Cyber_Curriculum_PWS_Appendix_4_POI_Phase_2.pdf

POI: E3OBR17D1 002A

(PDS CODE: OKO)

PLAN OF INSTRUCTION

(Technical Training)

Undergraduate Cyberspace Training (phase 2)

81 TRAINING WING

81 TRAINING GROUP

333 TRS/UMA

Effective 22 September 2016 with Class 2016024 C1 E3OBR17D1 002A (04 Aug 2017) C2 E3OBR17D1 002A (14 Aug 2017) C3 E3OBR17D1 002A (08 Aug 2017) C4 E3OBR17D1 002A (08 Aug 2018)

POI E3OBR17D1 002A

A

LIST OF CURRENT PAGES

PAGE NO

ISSUE

Title………………………………………………………………………………………………....... Original A……………………………………………………………………………………………………… Original i …………………………………………………………………………………………………….... Original

Attacking and Exploiting Cyber Networks Orientation (U) pages 1-4 ............................................................................................................... Original Attacking & Exploiting Cyber Networks (TS/SCI) pages 1-3 ....................................................... Original Cyberspace Organizations & Concepts (TS/SCI) pages 1-3 .......................................................... Original Network Warfare Mission Planning, Briefing, Execution, and Debriefing (TS/SCI) pages 1-3.... Original Written Measurement and Feedback (S) pages 1-2 ........................................................................ Original Defensive Cyberspace Operations (DCO) and Department of Defense Information Network (DODIN) Defensive Cyberspace Operations (DCO) and Department of Defense Information Network (DODIN) (S) pages 1-4 .............................................................................................................................................. Original Cyber Network Threats and Defense (TS/SCI) pages 1-2 .............................................................. Original Written Measurement and Feedback (S) pages 1-2 ........................................................................ Original Industrial Control Systems Industrial Control Networks (TS/SCI) pages 1-4 ........................................................................... Original Written Measurement and Feedback (U) pages 1-2 ....................................................................... Original Telephony Networking Telephony Networks (TS/SCI) pages 1-4 ....................................................................................... Original Written Measurement and Feedback (U) pages 1-2 ....................................................................... Original Strategic Network Warfare Introduction to Strategic Application (TS/SCI) pages 1-2 ............................................................. Original Integrated Air & Missile Defense Systems (IAMDS) Fundamentals (TS/SCI) pages 1-2............. Original Space Networks Fundamentals (TS/SCI) pages 1-2 ....................................................................... Original Strategic Cyber Kill Chain (TS/SCI) pages 1-2 .............................................................................. Original Red C4ISR Networks (TS/SCI) pages 1-2...................................................................................... Original Blue C4ISR Networks (TS/SCI) pages 1-3 .................................................................................... Original Written Measurement and Feedback (TS/SCI) pages 1-2 .............................................................. Original Laws & Ethics Federal Laws Governing Network Monitoring (S) pages 1-3 ........................................................ Original International and Operations Law (S) pages 1-2 ............................................................................ Original Ethics, Regulations and Obligations (S) pages 1-2 ......................................................................... Original Internet Regulatory Agencies and Coordination (S) pages 1-2 ...................................................... Original Written Measurement and Feedback (U) pages 1-2 ....................................................................... Original Fighting Through a Cyber Attack (Capstone) Fight Through a Cyber Attack (TS/SCI) pages 1-3 ........................................................................ Original DoD 8570.1M Boot Camp & Certification Security Concepts (U) pages 1-3 .................................................................................................... Original Certification Testing (U) pages 1-2 ................................................................................................ Original Course Feedback and Graduation (U) pages 1-2 ............................................................................ Original

DISTRIBUTION:

SAF/A6ODE-1

POI E3OBR17D1 002A

B

81 FSS/FSSM-1

333 TRS/TRR-2

333 TRS/UMAF-2

DEPARTMENT OF THE AIR FORCE

Keesler AFB, MS

PLAN OF INSTRUCTION E3OBR17D1 002A

(PDS CODE OKO)

i

FOREWORD

1. PURPOSE: This publication is a Plan of Instruction (POI) when the pages listed on page A are bound into a single volume. When separated into units of instruction, it becomes the Lesson Plan/Part I. The POI contains the qualitative requirements for E3OBR17D1 002A, Undergraduate Cyber Training (phase 2), in terms of objectives for each unit of instruction and shows planned time and support materials and guidance. This POI was developed according to AETCI 36-2641 and Interactive Courseware Implementation System (ICIS) software.

2. COURSE DESIGN DESCRIPTION: The instructional design for this course is group-paced. This course provides training to personnel in the 17D AFSC and civilians in the knowledge and skills necessary to perform duties across the spectrum of the cyberspace domain.

3. TRAINING EQUIPMENT: Refer to the AETC Form 120 for major training equipment.

4. REFERENCES: This POI is based on Course Training Standard (CTS/SCI) E3OBR17D1 002A, 8 August 2013, and Course Chart E3OBR17D1 002A dated <TBD upon approval of revised-post service test course chart, approx. date fall 2016>

5. INSTRUCTION SEQUENCE: The POI is the preferred instructional sequence for the course.

6. CORE VALUES: Throughout the course, instructors will weave information about core values using active learning techniques.

DEPARTMENT OF THE AIR FORCE

Keesler AFB, MS

PLAN OF INSTRUCTION E3OBR17D1 002A

(PDS CODE OKO)

ii

JAY D. MOONEY, GS-12, DAF

Chief, Training Development Element

Supersedes: E3OBR17D1 002A, 21 August 2015

OPR: 333 TRS/TRR

Prepared by: Ms Juli Bocek Distribution: Listed on Page A

7. OTHER:

Supersedes:

POI NUMBER

E3OBR17D1 002A

BLOCK

I

UNIT

DATE

22 Sep 2016

PAGE NO.

