08086 MORS october_Lg_Prog.wmvACCESSING, BROWSING AND/OR USING THIS WIKI (THE "WIKI"), YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE, TO BE BOUND BY THESE TERMS AND TO COMPLY WITH ALL APPLICABLE LAWS AND REGULATIONS, INCLUDING EXPORT AND RE-EXPORT CONTROL LAWS AND REGULATIONS. ONLY UNCLASSIFIED CONTENT MAY BE POSTED. IF YOU DO NOT AGREE TO THESE TERMS, DO NOT USE THE WIKI. YOUR FAILURE TO COMPLY WITH THE TERMS, CONDITIONS, AND NOTICES ON THE WIKI WILL RESULT IN AUTOMATIC TERMINATION OF ANY RIGHTS GRANTED TO YOU, WITHOUT PRIOR NOTICE. Review entire 
Wiki Policy.doc.
DoD Employess should only post inputs in compliance with the criteria specified in DoD Instruction 5230.29, available at http://www.dtic.mil/whs/directives/corres/html/523029.htm.
Military Operations Research Society (MORS) www.mors.org
Cyber Analysis Workshop
Virtual Collaboration (unclassified on this wiki) and request secret wiki from Mark.Gallagher@pentagon.af.mil
Virtual Meetings using Defense Connect Online (as schedule and announced below--request an account to get announcements)
Physical Meeting 28-30 October 2008, Whitney, Bradley, & Brown (WBB) Consulting, Reston, Virginia.
Keynote Speaker: Dr. Ronald C. Jost
Deputy Assistant Secretary of Defense for C3, Space, and Spectrum
Plenary Speaker: Mr. G. Dennis Bartko
Special Asst. Dir. for Cyber at the NSA
Directions to Workshop at WBB Consulting, 11790 Sunrise Valley Drive, Reston, VA 20191, Telephone: 703-448-6081 from http://www.wbbinc.com/locations.html#reston: (Mapquest shortcut http://www.mapquest.com/maps/map.adp?formtype=address&country=US&popflag=0&latitude=&longitude=&name=&phone=&level=&addtohistory=&cat=&address=11790+Sunrise+Valley+Drive&city=reston&state=va&zipcode=
Driving:
- Take Interstate 66 West and follow the exit signs for Washington/Dulles Airport to 267 West Toll.
- Continue on 267 West to Reston Parkway, Exit 12.
- From there turn left on Reston Parkway.
- At the second light turn left again on Sunrise Valley Drive.
- WBB is 1/4 mile further on the left.
Public transportation:
Meeting Registration Fee for Entire Workshop:
US Federal Government MORS Member $575 and MORS Non-Member $640
Non-US Government MORS Member $675 and MORS Non-Member $750
Meeting Registration Fee for One-Day of Workshop:
MORS Member $325 and MORS Non-Member $375
Workshop Attire
We have no dress policy for this workshop. Most will wear "business casual," and a few will wear suits. Military may wear civilian clothes. If choosing military uniforms, in Air Force terms, "blues, BDU, or flight suits" are appropriate.
Hotel Reservations
The Sheraton Reston Hotel, 11810 Sunrise Valley Drive, Reston, VA 20191 at phone 703-620-9000 is just across the parking lot from WBB Consuling. They have reserved rooms at $233 plus tax (which I am told is the Government FY09 per diem rate) until 6 Oct. After 6 Oct, their rooms will cost $289.
Workshop Information
The workshop plan is at http://www.mors.org/ca/ca_tor.pdf, and a workshop flyer is 
MORS Cyber Analysis Workshop Flyer.pdf. Registration information is at http://www.mors.org/ca/cafront.htm. Limited students may have their registration fees waived--interested students contact Mark Gallagher at 703-588-6949 or Mark.Gallagher@pentagon.af.mil.
Invite senior government leader to participate in person or online in the workshop outbrief on Thursday, 30 Oct 08, at 1400-1600 EDT. This is our invitation letter: Workshop attendees will see and hear senior leader feedback on their recommendations for advancing cyber analysis.
Completed Virtual Meetings
Sessions conducted through Defense Connect Online (DCO). Here is a reference guide DefenseConnectOnline.pdf.
