I submitted two essays to USNI for the upcoming Information Dominance Edition. Below is the first essay, A Better Cyber Culture In Six Steps.
Ingraining
continuous professional development in our cyber warfare operators ensures
excellence in future operations. A
culture of professional development is easier to build in a controlled
environment, such as onboard a warship, where outside distractions are scarce. As most cyber jobs will be on shore duty,
there are many distracters that threaten to destroy the camaraderie and warfare
focus our other warfare disciplines enjoy.
A robust cyber culture promotes continual education, strengthens good
habits and builds expert operators.
Traditional
classroom education and training methods that work for other warfare areas fall
short in cyber. We know what we want
SWOs, Aviators and Submariners to do, but the rapidly changing nature of cyber
gives us only a murky vision of a good operator. Additionally, with a constant budget crisis
that routinely eliminates training dollars, we must have an inexpensive
distributed method of continual education.
I recommend the following methods:
1. Expanded distance education through masters
certificates from Naval Postgraduate School.
NPS has
created an outstanding system of masters-level certificates that require three
to four masters classes and are available completely via distance education. These certificates give a unique subspecialty
code for officers that complete the course of instruction. However, none of these subspecialty codes are
currently used for billets. Coding
desirable billets with these subspecialty codes rewards officers that take
initiative to attend this course of instruction. Expanding the number of certificate offerings
and requiring these classes for desirable billets will raise the overall level
of knowledge of our operators without significant additional expenditure.
2. A website with Rich Site Summary (RSS) feeds
of cyber related topics.
RSS readers make it easy to quickly sift through massive amount of information on a variety of subjects. Most of the cyber operators I know already subscribe to various feeds and follow websites such as Slashdot.org. There is no standard across the enterprise, and thus no enterprise-wide way of sharing the best sources of information. A summary of feeds on a CYBERCOM maintained website could easily fix this.
3. Expand local cyber and STEM community
outreach efforts.
Although
selection boards consider work performance for about 75% of the total grade
towards a promotion, community involvement is still a fair chunk of the overall
grade. Cryptologic Sailors are not often
interested in many of the traditional outreach events, but they routinely
attend STEM and cyber related community events that play to their strengths. Expanding these efforts near our cyber
centers of excellence gives cyber Sailors a better shot at overall promotion,
as well as foster focus on cyber both at work and after work.
4. Mandatory annual
attendance of an online significant cyber training event.
Linguist
Sailors must attend one month of training every year called a significant
language event. This is typically
conducted locally and serves to maintain the high language skill level required
for their job. Cyber operators require
the same level of effort to maintain their highly perishable skill set. Conducting these training events online on
JWICS or NSA-Net would permit a large number of attendees at very low cost.
5. Expanded mentorship opportunities between
military and civilian operators.
With the
high demand in the civilian sector (both government and non-government) for
cyber- related skills, there is often an adversarial relationship between
military and civilian organizations.
This does not foster excellence and does not recognize the reality that
all military members at some point hang up their uniform and work
elsewhere. Distance mentorship between
military and civilian operators can help alleviate this. A protected portal on both the classified and
unclassified networks can foster these mentoring relationships.
6. Classified blogging
It's
hard to talk in depth about cyber without getting into classified
information. Intelink on both JWICS and
SIPR has a built-in blog capability that is woefully underutilized. Cyber leadership should be regularly blogging
here to improve communication across the enterprise, as well as encouraging
younger leaders to blog their ideas.
A
culture of continual cyber development does not need to cost much, but it must
recognize that, unlike other warfare areas, our cyber operators are not stuck
on a warship where they are isolated from the world around them. They spend their workday defending our nation
and then go home to the distractions that we all face on shore duty. Deploying tools and methods to help them
continually develop their talents, both on the job and off, will go a long way
to ensuring our future cyber security.
