UNCLASSIFIED DOD Organization for Computer Network Defense Summary of Proposals June 1998 UNCLASSIFIED UNCLASSIFIED Pu 059 Elli To provide a summary of the proposals for an interim organizational structure that can coordinate and direct the defense of DOD Computer Networks and Systems until superseded by a long - term solution UNCLASSIFIED Completedi Requested Actions - - DEPUPSDEPS Review brief to be presented to DPSDEPS DPSDEPS Gonceptuaiiy approve organizationai structure options Review brief to be presented to Unified Commands reconvene to review comments and recommend option for GNU structure - Unified Commands Provide comments recommendations on FTC presentations Bf - DEPUPSDEPS Approve recommended strategy tor tinai option development Rf - DJS Meeting Dptions reviewed narrowed to two tinaiists - UPSDEPS Discuss tinai option for recommendation to JCS - AGDM Jail-1 Provide comments and recommendations - Unified Commands Provide comments - JCS Tank Approve recommendation UNCLASSIFIED UNCLASSIFIED Evolutiono Oatians Solar Sunrlse JS IDFIC UCPBJEI Jams 31 Hun-9r Hn'u' il' Dana Fauna Apria Mayan Ml f Danna DEPCIFSDEPS DPSDEFS Hal-rim DFSDEFS DEPCIFSDEFS I 2 DISH 3 4 JS IDFID 5- J l t 1 Band 1 JGEWD Baal-cl Final Hmumnunch un UNCLASSIFIED LINE LASEIFIED Results ram 19 a DJ eefin l - Representatives from each of the proposed organizations participated - Consensus that this organization must plug into an umbrella organization which can if required be DOD focal point for coordination with National Infrastructure Protection Center - Must still retain operational focus - Narrowed to two options San Antonio-based JTF organized around chwc Washington-based JTF hybrid of previous proposals - Next step OPSDEPS tank session UNCLASSIFIED LINE LASEIFIED Proposed CN -J Mission - - Subject to the authority direction and control of the SECDEF this organization will be responsible for coordinating and directing the defense of DOD computer systems and computer networks This mission includes the coordination of DOD defensive actions with non - DOD government agencies and appropriate private organizations UNCLASSIFIED UNCLASSIFIED nizationof Functions 1' I Sat-301them h - Drganize plan and participate in joint training to conduct strategic CND - Monitor Intelligence Community I E reporting - Provide Intelli ence Community with for collection and I a requirements for potential attac against computers and networks - Monitor status of computer networks - Determine when systemfs are under attack assess operational impact and notify NCA and user community - Coordinate I direct appropriate actions to stop attack contain damage restore functionality and provide feedback to user community - Coordinate with Defense - wide Information Assurance Program and Critical Asset Assurance Program authorities to ensure compliance wider IA policy and initiatives - Coordinate as required with NBC NIPC law enforcement agencies other Interagency partners private sector and allies - Assess effectiveness of defensive actions and maintain current assessment of operational impact on - Subject to authority direction and control of SECDEF provide information to and receive direction from the CJCS and provide liaison as required to the CED staff and Joint Chiefs of Staff UNCLASSIFIED UNCLASSIFIED Recent Guidance -- I I I I II limit - Presidential Decision Directive 63 22 May 93 National Coordinator National Infrastructure Protection Center NIPC Department Implementation Plans wfin 180 days ODUSD lead UNCLASSIFIED UHELASSIFIED Homeland Defense I Li-Ell 1 - I i- a Err n11 if I ntrasgructure inn 1 a I Information 3 fee - Operations - Disturbance #5159 - UHBLAEEIFIED - - - i 1 UNCLASSIFIED Policy Issues - mm me first - NIPC re lntegretien - Active - Reserve 5 component UCP PROCESS STATUTORY -Tit es1o 13 32 - nt lAgreemente UNGLASSIFIED CDNSE UENCE MANAGEMENT COMMAND STRUCTURES - SEGAFIMY Exeeutive Agent - Ceunterdruge JIATFI - Heviee Peliey Deeuments - HTFs includes etc - Heviee Fer Meme Existing M he M us lnteregemeylr - NDHAD UNCLASSIFIED UNCLASSIFIED Operational Coordination I DePertment of Defense I GDDFIDIHATDFI CRITICAL Dpem onol ipc INFRASTRUCTUFI ES Coordination Nam-Tax I i use mqu I WA _an Lou_J I LEquLm AGEHT AFEEFIT - - UNCLASSIFIED UNCLASSIFIED CZWC Proposal All CONCEPT - Sen Antenie based JTF leveraging existing reletienships and personnel REQUIREMENTS - Persennel - 23 JGEWCI ED AFIWG billets - edditienel persennel requires reps frem DISA NAVGIHT E - start up 3 reeurring UNCLASSIFIED UNCLASSIFIED CZWC Proposal CONCEPT - San Antonio based JTF leveraging existing relationships and personnel REQUIREMENTS - Personnel - 23 JCEWC 1' ED AFIWC hillets - 9 additional personnel requires reps from DISA NAVCIFIT SI - start up I recurring PROS - Existing relationships with GINGs Basic 24 I 1ll'll'atch with AF support Gonnectivitv in-place now or programmed with Services and Agencies Available of ce I watch center space AFIWC Significant personnel commitment 21 AF 3' 23 Svnergv of JGEWG r' AIA I AFIWG co-location Quickest start-up immediate cadre available UNCLASSIFIED UNCLASSIFIED JC2WC Proposal -- I I I CONCEPT - San Antonio based JTF leveraging existing relationships and personnel REQUIREMENTS - Personnel 23 2D