CQ_20_Industry_Day_revised_slides_6SEP2019_(corrected).pdf

UNCLASSIFIED

Cyber Quest Industry Day

23 August 2019

Agenda

• Location: Room Estes B, Marriott Hotel

• Welcome/Introductions/Purpose: 0800 – 0815;

• Submission requirements/Schedule: 0815 – 0830;

• TCM Cyber: 0830 – 0930;

• Break: 0930 - 0945

• TCM EW: 0945 – 1045;

• Break: 1045 – 1100;

• TCM NS: 1100 – 1200;

• Lunch Break: 1200 – 1315;

• TCM TR/N-CFT: 1315 – 1415;

• Breakout TCM meetings: 1415 – 1515;

• Closeout: 1530.

Cyber Quest 20 Draft Objectives

TCM Cyber (Situational Understanding)

• Identify technologies that will enhance the commander's Cyber SU during Multi Domain Operations (MDO).

• Identify technologies capable of assessing overall mission risk and Cyber defensive posture.

• Identify and integrate technologies capable of displaying and sharing user defined and mission relevant social media trends.

• Identify technologies capable of immediately integrating with emerging CPCE and other programs of record.

TCM Electronic Warfare

• Identify EW support (ES) technologies that detect signals including frequency hopping technologies.

• Identify technologies that can provide the commander the ability sense and visualize their use of the electro-magnetic spectrum.

• Identify emerging technologies that can provide the freedom of movement within a saturated EME by utilizing spectrum obscuration.

TCM Networks and Services and TCM EW

• Identify emerging radio technologies that can provide Army BCT and below a High Capacity (HC), Line of Sight (LOS), terrestrial backhaul network that can support TLS (Terrestrial Layer System) and Logistics network (LOGNET) requirements.

• Integrate enterprise and tactical NETOPS capabilities into a single comprehensive system that provides the user with the ability to view and manage/control within the network.

• Demonstrate Identify and Credential Access Management (ICAM) capabilities that create trusted digital identity representations of Personal (PEs) and Non Personal Entities (NPEs).

• Demonstrate emerging Information Dissemination Management Content Staging (IDMCS) capabilities that ensure the correctly prioritized information is provided at the required time and to the required location by the appropriate individual.

TCM Tactical Radios

• Identity LEO and MEO satellite capabilities that can support Army Integrated Tactical Network (ITN) Capability and/or Assured - Positioning, Navigation, and Timing requirements.

• Assess Advanced Networking Waveforms (ANWf) and Dynamic Spectrum Allocation technologies

• Identify technologies for Assured Voice Communications.

TCM Cyber (Offensive Cyber Operations)

• Provide a tailorable survey platform of the electromagnetic spectrum with a focus on cellular and Bluetooth.

• Identify capabilities that can deny, degrade, disrupt, destroy and manipulate secure networks, devices and applications through RF enabled delivery methods.

TCM Cyber Defensive Cyber Operations)

• Identify capabilities that allow the dynamic reshaping of cyberspace based on mission and threat to include obfuscation, deception, and evasion

• Assess technologies that have autonomous active cyber defense.

Timeline

Broad Agency Announcement published – NLT 13 Aug 19

Cyber Quest Industry Day – 23 Aug 19

Deadline for White Paper submissions: 13 Sep 19

Initial Technology Selection (based on White Papers): 23 Sep 19

Technology Demonstrations (Fort Gordon): 21 - 25 Oct 19

Vendor notifications: NLT 5 Nov 19

Initial Planning Meeting: 19 – 20 Nov 19

Coordinated Working Group #1: * (25 – 27 Nov 19)

Mid Planning Meeting/Coordinated Working Group #2: * (25 – 28 Feb 20)

Final Planning Meeting/Coordinated Working Group #3: * (21 – 24 Apr 20)

Technology Integration Phase Start: 16 Mar 20

Cyber Quest Execution: 25 May – 19 Jun 20

* Tentative dates

Submission Requirements

• Vendors may respond to one or more areas listed in the BAA in the form of a whitepaper and quad chart.

• One whitepaper and quad chart must be submitted for each experiment objective addressed.

• Whitepapers must be 5 pages in length, excluding the cover page.

They should be single-sided, single spaced, utilize one (1) inch margins and Times New Roman 12 pitch font.