PLAN OF INSTRUCTION/LESSON PART I

NAME OF INSTRUCTOR

COURSE TITLE

BLOCK TITLE

Attacking and Exploiting Cyber Networks

COURSE CONTENT TIME

1. Orientation (U)

a. Orientation Task(s): N/A MEAS: None

(1)

SUPERVISOR APPROVAL OF LESSON PLAN

SIGNATURE AND DATE SIGNATURE AND DATE

SUPPORT MATERIALS AND GUIDANCE

BLOCK

I

UNIT

DATE

22 Sep 2016

Student Instructional Materials

AETCI 36-2909

Training Methods Lecture (1 hrs)

Instructional Guidance 1(a) Brief Warrior Ethos daily.

Course Overview and Administration: Explain the duty hours, use of phones, cell phones, and pagers. Also, describe the course and give an overview of each block. Explain introductions, chain of command, and AETC/local policies.

Conduct instructor/ student introductions. Describe course makeup and classroom procedures, locations of various facilities. State uniform/dress policy. Address military customs and courtesies. Brief students on tobacco use policy at AETC facilities: No students (civilian or military, regardless of military branch) can smoke during the training day. Brief students on additional security issues including: environmental issues and natural disasters. Remind students of the KAFB Form 21, Hurricane Sheltering Intentions (1 Jun-30 Nov).

Discuss any plans of action concerning natural disasters. Complete AF Form 4392, Pre-departure Safety Briefing (as applicable): all personnel under 26 years of age on long weekends and before departing on leave;

TDY; or everyone when departing PCS. Complete student locator information as necessary.

Student Feedback Program: Discuss the feedback program and how students can provide feedback. AETC Form 736, Student Feedback, Technical Training (TT), and Base Support of Training (BST), will be completed for courses 10 days or longer. Brief TT and BST surveys will be completed on-line NLT 5 days prior to graduation. Emphasize that it is not a compliant sheet, but rather a way to improve the course. Feedback, negative or positive, is highly encouraged and can be completed at any time during the duration of the course.

State that AETC Form 736 can be completed at any time throughout this course to identify a shortfall or to make a positive observation.

Instructional Material Types and Uses: Describe the types of student material and exams. Integrate the Air Force technical data system and other publications applicable to an AFSC throughout the course.

Training Material and Resource Conservation: Ensure the students know that it is the goal of this schoolhouse and the Air Force, to minimize costs associated with running the facility. One way to reduce costs is to conserve resources and energy. Instruct students to turn off monitors and lights when rooms are not in use. Only print what is required to save on paper. If documents can be printed in black and white, versus color, then print in black and white.

Training Environment Safety: Discuss some of the local safety concerns, building evacuation procedures, and RM (risk management). Integrate job-oriented safety (See applicable Air Force Occupational Safety and Health (AFOSH) standards), environmental issues (including pollution prevention awareness), publications awareness (emphasize compliance with instructions is mandatory), Risk Management (weave principles throughout the core curriculum), where appropriate throughout the course.

Brief students on the adverse effects of driving under the influence of intoxicating substances dealing with their careers and others.

SUPPORT MATERIALS AND GUIDANCE (continued)

BLOCK

I

UNIT

DATE

22 Sep 2016

Air Force Fraud, Waste and Abuse Prevention and Detection: Describe the AF FW&A program. Brief on the fraud, waste, and abuse prevention and detection policies and the need to avoid such activities.

Sexual Harassment and Assault Reporting, Professional and Unprofessional Relationships, Trainee Abuse and Hazing, and Academic Integrity: Describe required standards of conduct for trainees/students, faculty, and staff. Ensure AETCI 36-2909, Recruiting, Education, and Training Standards of Conduct, is included as part of the student instructional material. Refer to AETCI 36-2909 for examples of professional and unprofessional relationships between trainees/students, faculty, and staff.

Encourage trainees/students to follow the chain of command to resolve issues, where practical. If the unprofessional conduct involves someone in the trainee/student’s chain of command, inform trainees/students they may go to the next higher level (e.g., instructor supervisor, flight commander/chief, squadron commander, or group commander) or appropriate outside office or agency to report it. Encourage trainees/students to report sexual assault in accordance with AFI 36-6001, Sexual Assault Prevention and Response (SAPR) Program.

Identify support and investigative agencies, their contact numbers, and hotlines available to students and trainees who need assistance in resolving issues. Also, tell the students that the Air Force and AETC policy with regard to discrimination is clear: “Any conduct that involves unwanted sexual advances, requests for sexual favors, or any other verbal or physical conduct of a sexual nature that creates an intimidating, hostile, or offensive environment for any Air Force member WILL NOT, repeat WILL NOT be tolerated. You have an absolute right to a learning and living environment that is free of sexual harassment – 24 hours a day, seven days a week. If you are a victim of sexual harassment, it is vital that you report it immediately – tell anyone in your chain of command. Give the following statement about Sexual Harassment and Assault Reporting:

“Victims of sexual harassment and/or sexual assault in training environments are provided confidential access to victim support services. Victims will be afforded the necessary time for recovery and opportunity to make up training missed during the recovery period. Training may be made up through either special individualized assistance (SIA) or washback/recycle. How training will be made up will be determined by the instructor supervisor with the best interests of the student in mind and based on the amount of training that has been missed, complexity of the training, and other relevant factors.”