Unclassified Online Plenary Summary Session (using Defense Connect Online) 1400-1600 EDT on Tuesday, 21 Oct 08, https://connect.dco.dod.mil/cyberanalysis 
Online Plenary (21 Oct 08) v4.ppt with Dr. Henningsen's video 08086 MORS october_Lg_Prog.wmv (please download to play.) Recording from the 21 Oct Online Plenary Session: https://connect.dco.dod.mil/p43759644/?session=breezd6p554gsqx92mmi5&CFID=110239&CFTOKEN=33799064&jsessionid=CF740B99B01B8EC3606A7FCB586092ED
Unclassifed Online Session on Simulation Discipline Group, Time 1100 EDT on Thursday, 16 Oct 2008
Secret Online Session on CNA 1000-1100 EDT on Wednesday, 15 Oct 08
Information Operations Joint Munitions Effectiveness Manual (IO JMEM) CNA and CND Model Accrediation 1400-1600 EDT on 15 Sep 08 with 43 attendees. View a recording of this session here: https://connect.dco.dod.mil/p47356961/?session=breezt84t679pfqsqbuiw&CFID=33804&CFTOKEN=38692880&jsessionid=53B7BA8108EBE82C7198DB2A22156CA8
Online Plenary Kick-Off Session using DCO 1400-1530 EDT on Tuesday, 26 Aug 08 with 51 attendess. Briefing Online Plenary (26 Aug 08) v4.ppt.
The link for the DCO recording is https://connect.dco.dod.mil/p68475418/?session=breezgab8zd9un4km2tvq&CFID=33804&CFTOKEN=38692880&jsessionid=10F893E3BB4CA77C1811BD1912E3C7BE
Secret Online Session on Cyber JMEM analytical tools (C-REA and NRAT) , 1400-1600 EDT on Monday, 29 Sep 08
CNA Risk and Evaluation Assessment (C-REA) and Network Risk Assessment Tool (NRAT) descriptions
Secret Online Session on CNA 1000-1100 EDT on Wednesday, 1 Oct 08
Secret Online Session on Cyber Modeling and Simulation Requirements (1st Review), Time 1400-1600 EDT on Wednesday, 1 Oct 08
Secret Online Session on Cyber Modeling and Simulation Requirements (2nd Review), Time 1400-1600 EDT on Tuesday, 7 Oct 08
Unclassifed Online Session on Cyber C2 and Situational Awareness, Time 1000-1100 EDT on Wednesday, 8 Oct 2008
26 Aug Plenary Session Poll results (percent and number of respondents)
1) Do you expect to input comments on the wikis? 83% yes
2) Which track do you plan on participating in? Physical meeting Online
Cyber Environment and Fourth Generation Warfare (4GW) 13% 3 48% 14
Cyber C2 and Situational Awareness 13% 3 38% 11
Cyber Vulnerabilities, Protection, and Defense 17% 4 34% 10
Cyber Deterrence 8% 2 34% 10
Cyber Exploitation and Offense 33% 8 34% 10
Humans in Cyber Networks 13% 3 38% 11
Cyber Impacts on Business Processes 4% 1 28% 8
3) Which discipline groups do plan on participating in? Physical Meeting Online
Optimization (Unclassified) 4% 1 27% 8
Decision Analysis (Unclassified) 8% 2 57% 17
Simulation (Unclassified) 17% 4 70% 21
Computer Science (Unclassified) 8% 2 17% 5
Social Sciences (Unclassified) 12% 3 27% 8
Optimization (Secret) 9% 2 17% 5
Decision Analysis (Secret) 26% 6 30% 9
Simulation (Secret) 3% 1 30% 9
Computer Science (Secret) 9% 2 17% 5
4) Are these online session worthwhile? 34% Very Worthwhile, 62% Somewhat, and 4% Little Value
26 Aug Plenary Session Minutes
Welcome!