• Clearly state what objective you are responding to and explain how your technology addresses it.

• Cleary state any ITAR restrictions or security classification requirements.

Cyber Quest 2020 BAA Quad Chart

Technology Sponsor

Problem Statement

• Describe the problem your technology will help the Army solve.

• Explain how will it solve the problem?

• What echelon will it be used?

• Who will use it?

• What task will the solution help the soldier/unit perform?

• What is the Concept of Operations for its use?

This information was approved for publishing per the ITAR as “basic marketing information of defense articles” or per the EAR as “advertising printed matter”.

Vendor/Organization Point of Contact information and Address

Picture/OV-1

Organization Logo

Technology Description

QUESTIONS?

MAJ DeWayne Thompson Chief, Live Experimentation Branch

Cyber Battle Lab Fort Gordon, GA

706.791.8049 oscar.d.thompson.civ@mail.mil

TCM CYBER

Capability Areas of Interest Cyber Quest 20

23 Aug 2019

** Representative- Not ALL Inclusive

Depiction, perception, and understanding of cyberspace- Enables delivery of effects in support of operations

Fidelity of Information Correlation of Information- Situational Understanding

Operator Information Requirements

Health and Status

Network Configuration

Network Topology

R ed

C yb er

Individual Staff

Sections

S6 Network Health and

Status

Network Configuration

EWO (EWPMT)

EW Assets

Frequency Allocation

S2/G2 (DCGS-A)

Network Topology

Organizational Information Requirements

Cyber SU Analytics

Signal Cyber Data

EW Cyber Data

Intelligence Cyber Data

Commander’s Integrated COP

• Provides a virtual depiction of the

Commander’s battlespace

• Displays operational impact of

CEMA for the Commander

• Correlates traditionally stovepiped information; enriching data and information into knowledge and understanding in near real time

• Expedites the incorporation of

CEMA throughout all phases of an operation

• Synchronizes capabilities across domains and warfighting functions and maximizes complementary effects in and through cyberspace and the EMS

Operations

Cyber ROE

M is si o n C

M D

COA Analysis

Cyber ROE

COA Analysis

S3 (MC)

Network Configurations

Red Forces

Network Topology

Red Cyber Forces

Cyber Personas

Trends Alerts

Cyberspace/CEMA

Operations

Cyberspace/CEMA Running

Estimate

Network Awareness Asset Identification Vulnerability Management Incident Management Authorized Service Interruptions

Threat Awareness Adversary Disposition/ Actions Insider Threat Social Media

Mission Awareness Operational Assessment Cyber Forces Status Cyberspace Mission Impacts on

Current Operations

Mission Command Cyber Data

Social Layer Data

CEMA Working Group

C C

IR

s

Cyber SU Supporting Army CEMA Cyberspace SU

Cyberspace/CEMA Overlay

(COP)

C yb er O

P S

So ci al

La ye r

EM

S

A ct iv it ie s

EMS Emitters

Frequency Allocation

EW Assets

B lu e N e tw o rk

Network Survivability

Key Terrain in Cyberspace

Cyberspace Defense CWSB / CPTs

Network Survivability

Cyberspace Defense

Mission Protection

Planning Execution

Tailored Information Relevant to the Current Mission & CDR’s Critical Information Requirements (Situational Understanding)

Cyberspace Situational Understanding

Experiment Objective #1 (Cyber SU) – TCM Cyber

• Identify technologies that will enhance Commander and Staff Cyber Situational Understanding, through the graphical depiction of three layers of cyberspace (physical, logical, and persona). The Graphical User Interface should provide the following views during near-real-time Multi-Domain Operations (MDO): “see YOURSELF”, “see Your BATTLESPACE”, and “Understand the BATTLESPACE”.

• Identify pre-defined and user defined analytic algorithms capable of depicting mission impact based on correlation of multiple data sets (e.g., net flows, packet capture, vulnerability data, alerts, etc.) and variables (e.g., key terrain – cyber, threat vector, warfighting functions, system dependencies, etc.).

• Identify technologies capable of assessing overall mission risk and cyber defensive posture by correlating inputs from multiple network sources, to include, key terrain - cyber, STIGs, system vulnerabilities, risk mitigations, etc.