Air Force Core Values and Doctrine: Instructors will present Air Force core values, as referenced in The Little Blue Book, to all Air Force students. Throughout the course instructors will weave in information about core values using active learning techniques. These techniques are identified as modeling, one-way stories, guided discussions, two-way stories, simulations, lived experiences, and case studies. Instructors will use their discretion as to the technique to be used and optimum times to inject the core value information. Describe the AF Core Values and why we should follow them throughout the course. Instructors will present the basic levels of AF doctrine as well as the Principles of War.

SCIF Orientation: Instructor will cover the following areas concerning Sensitive Compartmented Information (SCI) facilities: SCIF access; system access; and information safeguarding within a classified area. The instructor is to stress the importance of following the security guidelines. Students will follow the guidelines introduced in this unit through the course and their career.

OPTIONAL: Guest Speakers at their convenience: wing commander and squadron commander’s welcome and squadron commander’s expectations brief.

Discuss AF Core Values and why we should follow them throughout the course. Integrate Air Force doctrine throughout instruction. Reference Air Force doctrine at Curtis E. LeMay Center for Doctrine Development and Education website at https://doctrine.af.mil.

Integrate the Air Force technical data system and other publications applicable to an AFSC throughout the https://doctrine.af.mil/

BLOCK

I

UNIT

DATE

22 Sep 2016 course.

Integrate job-oriented safety (See applicable Air Force Occupational Safety and Health (AFOSH) standards), environmental issues (including pollution prevention awareness), publications awareness (emphasize compliance with instructions is mandatory), Risk Management, Energy Conservation (weave principles throughout the core curriculum), where appropriate throughout the course.

BLOCK

I

UNIT

DATE

22 Sep 2016

BLOCK TITLE

Attacking and Exploiting Cyber Networks

2. Attacking & Exploiting Cyber Networks (TS/SCI)

a. Explain the attack and exploitation terms related to attack and exploitation of cyber networks.

Task(s): 7.1 MEAS: W

b. Explain how Tactics, Techniques, and Procedures (TTPs), Attack & Exploitation Vectors, and Platform Defensive Measures are used to achieve desired effects in cyberspace. Task(s): 6.3, 7.2, 7.8 MEAS: W

(2)

c. Given access to a live network, perform nodal analysis on network nodes with no more than 4 instructor assists. Task(s): 3.1, 3.2, 7.3, 26.2, 29.1, 29.2 MEAS: PC/W

(65)

BLOCK

I

UNIT

DATE

22 Sep 2016

ST E3OBR17D1 002A, Attacking and Exploiting Cyber Networks (TS/SCI) WB E3OBR17D1 002A, Attacking and Exploiting Cyber Networks (TS/SCI)

Audiovisual Aids Warrior Ethos Vignettes Slide Presentation – Air Force (Optional) (TS/SCI)

Training Equipment LabNet ESX Server Suite (16) SIMTEX Range (1) Student Interface Suite (1)

Training Methods Demonstration/Performance (65 hrs) Lecture/Discussion (3 hrs)

Instructional Guidance 2(a) Brief Warrior Ethos Daily.

Explain the differences between Cyberspace Operations (CO), Cyberspace Attack, Cyberspace Defense, and Cyberspace Intelligence, Surveillance, and Reconnaissance (ISR). Discuss the terms “Deny, Degrade, Disrupt, Destroy, and Manipulate” (D4M). Discuss other terminology as found in other publications. Introduce the concept of the 10/18/50 CO authorities. Introduce debriefing criteria and requirements.

APPLICATION: None.

EVALUATION: Measurement deferred to Block Test.

2(b) Explain Tactics, Techniques, and Procedures (TTPs) and where they can be found. Discuss how mission planners use TTPs when developing cyberspace missions. Explain the concept of a vector. Review the OSI model, emphasizing the three most common levels of exploitation and attack. Discuss application-based vectors including web application, database and email vectored attacks. Discuss network-based vectors including vectors based on networking protocols and router vulnerabilities. Explain various physical-layer vectors including electronic attack, offensive counter-air operations. Discuss the various methods used to defend attack platforms. Define and discuss the importance of non-attribution networks. Differentiate non-attribution from selective-attribution in CO. Discuss various methods of on-net routing as a means of prevent tracing. Discuss pivot methodologies. Explain how co-option is used to undermine and collect intelligence during cyberspace operations. Discuss the use of dead-drops in exploitation operations.

APPLICATION: None.

EVALUATION: Measurement deferred to Block Test.

2(c) Introduce students to the Kali environment on LABNET. Explain to the students the concept of the Anatomy of an Attack, and how it is an academic framework for exploiting and attacking networks. Introduce

BLOCK

I

UNIT

DATE

22 Sep 2016 students to the command line, and show the various Windows and Unix command line tools. Explain the importance and power of the command line. Demonstrate for students the use of various passive reconnaissance tools. Perform nodal analysis through active reconnaissance on LABNET & enumeration using various tools in Kali such as nmap, nc.exe, and traceroute. Perform nodal analysis by gaining access and escalating privileges on targets using capabilities in the metasploit framework in Kali and other alternate methods of access. Complete nodal analysis by pilfering requested data, and install backdoors on target using capabilities in the metasploit framework and Kali. Demonstrate to students various tools for a DoS type attack, the practical use of a pivot.

APPLICATION: None.

EVALUATION: Administer Progress Check II-1c. Record results on automated database and re-administer PC for unsatisfactory performance. Knowledge measurement deferred to Block Test.

Discuss AF Core Values and why we should follow them throughout the course. Integrate Air Force doctrine throughout instruction. Reference Air Force doctrine at Curtis E. LeMay Center for Doctrine Development and Education website at https://doctrine.af.mil.

Integrate the Air Force doctrine, technical data system, and other publications applicable to an AFSC throughout the course.

