dodm/520502m.pdf https://www.esd.whs.mil/portals/54/documents/dd/issuances/dodm/520502m.pdf https://static.e-publishing.af.mil/production/1/af_a3/publication/afi10-701/afi10-701.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r2.pdf https://static.e-publishing.af.mil/production/1/afrs/publication/afman17-1301_afrssup/afman17-1301_afrssup.pdf https://static.e-publishing.af.mil/production/1/saf_cn/publication/dafman17-1203/afman17-1203.pdf https://static.e-publishing.af.mil/production/1/saf_cn/publication/dafman17-1203/afman17-1203.pdf https://static.e-publishing.af.mil/production/1/saf_cn/publication/afi33-332/afi33-332.pdf https://static.e-publishing.af.mil/production/1/saf_cn/publication/afi33-332/afi33-332.pdf https://static.e-publishing.af.mil/production/1/saf_cn/publication/afi17-130/afi17-130.pdf https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/520001m_vol3.pdf https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/520001m_vol3.pdf

Points of Contact OPSEC Coordinators

Position Name E-mail Wing OPSEC

Coordinator Lead Turner, Gregory gregory.turner.3@us.af.mil

Wing OPSEC Coordinator Alternate

Lewis, James james.lewis.112@us.af.mil

HNC-CY OPSEC

Coordinator

Garcia, Raymond raymond.garcia.23@us.af.mil

HNCP OPSEC

Coordinator

Hernandez, Yadira yadira.hernandez.1@us.af.mil

Unified Platform (UP)

Position Name E-mail Materiel Leader

Lt Col Priestly, John john.priestly@us.af.mil

Deputy Thompson, Ryan ryan.thompson.30@us.af.mil

Security Team Hernandez, Yadira Government Security Lead

Austin, Jared

EPASS Security Lead yadira.hernandez.1@us.af.mil jared.austin.1.ctr@us.af.mil

Intelligence Zarate, Pablo pablo.zarate.1.ctr@us.af.mil Facilities Coy, Chris chris.coy@us.af.mil mailto:gregory.turner.3@us.af.mil mailto:james.lewis.112@us.af.mil mailto:raymond.garcia.23@us.af.mil mailto:yadira.hernandez.1@us.af.mil mailto:john.priestly@us.af.mil mailto:Ryan.thompson.30@us.af.mil mailto:yadira.hernandez.1@us.af.mil mailto:jared.austin.1.ctr@us.af.mil mailto:pablo.zarate.1.ctr@us.af.mil mailto:chris.coy@us.af.mil

Acronyms and Abbreviations

AF Air Force

AFI Air Force Instruction

AFMAN Air Force Manual

AFOSI Air Force Office of Special Investigations

AI Artificial Intelligence

Chat GPT Chat Generative Pre-Trained Transformer

CI Critical Information

CII Critical Information and Indicators

CIIL Critical Information and Indicators List

CISP Counterintelligence Support Plan

CUI Controlled Unclassified Information

DIA Defense Intelligence Agency

GEOINT Geospatial Intelligence

HUMINT Human Intelligence

IS Information Systems

JCWA Joint Cyberspace Warfighter Architecture

MASINT Measurement and Signature Intelligence

ML Materiel Leader

OPSEC Operations Security

OSINT Open Source Intelligence

PPP Program Protection Plan

SIGINT Signals Intelligence

TRASHINT Trash Intelligence

UP Unified Platform

USAF United States Air Force

USCC United States Cyber Command

VOLT Validated Online Life-cycle Threat