• Identify and integrate technologies capable of displaying and sharing user defined and mission relevant social media trends.

• Identify available technologies capable of immediately integrating with emerging CPCE and other programs of record to make the Commander more mobile, agile and lethal.

Cyberspace Situational Understanding

Offensive Cyberspace Operations

FM 3-12 - Cyberspace Actions:

Cyberspace ISR/OPE

• Survey Electromagnetic Spectrum (EMS) – Identify Targets

• network mapping and enumeration

Cyberspace Attack

• Rapid packaging of lightweight cyberspace effects.

• Radio Frequency (RF) enabled non-kinetic effects

Operator Efficiency

• Methods to reduce cyber operator cognitive load/error

Pursuit of Advanced Cyberspace Capabilities to Support Unified Land Operations

Experiment Objective #2 (Offensive Operations) – TCM Cyber

• Identify emerging cyberspace technologies and procedures that will provide the commander RF enabled non-kinetic effects in support of offensive operations.

• Integrate new and existing cyberspace technologies and procedures to prosecute and exploit advanced waveforms and emerging wireless and IoT protocols.

• Integrate new and existing cyberspace technologies and procedures that provide support to mission planning, rehearsal, and execution of Offensive Cyberspace Operations.

Offensive Cyberspace Operations

• Provide cyber-deception capabilities that could be employed to provide early warning, false information, confuse, delay, or otherwise impede cyber attackers to the benefit of friendly forces.

• Threat and mission driven response

• Cyber stealth technology

• Signature masking and reduction

• Environment obfuscation and randomization

• Return to a known trusted state while operating

Defensive Cyberspace Operations

Dynamic reconfiguration to obfuscate

Decoy/Early Warning

Cyberspace Deception

Experiment Objective # 3 (Defensive Operations) – TCM Cyber

• Identify cyber deception capabilities that incorporate automated threat and/or mission driven response activities.

• The cyber deception capability leverages stealth technologies to support signature masking and/or reduction.

• The deception capability supports randomization of infrastructure, systems, and supporting variables to confuse or redirect the adversary.

• Lastly, the cyber deception capability allows for the normalization of the environment post automated threat deception activity.

• Assess technologies that have autonomous active cyber defense.

Defensive Cyberspace Operations

QUESTIONS?

Roy Snodgrass TCM-Cyber

Cyber CoE, Fort Gordon, GA 706.791.0787 roy.g.snodgrass.ctr@mail.mil mailto:roy.g.snodgrass.ctr@mail.mil

TCM EW

Capability Areas of Interest

Experiment Objective #7 (Electronic Warfare Support):

• Identify emerging electronic warfare support (ES) technologies that can provide the Army enhanced sensing of the electro-magnetic environment (EME) at extended ranges.

• Provide the EW personnel with the ability to sense communication and non-communication signals, including frequency hopping technologies.

• Determine the type and amount of enhanced antennas required for the Terrestrial Layer System (TLS) to effectively detect signals.

• ES data must able to transport through the provided tactical network to EWPMT.

Experiment Objective #8 (Electronic Protection):

• Identify technologies that can provide the commander the ability sense and visualize their use of the electro-magnetic spectrum (EMS).

• Provide the user the ability to baseline the EMS and identify interference in the unit’s use of the EMS.

• Incorporate small form factor devices and enhanced antennas in order to sense all signals generated with an Army formation.

• EP data must able to import into EWPMT to display the unit’s use of the EMS.

Experiment Objective #9 (EMS Deception):

• Identify emerging technologies that can provide freedom of movement within a saturated EME by utilizing spectrum obscuration.

• Determine the ability for an Army formation to shape the size and position of itself to the enemy through manipulation of the EMS.

• Incorporate means to deceive the enemy of the movements of an Army formation within the saturated EME.

• Defend against Electronic Attack through EMS deception and long range delivery means.

Experiment Objective #10 (Information Warfare):

• Identify capabilities that can support Army Military Information Support Operations using radio frequency delivery methods.