Integrate job-oriented safety (See applicable Air Force Occupational Safety and Health (AFOSH) standards), environmental issues (including pollution prevention awareness), publications awareness (emphasize compliance with instructions is mandatory), Risk Management, Energy Conservation (weave principles throughout the core curriculum), where appropriate throughout the course.

Multiple Instructor Requirements Geographical Separation (2) (65 hrs)

MIR

Two instructors are required for objective 2c (65 hours) to evaluate 2 groups of 8 students each in the standard classrooms (rooms 115, 116, 117, 118, 127, 135). Each classroom instructor will be responsible for opposite sides of the classroom and will manage half the workstations in the classroom. Irrecoverable system failure can result from incorrect configuration settings if students fail to complete the step-by-step instructions as directed.

Failure to provide constant supervision could result in a student erroneously corrupting a production network which would stop training until the network could be rebuilt. Instructors must be prepared to perform on-the-fly system configurations and restoral following improper or proper student actions.

BLOCK

I

UNIT

DATE

22 Sep 2016

BLOCK TITLE

Attacking and Exploiting Cyber Networks

3. Cyberspace Organizations & Concepts (TS/SCI)

3.5

a. Explain the roles & responsibilities of Cyberspace Organizations and their Areas of Responsibility (AORs). Task(s): 6.1, 6.2, 6.4 MEAS: W

(1.5)

b. Explain how Operations/Crew Resource Management, Intelligence Gain/Loss, Technical Gain/Loss, Measures of Effectiveness (MOEs), and Measures of Performance (MOPs) are used in adversary planning and execution to minimize risk and maximize benefit during a cyberspace operation. Task(s): 6.5, 7.6, 7.7, 7.11 MEAS: W

c. Explain the concepts associated with Special Access Programs (SAP) and how using the Integrated Joint Special Technical Operations (IJSTO) process benefits cyberspace operations.

Task(s): 6.6, 6.7 MEAS: W

BLOCK

I

UNIT

DATE

22 Sep 2016

WB E3OBR17D1 002A, Attacking and Exploiting Cyber Networks (TS/SCI)

Audiovisual Aids

Training Methods Lecture/Demonstration (1 hrs) Lecture/Discussion (2.5 hrs)

Instructional Guidance 3(a) Brief Warrior Ethos Daily.

Explain the organization, classified missions, role and responsibilities of the 24th AF to include the 67 Cyberspace Wing (CW) and the 688 CW. Discuss the role of the 624 OC as the Cyber Command and Control Mission System (C3MS). Explain the role of the 57 ATG and USAFWC in testing AF cyber security and exercising AF cyber operations units. Explain the organizations and roles of other DoD military service cyber forces. Discuss the roles of USSTRATCOM, USCC, and the Cyber Missions Forces (CMF) including their classified missions. Discuss other governmental involvement in cyberspace and how they might affect cyberspace planning. Discuss CNO deconfliction among agencies. Discuss the Memorandum of Agreement and where/how capabilities are produced.

APPLICATION: None.

EVALUATION: Measurement deferred to Block Test.

3(b) Introduce the planning process. Discuss the seven-step Joint Operational Planning Process (JOPP):

Initiation, Missions Analysis, Course of Action (COA) Development, COA Analysis and Wargaming, COA Comparison, COA Approval, and Plan/Order Development. Additionally, introduce the current operator plan and debrief process. Explain the importance of the collateral effects estimate (CEE) and its use in CO planning and mission approval, introduce the concept of approval authority against the CEE matrix. Discuss CO targeting processes and how targets are developed. Explain how targets are listed in the Joint Integrated Prioritized Target List and how targets are prioritized during the planning process. Discuss Intelligence Gain/Loss and Technical Gain/Loss and why they are factors in CO. Introduce Measures of Performance and Measures of Effectiveness and how they are used in CO planning to achieve desired effects in the battlespace. Introduce the concept of Crew Operations and Crew Resource Management. Discuss the various National Mission Team (NMT) and Cyber Mission Team (CMT) crew positions. Discuss the necessity of dual legal authorities and mission certifications in CO. Explain the standard flow of a 50/10/50 mission and a 10/10/50 mission.

APPLICATION: Complete unit review questions in the student workbook (WB).

EVALUATION: Measurement deferred to Block Test.

3(c) Explain Special Access Programs (SAPs), and how SAPs are not "silver bullets". Discuss the various

BLOCK

I

UNIT

DATE

22 Sep 2016 kinds of SAPs and differentiate waived and unwaived SAPs. Differentiate acknowledged and unacknowledged SAPs. Explain the use of digraphs and trigraphs in the SAP community and how they separate programs and systems. Discuss the security measures associated with SAPs. Finally, differentiate between operational and developmental SAPs.

Discuss the STO planning process. Explain how the STO community communicates as part of the IJSTO process.

APPLICATION: None.

EVALUATION: Measurement deferred to Block Test.

Discuss AF Core Values and why we should follow them throughout the course. Integrate Air Force doctrine throughout instruction. Reference Air Force doctrine at Curtis E. LeMay Center for Doctrine Development and Education website at https://doctrine.af.mil.

Integrate the Air Force doctrine, technical data system, and other publications applicable to an AFSC throughout the course.