AFIWC billets - 9 additional personnel requires reps from DISA NAVCIHT BI start up recurring Existing JCEWC relationships with CINCs - Basis 24 It Watch with AF support - Connectivity in-place now or programmed with Services and Agencies - Available office I'watch center space Significant personnel commitment 20 AF 1' 23 - Synergy of JCEWC AIA AFIWC co location Quickest start- -up immediate cadre available - Washington DC detachment required for interagency coordination - JCEWC support for DSD ACTDs impacted need to transfer responsibility or bacldill JCEWC billets to maintain ACTD support capability - Minimal baseline operational capability some surge capability UNCLASSIFIED UNCLASSIFIED C2WC IOC Milestones Milestene 1 Date Jul 31 u_ I Deelalbn I I I 1 an Were-step Appreved Initial Funding Avail Spaces Available K7 5 Hardware Ganneeilvitv see naies Manpawer DEJTF DPS Admln see notes I A Implemenminn Plan Draft Fmp ed charter Draft Initial peratlanal titan-ability r 31 Julv 1993 defined as baseline correlation analysis reporting and monitoring I eaardinatlng incident respenae activities Initial eperatiens will be less than continuous 24 It 1 due in manpevrer skill levels and addltianal requirements assaelated with standvup at the JTF develaplng pallev deetrlne guidanee eu-erdlnatian with ether I'agenelea Early- aperatiens will leverage ail eurrent AFGEHT and activities emanated but virtual and phveleal representatlen at AGEFIT i DIEA netlnrerk status is required at 11312 Expanded capabilities available at fallavv-an intervals based an manpaviler availabllitv and skills space and hardware praeurement and funding UNCLASSIFIED NC LASSI Fl JTF Impact Current C2 WC Mission Current Mission Area Trade-Otis - Assessing ACTD ID Vulnerabilities 5 billets tasked by - Executing ACTD and other technologyr demonstrations 13 billets tasked in the current JC2WC charter - Impact of mission deletion - DSD will have to transfer analytical vulnerabilities responsibilities elsewhere - The Joint honest broker bridge between CINCS and the communityr will be severed tor ACTD and technologyr demonstration - May be abte to cover some of these impacts in ACOM transfer we shoutd be witting to back tt where required UNCLASSIFIED UNCLASSIFIED JC2 WC Proposal - - Deputy CJTF 1 ALA 20 Admin 1 TED PAD 2 Intelligence Plans Dep 1ll'llateh Cemmander 5 chief 1 Gaunter 0 3 BIG 1 Watch cg Gaunter DH 2 5 wig 5 Netwerk Res 2 UPS 3 UPS Intel 1 Netwerk 5 TOT 7 Plans 2 DISA IDTC 1 AFCEFIT Analyst JWAC 1 ADMIN 1 1D Law Enfereement 5 NOTE 43 at the 52 billets TDT 25 are currently at San USAF will seuree Antunia Centraeters depley tram an as required UNCLASSIFIED Washington-Based Proposal - - Washingten-based at previeus prepesals - Based within DISA taeilities but net part at DISA - capitalize on synergies et DISA ee leeatien - DISA preyides facility eenneetiyity synergy same persennel and suppert ferJTF RE UIREMENTS - 29 Persennel 4 from - Minimal start up reeurring UNCLASSIFIED UNCLASSIFIED Washington-Based Proposal - - Washington-based of previous proposals - Based within DISA facilities but not part of DISA Capitalize on synergies of DISA co-location DISA provides facility connectivity synergy some personnel and support fordTF REQUIREMENTS - 29 Personnel 4 from DISA - Minimal 53M start-up recurring PROS Hesident GHD capability ASSIST DIAMUND a D Basic 24 I Watch with DISA support Global network management infrastructure Established relationships with CINGs DOD and lnteragency activities Available office i watch center space Connectivity in - place now or programmed UNCLASSIFIED UNCLASSIFIED Washington-Based Proposal - COHCEPT cf previcus - Based within DISA facilities but part cf DISA Capitalize cn synergies cf DISA cc-lccaticn DISA prcvides facility ccnnectivity synergy scme and REQUIREMENTS - 29 4 Minimal start-up recurring PROS Flesident GHD capability ASSIST DIAMDHD Fl 3 - Basic 24 It Watch with DISA - Glcbal management infrastructure Established relaticnships with CIHCs DOD and lnteragency activities - Available cffice I'watch center space -Ccnnectivity in- place cr - Signi cant manpcwer requirement - Start-up time TED nc personnel identified Minimal baseline cperaticnal capability nc surge capability UNCLASSIFIED UNCLASSIFIED Full Ops Washington-Based Proposal - - Total Command Greug 4 DISA 4 Total Speelal Staff PAD 2 TDIEI 2g Delta EA LG I I I Admin 1' Log J1 14 5 Tetal J2 Tetal 13 11 Tetal 15 4 Tetal Cemptreller 4 1 Intel 5 1 Watch Dfiieers 3 Defensive ID 2 I Admin Staff Defensive ID Planners Legistieian UNCLASSIFIED UNCLASSIFIED 13% TF Resource Matrix 9 5 DC-based Personnel 52 33 Provided 43 4 Comms yes yes needed Facility no no needed AFIWC DISA Start-up Costs Recurring Costs UNCLASSIFIED UNCLASSIFIED Recommendation OPSDEPS endorse Option as best interim organization to direct Computer Network Defense for DOD UNCLASSIFIED UNCLASSIFIED Way -Ahead - Meet with ACOM to discuss JC2WC proposal - VTC with Unified Commands for comment - Present at JCS Tank for final approval UNCLASSIFIED This document is from the holdings of The National Security Archive Suite 701 Gelman Library The George Washington University 2130 H Street NW Washington D C 20037 Phone 202 994-7000 Fax 202 994-7005 nsarchiv@gwu edu