Approximately 20 Virginia National Guard Soldiers and Airmen took part in the Cyber Fortress exercise with numerous public and private sector partners including Dominion Energy, the Virginia Department of Emergency Management, the Virginia Department of Information Technology, the Virginia State Police and other local, state and federal organizations Sept. 21-30, 2022, in Richmond, Virginia.
“The Cyber Fortress Exercise bought together the organizations who will actually respond in a real-world cyber incident and provided an opportunity to test Virginia’s cyber response plan and better prepare for future collective responses,” said Brig. Gen. James W. Ring, VNG Director of the Joint Staff. “The professionalism with these partners is demonstrated by the ability to execute a statewide exercise in less than 10 months from concept to execution. Virginia is better prepared to defend from future cyberattacks because of the partnerships established or improved in Cyber Fortress.”
Ring said the VNG is well positioned to partner with government in the event of a cyberattack, and Cyber Fortress validated the its ability to also support private sector critical infrastructure partners providing services to citizens across the commonwealth.
VNG Soldiers assigned to the Fort Belvoir-based 91st Cyber Brigade, the Fairfax-based Information Operations Support Center and the Richmond-based Joint Force Headquarters - Virginia Defense Cyber Operations Element and VNG Airmen assigned to the 185th Cyberspace Operations Squadron, 192nd Operations Group, 192nd Wing at Joint Base Langley Eustis supported the event and were integrated into other cyber security teams involved in the exercise.
“We have a lot to be proud of today,” said Shawn Talmadge, VDEM State Coordinator of Emergency Management. “This is among the first cyber exercises involving federal and state response partners in support of a private sector entity. We know the threat is real and incredibly capable. From Virginia’s perspective, we need to look at how we build resiliency and capacity and leverage the whole of government approach to support a private sector.”
Talmadge explained the exercise was a chance to test Virginia’s cyber security plan and identify any potential gaps as well as take a hard look at how to deploy state resources like the National Guard when needed.
He also said this exercise is a starting point, and future exercises will focus on other critical infrastructure capabilities like transportation or communication. Lessons learned will be documented in order to capture the appropriate procedures for receiving support requests and taking appropriate action.
“The Virginia National Guard benefits from collaborating with public and private partners to reduce the impact of a cyber event on the citizens of the commonwealth,” explained Col. Rusty McGuire, commander of the 91st Cyber Brigade and co-director of the exercise. “This exercise helps all mission partners collaborate in an intense exercise to identify gaps and make Virginia's cyber enterprise more resilient.”
McGuire said this is a great example of how the VNG works with state leaders and critical infrastructure partners for the benefit of all Virginians.
“Not only is the VNG prepared to respond to floods and snowstorms but the VNG is prepared to assist with the same level of support in a cyber security incident,” McGuire said. “We hope to see exercises like Cyber Fortress hosted annually to improve cybersecurity for all critical infrastructure partners across the commonwealth.”
McGuire said with real-world attacks increasing and becoming more sophisticated, it is more important than ever to bring federal and state agencies and private sector together to better protect Virginia critical infrastructure.
“Fifty years ago, a foreign actor could not touch critical infrastructure in the United States without major resources,” McGuire said. “Now with off-the-shelf capabilities, the virtual doorstep to critical infrastructure networks are just a mouse click away for bad actors. This requires a private-public approach to bring all available resources to defend critical networks and that is what we did with Cyber Fortress.”
He said the VNG submitted the proof of concept for the exercise in December 2021 and agreed to partner with Dominion Energy. The table-top exercise provided an opportunity for senior leaders to discuss processes and policies, while the multi-day portion of the exercise focused on joint teams of military and civilian cyber specialists contending with a simulated cyber attack.
"The vision of our security organization at Dominion Energy is to mitigate today's threats, manage our company's vulnerabilities, and close intelligence gaps - while also meeting tomorrow's challenges," said Adam Lee, chief security officer for Dominion Energy. "We work to ensure our cyber systems are resilient and properly defended and we remain trusted stewards of stakeholder data. A critical piece of our overall converged security framework is effective partnerships with our government partners. I believe that in order to properly secure American critical infrastructure, you have to train with government agencies which would respond in the event of a significant cyberattack. Cyber Fortress enabled us to lift our relationships to the next level."
McGuire said planning has already begun for the next installment of Cyber Fortress with the plan to rotate through a different critical infrastructure mission partner annually to ensure that all of Virginia is better prepared for future cyberattacks. He said the VNG has also partnered with the U.S. Army Cyber Institute and Norwich University Advanced Research Institutes to develop the table top portion of the exercise.