Integrate job-oriented safety (See applicable Air Force Occupational Safety and Health (AFOSH) standards), environmental issues (including pollution prevention awareness), publications awareness (emphasize

BLOCK

I

UNIT

DATE

22 Sep 2016

BLOCK TITLE

Attacking and Exploiting Cyber Networks

4. Network Warfare Mission Planning, Briefing, Execution, and Debriefing (TS/SCI)

a. Explain the methods to attack and exploit wireless networks. Task(s): 10.1 MEAS: W

(3)

b. Working in groups of no more than 4, using provided instructional material and system diagrams, perform, and execute a mobile mission, and prepare and present a mobile mission debrief with no more than 3 instructor assists. Task(s): 10.2, 10.3, 10.4 MEAS: PC

(27)

c. Working in groups of no more than 4 and given scenarios, perform a mission planning brief, execution, and debrief for a network warfare (NW) operation with no more than 3 errors and 3 instructor assists. Task(s): 7.4, 7.5, 7.9, 7.10, 7.12, 7.13, 10.2, 10.3, 10.4 MEAS: PC/W

(20)

BLOCK

I

UNIT

DATE

22 Sep 2016

WB E3OBR17D1 002A, Attacking and Exploiting Cyber Networks (TS/SCI)

Audiovisual Aids

Wireless Access Point (16) Laptop Computer (4)

Training Methods Demonstration/Performance (47 hrs) Lecture/Discussion (3 hrs)

Instructional Guidance 4(a) Brief Warrior Ethos Daily

Explain methodologies to attack and exploit mobile networks up to the TS/SCI level.

APPLICATION: None EVALUATION: Measurement deferred to Block Test.

4(b) Break students into teams of no more than four. Explain basic attack techniques and mission planning processes. Allow students to practice planning and executing a wireless mobile mission utilizing equipment in the wireless laboratory. Students will use the information to construct a mobile mission debrief on JWICS using PowerPoint.

APPLICATION: Exercise to practice planning and executing a wireless mobile mission.

EVALUATION: Administer Progress Check II-3b. Record results on AETC Form 98 and re-administer PC for unsatisfactory performance.

4(c) Break students into teams of no more than four. Provide students with fictitious scenario in which they will plan an OCO mission for.. Students will perform abbreviated mission planning, an operational analysis, and present their COAs during an approval briefing to the instructor.. Following approval, students will execute their approved COA within the simulation range. Teams will provide an informal, abbreviated debrief/after action report based on the master station log (MSL) they maintained during execution.

APPLICATION: Exercise to present a mission planning brief/debrief.

EVALUATION: Administer Progress Check II-3c. Record results on AETC Form 98 and re-administer PC for unsatisfactory performance.

Discuss AF Core Values and why we should follow them throughout the course. Integrate Air Force doctrine throughout instruction. Reference Air Force doctrine at Curtis E. LeMay Center for Doctrine Development and Education website at https://doctrine.af.mil.

Integrate the Air Force technical data system and other publications applicable to an AFSC throughout the

BLOCK

I

UNIT

DATE

22 Sep 2016

Integrate job-oriented safety (See applicable Air Force Occupational Safety and Health (AFOSH) standards), environmental issues (including pollution prevention awareness), publications awareness (emphasize compliance with instructions is mandatory), Risk Management, Energy Conservation (weave principles throughout the core curriculum), where appropriate throughout the course.

Multiple Instructor Requirements Geographical Separation (2) (47 hrs)

Two instructors are required for objective 4b (27 hours) to evaluate 4 groups of 4 students in the standard classrooms (rooms 115, 116, 117, 118, 127, 135). One instructor, working in the server room (room 109B), will provide interactive network scenarios that the students must react to and take action against as part of their progress check, while the classroom instructor reviews/approves group responses. Failure to provide constant supervision could result in a student erroneously corrupting a production network which would stop training until the network could be rebuilt. The remote instructor monitors the LABNet equipment due to the high incidence of irrecoverable system failure that can result from incorrect configuration settings if groups fail to complete the step-by-step instructions as directed. Instructors must be prepared to perform on-the-fly system configurations and restoral following improper or proper student actions.

Two instructors are required for objective 4c (20 hours) to evaluate up to 4 groups of 4 students in the standard classrooms. One instructor will provide interactive network scenarios that the students must react to and take action against as part of their progress check, while the classroom instructor reviews/approves group responses.

Failure to provide constant supervision could result in a student erroneously corrupting a production network which would stop training until the network could be rebuilt. The other instructor monitors the equipment due to the high incidence of irrecoverable system failure that can result from incorrect configuration settings if groups fail to complete the step-by-step instructions as directed. Instructors must be prepared to perform on-the-fly

BLOCK

I

UNIT

DATE

22 Sep 2016

BLOCK TITLE

Attacking and Exploiting Cyber Networks

5. Written Measurement and Feedback (S)

1.5

Written Measurement and Feedback (1.5)

BLOCK

I

UNIT

DATE

22 Sep 2016

Instructional Guidance Refer to Instruction to the Examiner located within the test kits. Administer written measurement and critique.

NOTE: Any student not making a minimum passing score on the test must be referred to the IS.

Record grades on AETC Form 325 or on the Student Report Card in TTMS in accordance with AETCI 36-2642, Technical and Basic Military Training Administration. Record test results on AETC Form 668, Test Data or in a computer-generated test analysis system for test analysis. Identify high-miss test questions. Destroy the answer sheets upon completion of the test unless the course is in validation. For courses in validation, all measurement material will be saved and submitted with the validation package to TDE using appropriate safeguards.