1. IO JMEM session on 15 Sept, 1400-1600 EDT
2. This will be a mixed classification workshop
3. Encouraging use of wikis and participation in online meetings (both unclassified and secret)
4. Follow-on sessions on wikis and DCO on SIPR and NIPR to discuss content
5. Physical meeting provides opportunity for analyst-senior leader interaction
6. Wikis are first draft of workshop report
7. The briefing slides will be posted online after this session (on wiki above)
8. Cyber M&S workshop: identified need for common cyber lexicon; must also consider STO; need to establish Community of Practice; must develop & build cyber-oriented models
9. Cyber M&S workshop materials will be posted on wiki
10. Tracks identify topics and challenges; discipline groups identify and discuss possible solutions
11. Will work hard to provide feedback mechanism between tracks & discipline groups
12. Final DCO session will include senior leader participation
13. There will be both classified and unclass sessions
14. C2 track starting with "Power to the Edge" book
15. Link on wiki site to IO JMEM applications
16. Two months in advance, we already have currently a total of 15 registrants for the workshop
17. May address social engineering in the humans track
18. DOD policy may have major impact on info sharing in collaborative communities (wikis, online meetings, etc.); will be examined by business processes track
19. Discipline groups should look across all tracks & propose unique approaches to analytic challenges in cyber
20. Each track should have at least one DCO session in September
21. Anyone can add content to wiki (with account)
22. Workshop planning uses a publish-subscribe approach rather than email. Questions: e-mail Mark.Gallagher@pentagon.af.mil
Physical Meeting Schedule
Our physical meeting will be 28-30 Oct at WBB Consulting in Reston, Virginia. Some have asked, "why attend the physical meeting after the virtual collaboration?" First, we will not nearly finish the discussion virtually, particularly with the DoD policy limitations preventing DoD employees from making substantive posting.
Second, the interaction between the track discussions and the discipline groups will be most interesting at the physical meeting.
Third and most important, the physical meeting concludes on Thursday afternoon with an online session of senior government leaders reviewing the recommendations--all attendees will see and hear this senior leader response to our recommendations and proposals! Registration at www.mors.org.
Themes/Tracks for virtual discussions, virtual meeting, and physical meeting:
The tracks will address issues in their areas. Some tracks will remain unclassified and others will have a secret portion.
Cyber Environment (unclassified track)
Cyber Situational Awareness and C2 (unclassified track)
Cyber Vulnerabilities, Protection, and Defense (secret track)
Cyber Deterrence (unclassified track)
Cyber Exploitation and Computer Network Attack (CNA) (secret track) (unclassified track)
DoD Web-Policy Impacts on Cyber Ops
Discipline Group Leads for virtual discussions, virtual meeting, and physical meeting:
The discipline groups will be formed based on participants' specialties. These discipline groups will examine the analytical issues across the tracks and propose where and how their specialties can contribute to improving our analysis capability.
Simulation
Optimization
Decision Analysis
Computer Science
Social Sciences
Insert other recommend discipline groups here:
Any individual may participate in any to all of the unclassified tracks and discipline groups. Workshop attendees will have to choose a single track and single discipline groups. The workshop will have separate sessions for tracks and discipline groups.
Cyber Modeling and Simulation Requirements
If you have access to the Air Force Portal, see https://wwwd.my.af.mil/afknprod/ASPs/CoP/OpenCoP.asp?Filter=AF-OT-01-17 for Air Force requirements. We also have Combatant Command requirements provided to JMEM and OSD NII requirements on the SIPRNET. Contact Mark.Gallagher@pentagon.af.mil for the address.
Below and on the track and discipline pages we background information. Please add relevant information to this wiki!
Cyber Power! Stuart Starr and Franklin Kramer are just finishing editing of their book title Cyber Power. Leading experts have written 28 chapters, totaling approximately 650 pages of status and needs for cyber policy and analysis. This book will be available from National Defense University (NDU) soon. Franklin Kramer, Stuart Starr, and Larry Wentz presented the following overview paper at the 13th International Command and Control Research & Technology Symposium. kramer, Starr, and Wentz.pdf
This Symposium Report on Cyber Challenges for the 21st Century describes many of the issues that need to be addressed. Cyber Symposium_Summary Report.pdf
Background
Insert relevant background and discussion here or below:
Secretary of Defense Robert M. Gates, Singapore, Saturday, May 31, 2008, stated our first priority is "opening doors, protecting and preserving common spaces on the high seas, in space, and more and more in the cyber world." See http://www.defenselink.mil/speeches/speech.aspx?speechid=1253 for full text. He also placed the cyber domain in the same category as the physical domains at the NORAD-NORTHCOM Command Center Ribbon Cutting Ceremony (Colorado Springs, CO) on Tuesday, May 13, 2008 with "Each domain of this center – whether cyber, land, air, or maritime – is critical in detecting, deterring, and defeating threats to the people of North America. And let there be no doubt that there are serious threats to our people and to our way of life that have evolved over time." See http://www.defenselink.mil/speeches/speech.aspx?speechid=1241.
