Defensive CYBER Tool Development

Mission — CYBER Situational Understanding source

Cyber SU is a software-only, mission command application designed for use by maneuver commanders at the tactical level (Infantry, Armor, Stryker Brigade Combat Teams, Division, Corps, and Army Service Component Commands). Cyber SU is the first application of its kind designed for maneuver commanders focusing on tactical/ expeditionary combat operations to detect and mitigate cyber and electronic warfare threats and assist with decision making during combat operations. Cyber SU produces a Cyber Electromagnetic Activity overlay on the commander's Common Operational Picture within the Command Post Computing Environment / Tactical Services Infrastructure. Unlike Enterprise Cyber Mission Force(s) Tools, Cyber SU was designed using the CPCE Software Development Kit; to operate within the constraints of Tactical Services Infrastructure hardware, a bandwidth constrained tactical environment and support Common Operating Environment standards in the Army's Command Post. The underlying Cyber SU framework is also being leveraged by the US Air Force to ensure alignment with the Combined Joint All Domain Command and Control. The Army will ensure Cyber SU has an open systems architecture and will continue to explore options to integrate Cyber SU functionality and data ingests between other Services as well as explore insertion of third-party technology within the Cyber SU solution. Cyber SU provides the maneuver commander the ability to visualize and understand any cyber related impacts/threats to physical (geographical), logical (at a specific network internet protocol), and cyber persona layers (bad actors, from individuals to nation states) of tactical cyberspace data. Supporting Cyber Electromagnetic Activity, Cyber SU ingests existing data sources from related programs (e.g., Tactical Defense Cyber Operations Infrastructure, Command Post Computing Environment, Electronic Warfare Planning and Management Tool, Unified Network Operations, Distributed Common Ground System-Army, Data Distribution System), synchronizes and integrates blue (friendly), red (enemy), and grey (commercial/private sector) data and enables collaboration therein at the tactical edge. Cyber SU addressed the principal capability areas from its first Information Technology Box (FY2020 - FY2024), including See Yourself (Initial Capability), See Your Cyber Battlespace, and Understand Your Cyber Battlespace. Cyber SU Information Technology Box requirements will not be renewed. To better meet Army needs, Cyber Electromagnetic Activity requirements captured in the Cyber SU System-Initial Capabilities Document are being subsumed into requirements documents for Informational Dimension, Electronic Warfare Planning & Management Tool. Next, the Unified Network Operations, Lower Tactical Tier, and Upper Tactical Tier requirements. Funding for the Cyber SU program is not required in FY2025 and beyond due to this change in how the Army is addressing these operational requirements and desired capabilities. Army approved program termination 11 June 2024.

Mission — Defensive CYBER Tool Development source

- Cyber Situational Understanding (Cyber SU): No funding requested in FY 2025 and beyond due to program divestment. Army approved program termination 11 June 2024. - Tactical DCO-I (TDI) is a software only program that consists of pre-configured DCO applications that enable local and remote Cyber defenders to conduct cyberspace surveillance, and maneuver against an adversary traversing within the tactical network. The TDI capability is hosted on the Army's Tactical Network and will reside within the Command Post at the tactical level (up to Army Service Component Commands). - FY 2026 funding in the amount of $3.611 million will support the completion of development engineering and integration of CR 7, CR 8, and CR 9 and beyond including development engineering to collate and aggregate TDI data from various echelons; convergence with Tactical Data Fabric to align with Army Data Strategies, and implement Security Operations, Automated Response contractor and matrix support.

Mission — Tactical DCO-I source

TDI is a software only program that pre-configures DCO applications to allow local and remote Cyber defenders the ability to conduct cyberspace surveillance and maneuver against an adversary traversing within the tactical network. The TDI capability includes: 1) Mission Protection: Ability to automate deployment of DCO tools to protect the virtual server environment of the Command Post Computing Environment. 2) Discovery/Counter-Infiltration: Ability to auto detect multiple virtual cyber threats and facilitate the mitigation/denial of adversarial actions. 3) Cyberspace Support/Readiness: Allow global and regional cyberspace defenders to assist units with countering advanced persistent threats. TDI follows a five-year, Information Technology (IT) Box construct to deliver capability over time, based on approved requirements. In IT Box (FY 2023-2027), TDI will develop Capability Releases (CR) (CR 1 - CR 12) to implement TDI software change activities and updates to provide value to Brigades to ASCCs. CR 1 collated and aggregated TDI data from various echelons and presented it into rolled-up status dashboards reflecting various roles and responsibilities. CR 2 integrated Security Orchestration, Automation, and Response and with Big Data Platform to initiate alignment with the Army's tactical data fabric efforts. CR 3 and CR 4 leveraged Artificial Intelligence/Machine Learning models generated from BDP and implemented it at the tactical edge. CR 5 and CR 6 supported capabilities and technologies to address emerging cyber threats and techniques, tactics, and procedures. FY 2026 funding in the amount of $3.611 million will support the completion of development engineering and integration of CR 7, CR 8, and CR 9 and beyond including development engineering to collate and aggregate TDI data from various echelons; convergence with Tactical Data Fabric to align with Army Data Strategies, and implement Security Operations, Automated Response contractor and matrix support.

Accomplishments & Planned Programs (6)