Test Type Written Tests (1.5 hrs)

Security Type: SECRET

BLOCK

II

UNIT

DATE

22 Sep 2016

BLOCK TITLE

Defensive Cyberspace Operations (DCO) and Department of Defense Information Network (DODIN)

COURSE CONTENT TIME

1. Defensive Cyberspace Operations (DCO) and Department of Defense Information Network

(DODIN) (S)

87.5

a. Explain the general principles and concepts about Defense-in-Depth (DiD). Task(s): 8.1

MEAS: W

(6)

b. Explain the relationships between network management functions, the units that perform management functions, and the unit’s areas of responsibility. Task(s): 8.2 MEAS: W

c. Working in groups of no more than 4, using instructional materials, generate a network tasking to produce full spectrum cyberspace effects with at least 70% accuracy. Task(s): 8.4, 22.2, 22.4 MEAS: PC/W

d. Explain the core network services and architecture utilized in Department of Defense Information Networks (DoDIN). Task(s): 8.3 MEAS: W

(5.5)

e. Using designated training equipment and instructional materials, perform duties related to the management and defense of the Department of Defense Information Networks (DoDIN) and present a mission debrief with at least 70% accuracy. Task(s): 5.2, 8.5, 8.6, 8.7, 8.8, 8.9, 22.5,

22.6 MEAS: PC/W

(64)

BLOCK

II

UNIT

DATE

22 Sep 2016

AFTTP 3-1.CWO (S)

AFTTP 3-1.ACD (S)

Workbook (WB) E3OBR17D1 002A, Enterprise Operations (U)

Slide Presentation – Enterprise Network Operations (Optional) (U)

Training Equipment Student Interface Suite (1)

Training Methods Demonstration/Performance (70 hrs) Lecture/Discussion (17.5 hrs)

Instructional Guidance 1(a) Brief Warrior Ethos Daily.

Discuss the general concepts of Defense-in-Depth (DiD) as they pertain to the elements that are composed within DiD. Explain how the risk "equation" is fundamental to determining the defensive posture of a network, relating the concepts of risk, threats, and vulnerabilities and how they affect one another. Relate the concepts of risk, threats and vulnerabilities to the approaches to DiD used in practice and provide specific examples from the text as well as any real-world experiences.

APPLICATION: Have students read DiD case study, discuss the company’s use of DiD vectors and risk.

1(b) Explain the network management functions including change, configuration, problem, release, and incident management and the AF units that perform each function. Also discuss the terrain areas of responsibility for each unit.

APPLICATION: None

1(c) Break students into teams of no more than four. Discuss the command and control structure of the DoDIN. Explain the organizational layout of the enterprise network along with a flow chart of the reporting chain. Explain and describe the Cyberspace Tasking Cycle and how various orders that apply to the day-to-day operations are generated.

APPLICATION: Brief Operation Cobalt Castle and have students choose force packages for tasks on slide.

EVALUATION: Administer Progress Check III-1c. Record results on AETC Form 98 and re-administer PC for unsatisfactory performance. Measurement deferred to Block Test.

BLOCK

II

UNIT

DATE

22 Sep 2016

1(d) Discuss in detail the DoDIN architecture and standard core services employed on the DoDIN and transport network to provide messaging (SMTP/IMAP mail architecture, Defense Messaging System/Automated Message Handling System), and directory services (Active Directory/LDAP, Global Address List) on an enterprise level.

Also discuss the Joint Information Environment (JIE) Enterprise services including; Defense Enterprise E-mail, Defense Enterprise Portal Services, Unified Capabilities, Enterprise Cloud Broker, Cloud Computing Services, Enterprise Directory Service/Identity & Access Management, and Defense Enterprise Mobility.

APPLICATION: None EVALUATION: Measurement deferred to Block Test

1(e) Discuss remote administration tools to include, but not limited to Microsoft PowerShell scripting engine, Microsoft Management Console, various MMC snap-ins (Active Directory, Event Viewer, Group Policy Management, etc.), Exchange Management Console, and the PuTTY command line interface client. Explain and demonstrate how to detect and identify external and internal network attacks using tools including, but not limited to, IDS alerts, TCP-Dump, HBSS, firewall audit logs, Event Viewer and DNS logs. Explain and demonstrate how to defend against current and future attacks, after being detected, using router access control lists, firewall rules, proxy rules and policies, Microsoft Management Console, Exchange Management Console, mail relay policies, and layer 2 access drops (MAC address drops) using network defense TTPs as described in the AFTTP 3-1.CWO and ACD.

Explain the network operations and defense scenario. Brief the students a fictitious change-over STEP briefing to include a fictitious threat to the network entailing the level of detail expected from their briefing. Provide each student a scenario based upon the threat briefed prior to the scenario. Receive an change-over operations debriefing from each individual student based upon the scenario given to each student.

Separate students into 2 groups of 8. One instructor is required for each group to meet the demands of the objective and the attention required from the instructor to each individual student. Students are evaluated individually due to the vital/critical training standards required in the objective by the career field. This requirement drives the demand for an additional MIR instructor.

APPLICATION: Complete unit review questions in the workbook (WB). Perform simulated network attacks against student ranges.

EVALUATION: Administer Progress Check III-1e. Record results on AETC Form 98 and re-administer PC for unsatisfactory performance. Measurement deferred to Block Test.

Discuss AF Core Values and why we should follow them throughout the course. Integrate Air Force doctrine throughout instruction. Reference Air Force doctrine at Curtis E. LeMay Center for Doctrine Development and Education website at https://doctrine.af.mil.

Integrate the Air Force technical data system and other publications applicable to an AFSC throughout the course.

Integrate job-oriented safety (See applicable Air Force Occupational Safety and Health (AFOSH) standards), environmental issues (including pollution prevention awareness), publications awareness (emphasize https://doctrine.af.mil/

BLOCK

II

UNIT

DATE

22 Sep 2016

Multiple Instructor Requirements Geographical Separation (3) (64 hrs)

Three instructors are required for objective 1e (64 hours) to evaluate 2 groups of 8 students. One instructor, working in the server room (room 109B), will provide interactive network scenarios that the students must react to and take action against as part of their progress check. Each classroom instructor will be responsible for opposite sides of the classroom and will manage half the workstations in the classroom. Failure to provide constant supervision could result in a student erroneously corrupting a production network which would stop training until the network could be rebuilt. The remote instructor monitors the LABNet equipment due to the high incidence of irrecoverable system failure that can result from incorrect configuration settings if groups fail to complete the step-by-step instructions as directed. Instructors must be prepared to perform on-the-fly system configurations and restoral following improper or proper student actions.