General Cartwright, VCJCS, spoke at the Air Force Cyberspace Sympossium, June 20, 2008. The DefenseLink article at http://www.defenselink.mil/news/newsarticle.aspx?id=50273 reports
One of the other challenges is building a force of cyber warriors, Cartwright said. He said the military has to figure out the appropriate skills, schools and rank structure to build a force capable of both the “defend and operate skills” and the “exploit and attack skills.” Once those forces are determined, the organizations will have to be built in such a way that they can present those forces to combatant commanders for employment. He said the backbone of the cyber warfare force needs people who are able to use constant innovation and adapt to constant change.
General Chilton, Commander US Strategic Command, Offutt Air Force Base, Nebraska, March 14, 2008, lays out the challenges of defending cyberspace. See http://www.defenselink.mil/news/newsarticle.aspx?id=49282.
Deputy Assistant Secretary of Defense for East Asia David Sedney at a DoD New Briefing from the Pentagon, Arlington, Virginia, on March 3, 2008, with full text at http://www.defenselink.mil/transcripts/transcript.aspx?transcriptid=4165 defines cyber intrusion versus cyber attack:
Question: Just a couple of things. First, on the section on cyber- attacks, it talks about intrusion and attacks. Can you just define also the difference there? And do you regard any of the intrusions which were traced back to China from the past year as in fact being attacks, or do you regard them as more an attempt to kind of snoop in and look at things?
MR. SEDNEY: I think we've been fairly careful in the language to distinguish between the intrusions, which we know have been happening, and attacks, which are things that can happen and can use the techniques. The exact same techniques that you use to intrude into a computer you could use to then attack it later on. And so we are not saying that there have been -- that these things are attacks, but they are intrusions. And intrusions also give you the ability to both look at what's inside and take out what's inside. And that has clearly happened. Large amounts of data have been taken out in these intrusions. That doesn't mean that that data has been destroyed, but it could have been. It doesn't mean it's been altered, but it could have been. So there are all these possibilities there. That, I guess, is -- it's a very careful answer to your question, and I think I have to be careful when I answer your questions.
Question: Isn't that an attack if you went into my house and took things out of my house? Isn't that more than an intrusion?
MR. SEDNEY: We're getting into philosophy here, but if I -- I think it's, perhaps, more like if someone went into your house and took a picture and left what was there, but then they went off -- but they went off with the image of it. But I think the whole area of cyber presents new challenges to us, both in the defense world, the intelligence world and the legal world. The whole world of the Internet presents these kind of challenges that we're struggling with, but it is important for countries to behave responsibly. And I think you'll notice in the report that we point out statements by other governments directly through the Chinese about their concerns, because it's not just the United States that has been subject to these intrusions -- (word inaudible) -- in China. It's been countries all over the world.
Eric A. Fischer in a Congressional Research Service title "Creating a National Framework
for Cybersecurity: An Analysis of Issues and Options" at net.educause.edu/ir/library/pdf/csd3765.pdf describes the needs of national cyber security system.
The Cyberspace Information Operations Study Center hosted its first symposium “Air Force Symposium 2008 – Cyberspace” at Maxwell AFB, Montgomery, AL, July 15 – 17, 2008. All the briefings are posted on the attached website http://www.maxwell.af.mil/au/awc/cyberspace/read.html please review the Read Ahead tab to the left and the Symposium briefings are posted at the bottom of the page.
Please add other relevant quotes, refereences, and comments here:
References
Smith, Edward A., Complexity, Networking, & Effects-Base Approaches to Operations, Department of Defense Command and Control Research Program (www.dodccrp.org), Washington, DC, July, 2006.
