Whither Air Force Cyber?

I was disappointed to read in Air Force senior leaders take up key decisions that Air Force Cyber Command is effectively dead:

Leadership also decided to establish a Numbered Air Force for cyber operations within Air Force Space Command and discussed how the Air Force will continue to develop capabilities in this new domain and train personnel to execute this new mission.

Apparently that unit will be 24th Air Force. Since the Numbered Air Force is the unit by which the service presents combat forces to Unified Combatant Commanders in wartime, it makes some sense for cyber to at least be organized in that manner.

I guess the Air Force believes it needs to get its house in order before trying to establish a new command. The Air Force is also suffering the adverse effects of the way it advertised itself, essentially stealing the spotlight by not appearing "Joint" enough.

I am most concerned with the effect of not having Cyber Command upon the proposed cyber career field. From what my sources had told me, it was turning into a rebranded communications AFSC. The biggest problem the Air Force faces in cyber is not retaining skilled personnel. It suffers because there is no career path for cyber warriors. If that problem is not fixed, none of the reorganization efforts will matter anyway.

Comments

CG said…
I dont think any of the services have figured out how to properly identify people with "cyber" skill sets or how to keep them in the right jobs once they are trained or identified.

Its unfortunate that outdated thinking and ways of doing business are forcing the talented people to get out to do what they are good at.
10:44 PM
Anonymous said…
Told ya.. The guys with 50" zippers need love too.
12:05 AM
Anonymous said…
I guess no one has ever heard of Information Operations (IO) or Land Information Warfare (LIWA), both of which predate anything that the Air Force has recently publicized. Retention of soldiers with this skill set is definitely an issue. It is tough for a soldier to know that his civilian counterpart who sits literally across the aisle makes 4 times his salary. When this civilian counterpart actively recruits the skilled soldiers he encounters for his company only the truly dedicated and patriotic remain soldiers.
12:00 PM
Richard Bejtlich said…
Joe, the AFCERT was created in 1992 and the AF Information Warfare Center followed in 1993.
1:36 PM
Anonymous said…
From The U.S. Navy CIO Blog

Everyone Is a Cyber Warrior Published, October 2, 2008

http://www.doncio.navy.mil/Blog.aspx?ID=780&ShowComments=true

Look for the Navy to soon drop the word "Defense" from Navy Cyber Defense Operations Command
2:22 PM
Anonymous said…
i agree with richard
3:44 AM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technical or pol
Read more