| Preface |
|
iii | |
|
|
|
vi | |
| Summary |
|
vii | |
| Acknowledgments |
|
xii | |
| Abbreviations |
|
xiii | |
|
|
|
1 | (4) |
|
|
|
1 | (1) |
|
|
|
2 | (1) |
|
|
|
2 | (1) |
|
|
|
3 | (2) |
|
2 Specifying the Objective, Strategy, and Tasks |
|
|
5 | (14) |
|
|
|
6 | (1) |
|
|
|
6 | (2) |
|
|
|
8 | (2) |
|
|
|
10 | (1) |
|
|
|
11 | (1) |
|
|
|
11 | (2) |
|
Tracing Up to the Objective |
|
|
13 | (1) |
|
Tracing Down to the Tasks |
|
|
13 | (2) |
|
|
|
15 | (4) |
|
3 Issues for Apportioning and Coordinating the Labor |
|
|
19 | (5) |
|
The Nature of Cybersecurity Activities |
|
|
19 | (1) |
|
Technical Aspects of Cybersecurity Activities |
|
|
20 | (1) |
|
Assessing the Risk of Adversary Cyber Operations |
|
|
21 | (1) |
|
|
|
21 | (1) |
|
Timelines of Risk Assessments |
|
|
22 | (1) |
|
Funding Cybersecurity Activities |
|
|
23 | (1) |
|
4 Discussion of Apportioning and Coordinating the Labor |
|
|
24 | (15) |
|
Strategic Guidance for Cybersecurity |
|
|
24 | (1) |
|
|
|
24 | (5) |
|
|
|
29 | (1) |
|
|
|
29 | (1) |
|
|
|
29 | (2) |
|
Recommendations for the Role of Authorizing Officials |
|
|
31 | (4) |
|
Provisioning Services and Performing Security |
|
|
35 | (2) |
|
Preparatory and Operational Cybersecurity Activities |
|
|
37 | (2) |
|
5 Improving the Cyber Culture |
|
|
39 | (10) |
|
|
|
40 | (1) |
|
A Sense That There Is Conflict in Cyberspace Between the United States and Others That Is Ubiquitous in Time and Space |
|
|
40 | (1) |
|
A Sense That Operations in Cyberspace Might Be Decisive in Warfare |
|
|
41 | (1) |
|
An Understanding That All Airmen, Civilians, and Contractors Play a Role in Cybersecurity |
|
|
42 | (1) |
|
A Realization That Nothing Can Be Completely Secure in Cyberspace |
|
|
42 | (1) |
|
A Sense of Responsibility to Carry on Their Mission(s) in the Face of an Attack Through Cyberspace |
|
|
42 | (1) |
|
A Sense That Connecting a System to Another (or a Network) Carries Potential Risks |
|
|
43 | (1) |
|
A Sense of Obligation to Report Anomalies in Data, Nonnominal Procedures, and Potential Cyber Incidents |
|
|
43 | (1) |
|
|
|
43 | (1) |
|
Persuade People That a Cultural Change Is Needed |
|
|
44 | (1) |
|
Ensure Support and Commitment of Senior Leadership and Commanders |
|
|
44 | (1) |
|
Present a Clear and Coherent Plan for Change |
|
|
45 | (1) |
|
Build Internal Support for Change and Overcome Any Resistance |
|
|
45 | (1) |
|
Provide Adequate Resources |
|
|
46 | (1) |
|
Get Support External to the Air Force |
|
|
47 | (1) |
|
Drive the Changes into the Daily Routines of Members |
|
|
47 | (1) |
|
Pursue Comprehensive Change |
|
|
47 | (2) |
|
6 Conclusions and Recommendations |
|
|
49 | (3) |
|
|
|
49 | (1) |
|
|
|
49 | (1) |
|
|
|
50 | (1) |
|
Cybersecurity Integrity Program |
|
|
50 | (1) |
|
|
|
50 | (2) |
| References |
|
52 | |