TCM EW CQ20 OBJECTIVES

Contested Area Highly Contested Area

UNCLASSIFIED // For Official Use Only // Pre-Decisional

Operational Support Area

DIV TOC

Aerostat

MFEW Air Large

TLS ER

TLS ER

HA Delivered ALE

High Altitude Balloon

Operational Deep Fires Area

Radars / C2 Nodes / APNT

Strategic

Theater C2 Systems

Close Area Deep Maneuver Area

Comms / Radars / GPS / C2 Nodes / SATCOM

High Altitude jet

SI ES

CO EA

Artillery Delivered

UGS & ALEISR / Irregular ForcesSF

Infantry

HA Delivered UGS

Radar

LongRange

Artillery Armor

A2AD Bubble Infantry

Drone

Swarm

Tactical Support Area

Comms / GPS / C2 Links

MFEW Air RW

MFEW Air Small

Artillery

Corps

TOC

LEO/MEO

Joint Data Network

Theater

LRPF

HA Relay

EWPMT

EWPMT

EWPMT

TLS Large

EWPMT Dismounted

TLS Large

EWPMT

TLS Small

EWPMT

EWPMT

CONUS

CONCEPT CONCEPT

UNCLASSIFIED // For Official Use Only // Pre-Decisional

Operational Support Area

DIV TOC

Aerostat

MFEW Air Large

TLS ER

TLS ER

HA Delivered ALE

High Altitude Balloon

Operational Deep Fires Area

Radars / C2 Nodes / APNT

Strategic

Theater C2 Systems

Close Area Deep Maneuver Area

Comms / Radars / GPS / C2 Nodes / SATCOM

High Altitude jet

SI ES

CO EA

Artillery Delivered

UGS & ALEISR / Irregular ForcesSF

Infantry

HA Delivered UGS

Radar

LongRange

Artillery Armor

A2AD Bubble Infantry

Drone

Swarm

Tactical Support Area

Comms / GPS / C2 Links

MFEW Air RW

MFEW Air Small

Artillery

Corps

TOC

LEO/MEO

Joint Data Network

Theater

LRPF

HA Relay

EWPMT

EWPMT

EWPMT

TLS Large

EWPMT Dismounted

TLS Large

EWPMT

TLS Small

EWPMT

EWPMT

CONUS

UNCLASSIFIED // For Official Use Only // Pre-Decisional

Operational Support Area

DIV TOC

Aerostat

MFEW Air Large

TLS ER

TLS ER

HA Delivered ALE

High Altitude Balloon

Operational Deep Fires Area

Radars / C2 Nodes / APNT

Strategic

Theater C2 Systems

Close Area Deep Maneuver Area

Comms / Radars / GPS / C2 Nodes / SATCOM

High Altitude jet

SI ES

CO EA

Artillery Delivered

UGS & ALEISR / Irregular ForcesSF

Infantry

HA Delivered UGS

Radar

LongRange

Artillery Armor

A2AD Bubble Infantry

Drone

Swarm

Tactical Support Area

Comms / GPS / C2 Links

MFEW Air RW

MFEW Air Small

Artillery

Corps

TOC

LEO/MEO

Joint Data Network

Theater

LRPF

HA Relay

EWPMT

EWPMT

EWPMT

TLS Large

EWPMT Dismounted

TLS Large

EWPMT

TLS Small

EWPMT

EWPMT

CONUS

UNCLASSIFIED // For Official Use Only // Pre-Decisional

Operational Support Area

DIV TOC

Aerostat

MFEW Air Large

TLS ER

TLS ER

HA Delivered ALE

High Altitude Balloon

Operational Deep Fires Area

Radars / C2 Nodes / APNT

Strategic

Theater C2 Systems

Close Area Deep Maneuver Area

Comms / Radars / GPS / C2 Nodes / SATCOM

High Altitude jet

SI ES

CO EA

Artillery Delivered

UGS & ALEISR / Irregular ForcesSF

Infantry

HA Delivered UGS

Radar

LongRange

Artillery Armor

A2AD Bubble Infantry

Drone

Swarm

Tactical Support Area

Comms / GPS / C2 Links

MFEW Air RW

MFEW Air Small

Artillery

Corps

TOC

LEO/MEO

Joint Data Network

Theater

LRPF

HA Relay

EWPMT

EWPMT

EWPMT

TLS Large

EWPMT Dismounted

TLS Large

EWPMT

TLS Small

EWPMT

EWPMT

CONUS

QUESTIONS?