BLOCK

II

UNIT

DATE

22 Sep 2016

BLOCK TITLE

Defensive Cyberspace Operations (DCO) and Department of Defense Information Network (DODIN)

2. Cyber Network Threats and Defense (TS/SCI)

a. Explain how the DoD and Intelligence Community (IC) characterize cyber threats/adversaries and current defensive strategies employed to counter those threats/adversaries. Task(s): 22.1,

22.3 MEAS: W

(26)

BLOCK

II

UNIT

DATE

22 Sep 2016

Lecture/Discussion (26 hrs)

Instructional Guidance 2(a) Brief Warrior Ethos Daily.

Discuss the classified net defense capabilities and limitations of the Department of Defense and USAF. Focus on current network architecture, tools, training,and planned future capabilities. Explain the different apertures of each tier in the GIG. Discuss the role of USG agencies and the Defense Industrial Base. Explain how network defenders organize threats against the GIG and why it is important to know your adversary. Discuss hacker personas and motivations. If available, provide / present a current net defense threat brief from 70th ISR Cyber Analysis Squadron or the 33d Network Warfare Squadron. Explain intrusion response procedures, including best practices and Law Enforcement considerations. Explain what tools are available to cyber defense operators, including their capabilities and limitations. Provide examples of First Responders Evidence Disk (FRED) results, how to use FRED, how to interpret the results of FRED and the role of FRED in incident response.

Discuss the concept of a comprehensive approach to network defense, and the delicate balance of the intel gain/loss equation.

Optional: If possible, join the SDO brief on DCO. Also, if possible, join the JTF-GNO / USCYBERCOM ops intelligence round-up brief through VTC.

APPLICATION: Complete unit review questions in the workbook (WB).

BLOCK

II

UNIT

DATE

22 Sep 2016

BLOCK TITLE

Defensive Cyberspace Operations (DCO) and Department of Defense Information Network (DODIN)

3. Written Measurement and Feedback (S)

BLOCK

II

UNIT

DATE

22 Sep 2016

Refer to Instruction to the Examiner located within the test kits. Administer written measurement and critique.

NOTE: Any student not making a minimum passing score on the test must be referred to the IS.

Record grades on AETC Form 325 or on the Student Report Card in TTMS in accordance with AETCI 36-2642, Technical and Basic Military Training Administration. Record test results on AETC Form 668, Test Data or in a computer-generated test analysis system for test analysis. Identify high-miss test questions. Destroy the answer sheets upon completion of the test unless the course is in validation. For courses in validation, all measurement material will be saved and submitted with the validation package to TDE using appropriate safeguards.

Test Type Written Tests (1.5 hrs)

Security Type: SECRET

BLOCK

III

UNIT

DATE

22 Sep 2016

BLOCK TITLE

Industrial Control Systems

1. Industrial Control Networks (TS/SCI)

32.5

a. Working in groups of no more than 4 and given an Industrial Control System (ICS) architecture, design a complete system taking into account the components, configurations, security and defense in depth needed at the logical and physical layers in accordance with the provided checklist. Task(s): 14.1, 14.2, 14.4 MEAS: PC/W

(22)

b. Explain methods to attack and exploit ICS networks. Task(s): 14.3 MEAS: W

c. Working in groups of no more than 4, using provided instructional material, designated equipment, and system diagrams, perform planning and execute an ICS mission in accordance with the provided checklist. Task(s): 14.5, 14.6, 14.7 MEAS: PC

(8.5)

BLOCK

III

UNIT

DATE

22 Sep 2016

Student Text (ST) E3OBR17D1 002A, Industrial Control Systems (U)

Audiovisual Aids Warrior Ethos Vignettes Slide Presentation – Industrial Control Systems (Optional) (U) 60 Minutes DVD - Sabotaging the System (Optional) (U) Facility Tour Video (Optional) (U)

Electrical Distribution Simulator (1) Water Distribution Simulator (1) Student Interface Suite (1)

Training Methods Demonstration/Performance (30.5 hrs) Lecture/Discussion (2 hrs)

Instructional Guidance 1(a) Brief Warrior Ethos daily.

Explain the big-picture concept of control systems, including their everyday use, applications and their importance. Convey the importance of these systems and how the U.S. government is putting emphasis on these systems. Describe the various types of control systems and how they are differ from typical IT systems. Explain the technical components that can make up various industrial control systems and help the students to be able to distinguish between the functions and components of industrial control systems. Explain the considerations to take into account when deciding which solution to choose as it applies to topologies, mediums and protocols associated with the ICS architecture and the types available. Discuss ICS type protocols and what makes them unique in comparison to IT protocols. Discuss how ICSs apply to the Air Force, how these systems are categorized, and how we get these systems are certified and accredited. Explain how we can use Ladder Logic to program PLCs.

Break students into teams of no more than four.

FIELD TRIP (Optional): The field trip is used to help show the students a real live ICS and the applicable components. The trip is normally to the CE compound across base or to a destination downtown of your choosing based on their ability to support the visit. Examples of potential visits are Mississippi Power, Keesler CE facilities, Bank Infrastructure Facility, and/or Water Treatment Facility, etc. If time or resources does not permit for a field trip, the instructor will discuss their observations from previous field trips as an alternative method to reinforce concepts taught in class.

APPLICATION: None EVALUATION: Administer Progress Check V-1a. Record results on AETC Form 98 and the SharePoint site for the mentors. Re-administer the PC for unsatisfactory performance. Knowledge measurement deferred to

BLOCK

III

UNIT

DATE

22 Sep 2016

Block Test.