Insert other relevant references here:
We are using Defense Connect Online (DCO) for our online live collaboration meeting. The recording from DCO training session is available at: https://connect.dco.dod.mil/p85924805?session=breez425ixfidsmmuufbr. Forward to the 3 minute point. The first portion of the training was designed for anyone that will attend these meetings, and this section goes to the 38 minute point. After that, we discussed techniques for hosting meetings.
Suggestions and Comments:
We are trying several innovations in conducting this workshop. Your comments and suggestions are welcome on these innovations or any other aspect of the conference.
First, we have established this and classified wiki to discuss and drive the agenda. However, DoD policy that empolyees can not post to public websites, like this wiki, on military or job-related matters without a public affairs release has severly restricted its use. Do you like the wiki? How could it be better?
Insert wiki comments or suggestions here:
Second, we are conducting online sessions with Defense Connect Online (DCO) to prepare and start the workshop in the two months prior to the meeting. Do you like the online sessions? How could they be better?
Insert your comments and suggestions here:
Third, we are having participants focus within an application track and then meet with fellow experts on their discipline to look across the tracks and evaluate how their specialities may be applied. Do you like the alternative view of the discipline groups?
Insert comments and suggestions here:
Fourth, rather than start the workshop with a key note speaker to guide the vision. We are posting links to leaders speechs and writings. On the last afternoon of the workshop, we are inviting senior government leaders, either in person or online, to review and comment on workshop recommendations. Do you like this approach for senior leader involvement? How do you think it could be improved?
Insert comments and suggestions here:
Fifth, for the planners of this workshop, we used a sharepoint site to distribute information and DCO session to discuss the workshop. Do you think this electronic collaboration is a better way to plan?
Insert comments here:
What other comments or suggestions to you have for us? Please insert them here:
Thank you for reading and participating! You may also call me at 703-588-6949 or e-mail to Mark.Gallagher@pentagon.af.mil.
Please add relevant information to this wiki! If you do not have permission to write, please request an account in the upper right corner of your screen--everyone is welcome to contribute. Under "account" in the upper right corner you get three tabs: home, profile, and email. Home enables you to set the frequency for email notifications. Profile allows you to upload a picture for you comments. Email enables passwords. For MORS Members, Directors, and Fellows, this same pbwiki account can be authorized to give you write privileges to http://morsnet.org, where MORS discusses and plans activities and events.
Wiki Editing (very similar to word processing such Word--except everyone edits the same document):
-- Input text. Select "edit" tab on top. Move cursor and begin typing. Format is at the top. When complete click save on the bottom left of the screen.
-- Insert file. On the right side middle section under "Insert links" select "Images and files", browse to file, upload, click on file name to put link at cursor position.
-- Insert link to existing page. Right click to highlight the text of a link, under "Insert links" select "Pages" and click on the desired page
-- Insert link to a new page. Right click to highlight the text of the link, under "Insert links" select "Pages" and click on "Insert a link to a new page". Select options and click "OK"
-- After having fun, click on "Save" at bottom left.
Wiki Navigation: Click on the link to the page you want. The home or cyberanalysis links on the top left will bring you back to the frontpage.
Comments (4)
Charles_Brownstein said
at 3:45 pm on Aug 8, 2008
I think that in this arena, "attack" referrs to all sorts of unauthorized system incurrsions, rather than to the impact. An attacking machine could gain access to look at or mess with information or system components, of make systems behave in unplanned for ways (bock, slow or open up access, or whatever). A truely interesting issue is to pin down just who made any particular machine do its deed.
Mark Gallagher said
at 8:42 am on Aug 11, 2008
Charles, great comment! I copied your comment into the Cyber Vulnerabilities, Protection, and Defense page. Anyone may add directly into these wiki discussions. I have started added "insert" instructions to encourage more additions. Very Respectfully, Mark
Bud Whiteman said
at 3:12 pm on Aug 26, 2008
IO JMEM products and methodologies which include cyber analysis (offense and defense) is available on the SIPRNET. Go to intelink and search for "io jmem" or type the following into your SIPRNET browswer:
https://scie.stratcom.smil.mil/sites/workspaces/iojmem
Patrick Allen said
at 9:54 am on Oct 21, 2008
The list of topics to discuss for the Command and Control and Situation awareness track has now been posted on the C2 and SA page. This track is currently unclassified. Comments welcome.
You don't have permission to comment on this page.