Daniel Bush

TCM-EW

Cyber CoE, Fort Gordon, GA 706.791.1872 daniel.g.bush.ctr@mail.mil

TCM Networks and Services

Capability Areas of Interest

TRADOC Capability Manager – Networks and Services

Mission

Army’s centralized capability manager for Army DoDIN Networks and Services for fielded and future forces.

TCM N&S is the user advocate for DOTMLPF solutions that include Unified Network Operations (UNO), Installation Information Infrastructure modernization, Mission

Partner Environment (MPE), Signal and Network Modernization efforts (SIGMOD/NETMOD) , Support to Common Operating Environment (COE), and support to Command Post Integrated Infrastructure (CPI2) – ensuring mission success across the force in support of Multi-Domain Operations.

Functions

Capability Portfolio includes multiple Programs of Record

The Army’s User Representative across DOTMLPF

Synchronize DOTMLPF with fielding

We are the proponent for all Army Networks and Services (end to end)

Focus Areas

1. Analytics, Artificial Intelligence, and Machine Learning

2. Modeling and Simulation

3. Identity Credential and Access Management (ICAM)

4. Information Dissemination Management and Content Staging

(IDMCS)

5. High Capacity (HC) Line of Sight (LOS) terrestrial backhaul network

6. Protected/Resilient SATCOM Technologies

Focus Area 1

Analytics, Artificial Intelligence, and Machine Learning

• Identify capabilities that leverage threat-based analytics, artificial intelligence, and machine learning to dynamically and/or automatically manage and control large numbers of network devices and services to simplify network decision making.

• This also includes network topologies, traffic paths, quality of service (QoS), bandwidth, and speed of service (SoS).

Analytics, Artificial Intelligence, and Machine Learning

Current Capability

• Current NetOps has no analytical or AI capability

Gap

• How can the Army improve Defensive Cyber Operations and Cybersecurity

• Threat Emulation and Vulnerability Assessment

Importance to the Army

• It is a time consuming process to go through NetOps data to optimize for mission and defend against threats

• Commanders must be able to prioritize and stage data so that critical information is delivered and available when/where needed

• IDM/CS and Network Management

Way Ahead

• Refine operational requirements

• Experiment with potential solutions

• Deliver/field analytical and AI solutions that meet UNO requirements

• Simple, Intuitive, and automated process

Focus Area 2

Modeling and Simulation

• Identify capabilities that can model, simulate, visually display and assess the differences in performance between a current and planned network.

• The intent is to analyze and validate expected changes in network performance (e.g. connectivity, throughput, propagation/coverage, network health, service health, performance, signal flow, etc.).

Modeling and Simulation

Current Capability

• WIN-T NetOps can only Model and Simulate connectivity and movement paths

Gap

• How can the Army improve Cyberspace situational understanding

• Threat Emulation and Vulnerability Assessment

Importance to the Army

• The S6/G6 does not have the ability to war game the network and provide commander recommendations on COAs

• This capability will enable Commanders to determine what additional resources will be required

Way Ahead

• Refine operational requirements

• Experiment with potential solutions

• Deliver/Intergate/field Model and Simulation solutions that meet UNO requirements

• Simple, Intuitive, and automated process

Focus Area 3

Identity Credential and Access Management (ICAM)

• Identify capabilities that can support Army ICAM requirements

• Demonstrate ICAM capabilities that create trusted digital identity representations of Personal and Non Personal Entities

• Align those identities to credentials in order to access transactions and provide authorized access to required resources

Identity Credential and Access Management

Current Capability

• No current ICAM capability in Tactical Formations

• User Name and Password on CPOF, BCCS Systems (AFATDS, AMDWS, TAIS, etc…)

• Persona Based Access

Gap

• How can the Army improve Defensive Cyber Operations and Cybersecurity

• How can the Army better authenticate users and devices and share information across multiple networks

Importance to the Army

• Current capability allows more probably of Insider Threat (through User Name and Password)

• No automated checks and balances to access data

• Current capability does not check credentials or have a standardized Public Key Enabled (PKE) infrastructure

• Current capability is Persona Based and not Role Based. Roll Based Access is more secure and only allows access to approved data where Persona Based has little to no access control

Way Ahead

• Multifactor Authentication

• (Who you are, what you have, what you know)

• Standardized PKE with CRL search for verify Credentials

• Role Based Access to approved data

• Implement a more simple, intuitive, and automated process

Focus Area 4

Information Dissemination Management and Content Staging (IDMCS)

• Demonstrate emerging IDMCS capabilities that ensure the correctly prioritized information is provided at the required time and to the required location by the appropriate individual.

