RICHMOND, Va. — Virginia National Guard cyber warriors assigned to the Fairfax-based 91st Cyber Brigade joined more than 600 National Guard Soldiers and Airmen from 39 states and territories to conduct Cyber Shield 2020 to test their skills in response to cyber incidents Sept. 12 - 26, 2020. The exercise was conducted virtually due to the COVID-19 pandemic.
Cyber Shield, which brings together military and civilian cyber defense specialists from across the country, is sponsored by the U.S. Army National Guard with assistance from the Air National Guard. It’s conducted at an unclassified level to allow maximum participation.
“It’s the premiere unclassified cyber defense exercise for the Army National Guard,” said Col. Teri Williams, commander of the Fairfax-based 91st Cyber Brigade and the officer in charge of Cyber Shield 2020. “It’s an exercise to hone the skills of defensive cyber operations.”
The exercise was originally scheduled to be held in spring of 2020 at Camp Williams, Utah, but had to be postponed and eventually moved because of the COVID-19 pandemic. After trying to reschedule to locations in Indiana and California, Williams said the decision was made to move the event to a virtual environment.
“It was a hard decision because part of the value of the exercise is getting all that cyber talent together. I always say you get more cyber talent in one square mile during those two weeks of Cyber Shield than probably exists in the world,” said Williams. “It was hard to make the decision to go virtual but it was the right thing to do just because it was either that or we cancel Cyber Shield ’20.”
The first week of Cyber Shield was focused on cyber defense industry training, which included classroom training and practical exercises in threat analysis, information operations and other topics.
“Training week is probably one of the highlights of Cyber Shield,” said Williams, who in addition to her role as the commander of the 91st serves full-time as the chief information officer for the Ohio Army National Guard. “We bring in some of the top vendors across the country to provide the training to the individuals. A lot of times the states don’t have the ability to contract some of the real high-end vendors. So this exercise gives us the ability to get Soldiers and Airmen the training that they otherwise would not get in their individual states.”
The second week of Cyber Shield was focused on practical exercises and ranges aimed at improving cyber incident response and network defense operations. This year, even before the decision to go all-virtual, Williams said a decision was made to use ShadowNet, a custom-built private cloud which provides aligned units with tailored cyber training at the individual and collective levels. That decision turned out to be fortuitous.
“ShadowNet was originally designed by Guardsmen for Guardsmen, so that certainly became a reality during the exercise,” explained Williams. “In years past, the range that we’ve used for the exercise would never have been able to support what we did this year. This year we pivoted to ShadowNet, which is the 91st Cyber Brigade’s training cyber range. Before COVID we decided to move to ShadowNet, and thank God we did, because there is no other range out there that would have been able to support a remote exercise as dispersed as we were.”
Using the ShadowNet platform, the exercise involved adversarial “Red Teams” attempting to launch cyber attacks against “Blue Teams,” with both teams comprised of National Guard cyber defense elements. To allow for better discussions and learning about the events taking place each day, the exercise staff made a few changes from previous years’ Cyber Shields.
“We typically do one big scenario over the course of the week, so they kick off and just go until Friday,” said Williams. “This year what we tried was a different day every day, so it was all segmented. For the intel and fusion cell folks, we tried to keep an over-arching story. We really tried to keep the individual injects, basically the red on blue type stuff, very segmented day to day so that at the end of the day, the opposing force could come in and tell the blue team everything that they did and they can talk about it rather than waiting until Friday and you forget what the heck happened. It also allowed the teams to start with a clean slate every day.”
Hosting the fully-remote exercise presented other unexpected challenges, many of which were the result of having so many personnel spread out across the Guard’s 54 states and territories and the difference in their home time zones.
“With everybody dispersed, you don’t think about things like Guam. They had a blue team, and were on a completely different time zone, and it’s like 1:40 in the morning there and it’s the middle of our day here,” said Williams. “In a normal, on-premise exercise we just run through one iteration of the exercise. This year given the remote nature and the different time zones, we did two iterations, a morning and an afternoon, so we could move people in different time zones and try to make it less impactful for them.”
Cyber Warriors from the VNG’s 91st Cyber Brigade helped run a virtual help desk during the exercise, and also helped with a validation exercise for the 172nd Cyber Protection Team, a combination team comprised of Ohio, Michigan and Indiana Guardsmen during the first week of Cyber Shield.
“Our Virginia folks from the 91st had to figure out how to run a dispersed help desk and figure out how to interact with the range liaison officers, and also how to address issues as they popped up, how that was going to be handled,” said Williams.
For Williams, who has participated in Cyber Shield yearly since 2013, this was the third year she’s been the OIC. Overcoming the challenges presented by the virtual environment forced by the pandemic was beneficial to everyone involved with the exercise.
“Usually the staff doesn’t feel like we’ve learned a lot just because you’re making sure everyone else is learning and training,” she said. “I think this year was unique in the sense that I think the staff and the participants learned a lot based on all the challenges we had.”