1(b) Discuss the obstacles associated with gaining access to a control LAN on a ICS, common methods used to access these systems and methods used to discover and control the process. Explain how we classify this type of attacks and review a couple of examples of ICS attacks. Discuss how vulnerability assessments can have an adverse effect on ICSs. Review the possible support options available from ICS-Cert. Discuss how defense-in-depth applies to ICS. Lastly, review at a minimum, the Stuxnet case study.

APPLICATION: None.

EVALUATION: Measurement deferred to Block Test.

1(c) Explain planning and the execution of an ICS mission. Demonstrate and perform/execute an ICS mission.

Discuss the various options specific to ICS and how/where they might be vulnerable to attack. Incorporate lessons learned in a mission debrief. Students should be combining knowledge and skills learned in previous objectives to plan and carry out a mission specific to ICS.

Break students into teams of no more than four.

APPLICATION: None.

EVALUATION: Administer Progress Check V-1c. Record results on AETC Form 98 and the SharePoint site for the mentors. Re-administer the PC for unsatisfactory performance. Knowledge measurement deferred to Block Test.

Discuss AF Core Values and why we should follow them throughout the course. Integrate Air Force doctrine throughout instruction. Reference Air Force doctrine at Curtis E. LeMay Center for Doctrine Development and Education website at https://doctrine.af.mil.

Integrate the Air Force technical data system and other publications applicable to an AFSC throughout the course.

Integrate job-oriented safety (See applicable Air Force Occupational Safety and Health (AFOSH) standards), environmental issues (including pollution prevention awareness), publications awareness (emphasize compliance with instructions is mandatory), Risk Management, Energy Conservation (weave principles throughout the core curriculum), where appropriate throughout the course.

Multiple Instructor Requirements Geographical Separation (2) (30.5 hrs)

MIR

1a (22 hours) Two instructors to evaluate up to 4 groups of 4 students in the standard classrooms. One instructor will provide interactive network scenarios that the students must react to and take action against as part of their progress check, while the classroom instructor reviews/approves group responses. Failure to provide constant supervision could result in a student erroneously corrupting a production network which would stop training until the network could be rebuilt. The other instructor monitors the equipment due to the high incidence of irrecoverable system failure that can result from incorrect configuration settings if groups fail to complete the step-by-step instructions as directed. Instructors must be prepared to perform on-the-fly system configurations and restoral following improper or proper student actions.

1(c) (8.5 hours) Two instructors to evaluate up to 4 groups of 4 students in the standard classrooms. One

BLOCK

III

UNIT

DATE

22 Sep 2016 instructor will provide interactive network scenarios that the students must react to and take action against as part of their progress check, while the classroom instructor reviews/approves group responses. Failure to provide constant supervision could result in a student erroneously corrupting a production network which would stop training until the network could be rebuilt. The other instructor monitors the equipment due to the high incidence of irrecoverable system failure that can result from incorrect configuration settings if groups fail to complete the step-by-step instructions as directed. Instructors must be prepared to perform on-the-fly system configurations and restoral following improper or proper student actions.

BLOCK

III

UNIT

DATE

22 Sep 2016

BLOCK TITLE

Industrial Control Systems

2. Written Measurement and Feedback (U)

BLOCK

III

UNIT

DATE

22 Sep 2016

Refer to Instruction to the Examiner located within the test kits. Administer written measurement.

NOTE: Any student not making a minimum passing score on the test must be referred to the IS.

Record grades on AETC Form 325 or on the Student Report Card in TTMS in accordance with AETCI 36-2642, Technical and Basic Military Training Administration. Record test results on AETC Form 668, Test Data or in a computer-generated test analysis system for test analysis. Identify high-miss test questions. Destroy the answer sheets upon completion of the test unless the course is in validation. For courses in validation, all measurement material will be saved and submitted with the validation package to TDE.

Test Type TTMS Automated Test (1.5 hrs)

Security Type: UNCLASS

BLOCK

IV

UNIT

DATE

22 Sep 2016

BLOCK TITLE

Telephony Networking

1. Telephony Networks (TS/SCI)

a. Explain the design and architecture of telephony networks including the role of specific components and configurations. Task(s): 9.1 MEAS: W

(3.5)

b. Explain attack, exploit, and defensive strategies on telephony networks. Task(s): 9.3 MEAS:

W

c. Working in groups of no more than 4 and given access to a working Voice Over Internet Protocol (VoIP)/analog telephony network, and training materials, configure, harden and defend a telephony network from attack or exploitation with no more than 3 instructor assists. Task(s):

9.2, 9.4 MEAS: PC/W

(22)

d. Working in groups of no more than 4, using provided instructional material and system diagrams, perform planning and execute a telephony mission with no more than 3 instructor assists. Task(s): 9.5, 9.6, 9.7 MEAS: PC

(8.5)

BLOCK

IV

UNIT

DATE

22 Sep 2016

ST E3OBR17D1 002A - Telephony Networking

Audiovisual Aids Warrior Ethos Vignettes Slide Presentation – Telephony Networking (Optional) (U)DSN Video (Optional) (U)NSA DVD – You Brought The Bug (Optional) (TS)

Training Equipment Laptop Computer (4) Student Interface Suite (1) Telephony Equipment Suite (16)

Training Methods Demonstration/Performance (30.5 hrs) Lecture/Discussion (4.5 hrs)

Instructional Guidance 1(a) Brief Warrior Ethos Daily.

Read "Standard Operating Procedure (SOP) - Telephony Networking", dated 13 Aug 2010, which is maintained by the SSO.