Information Dissemination Management and Content Staging

Current Capability

• WIN-T NetOps can only prioritize data by VLAN

• No prioritization of data across network by type (video, audio, sensor, etc), source, destination, unit, role, or location

• No automation of the Content Staging of critical or prioritized data

Gap

• How can the Army improve Information Dissemination Management and Content Staging

Importance to the Army

• There is more demand on the future tactical network than the current tactical network capacity can handle.

• Disconnected, Intermittent, Limited, - Congested, Contested (DIL-CC) network conditions exist. The enemy will work to deny our ability to use our networks

• Commanders must be able to prioritize and stage data so that critical information is delivered and available when/where needed

Way Ahead

• Refine operational requirements

• Experiment with potential solutions

• Deliver/field ICM/CS & content management solutions that meet Unified Network Operations (UNO) requirements

• Implement a more simple, intuitive, and automated process

Focus Area 5

High Capacity (HC) Line of Sight (LOS)

• Identify emerging radio technologies that can provide Army maneuver units a High Capacity (HC) Line of Sight (LOS) terrestrial backhaul network

• Determine if the HC/LOS network can support Terrestrial Layer System (TLS) and Logistics network (LOGNET) requirements.

• Incorporate beam steering and beam forming technologies to determine their effectiveness in protecting and hiding the network.

• Identify commercial capabilities that increase bandwidth efficiency among fielded tactical radio systems in order to gain greater throughput and support

TLS.

High Capacity (HC), Line of Sight (LOS), terrestrial backhaul network

Current Capability

• HCLOS

• TRILOS

• TROPO

Gap

• How can the Army improve network connectivity and capacity

Importance to the Army

• SATCOM only operations is a potential single point of failure.

• The Army requires multiple paths through multiple frequency spectrums to transport data to the point of need

Way Ahead

• Refine operational requirements

• Experiment with potential solutions that reduce size, weight and power requirements

• Field systems that provide on the move capabilities

Focus Area 6

Protected/Resilient SATCOM Technologies

• Identify commercial technologies that can protect tactical satellite transmissions.

Protected/Resilient SATCOM Technologies

Current Capability

• SMART-T is currently the Army’s Anti-Jam (AJ) SATCOM terminal, providing a high level of AJ protection using AEHF satellites.

• 3-Star MC GOSC decision to reduce the number of SMART-T terminals.

Gap

• How can the Army improve network connectivity/Capacity

• How can the Army operate in an electronic protection and electronic warfare capable environment

Importance to the Army

• Enables a survivable and assured SATCOM network ready to fight in MDO now and into the future

• Provides a high level of AJ protection (against peer/near peer threats

• Adds resiliency to the network transport for operations in multi-domain environments

Way Ahead

• Near term fielding of Network Centric Waveform Resilient (NCW-R) and Protected Tactical Waveform (PTW) over WGS/Commercial satellites for limited AJ protection for Army wideband terminals

• Identify commercial advances in AJ or interference protection/mitigation.

• Identify LEO and MEO satellite capabilities that can provide added resiliency to network transport

• Pursue Protected Tactical Satellite (PTS) with PTW (in Army terminals) to obtain better AJ performance & throughput than current SMART over AEHF satellites

QUESTIONS?

Martin Verboom TCM Networks and Services Cyber CoE, Fort Gordon, GA

706.791.0741 martin.w.verboom.civ@mail.mil

Network Cross Functional Team/TCM Tactical Radios

Capability Areas of Interest

Experiment Objectives

• Identify LEO (Low Earth Orbit) and MEO (Medium Earth Orbit) satellite capabilities that can support Army Multi Domain Operations data transport requirements.

• Assess Advanced Networking Waveforms (ANWf) and Dynamic Spectrum Allocation technologies to determine if they can maintain communications in congested environments.

• Identify technologies for Assured Voice Communications leveraging Frequency Hopping.

Focus Areas