“Don’t tell them, Pike!”
Protecting data in 21st Century Army, a personal insight
On 28th November I visited the Army’s Cyber Spartan 2024 exercise held at Battlelabs in Devon, courtesy of our relationship with the Royal Signals Institution. The exercise aims strengthen the Army’s DCO (Defensive Cyber Operations) capabilities. Spread over a week, it uses a “Red teams opposing Blue teams” structure, all run inside a “range” (a large private network within which the exercise takes place) which is an analogy with real-world exercises. Another analogy comes with the terminology “Live Fire”, meaning that Red teams really do attempt to break the networks and digital assets of the Blue Teams, whilst harassing their defence efforts in real time. Other teams manage the range, generate the operational traffic on the network, and govern and score the exercise. (In this setting, a field umpire is not required to mark the casualties with different colours of paint).
33 Blue teams participate either onsite or from remote locations. A team is typically between 7-10 individuals. Teams come from a variety of Army units, other government agencies (e.g. Police) and some allied partners.
The whole exercise is supported on a platform supplied by a specialist firm (interestingly, sourced from a supplier which is not based within a 5-Eyes alliance country). The platform includes the range, the operational assets and all of the tools for each of the teams.
A University partner (Cranfield) is used to research the data emerging from the exercise to inform the Army on the effectiveness of the exercise, the broad skills levels (teams can be compared, but not individuals), how the makeup of teams affect performance and other human factors. The success or failure of teams in the exercise is very sensitive not only to technical skills levels, but to team organisation, communication and decision-making.
I talked with some of the team participants – mostly younger soldiers. They seemed to have a good grasp of the importance of the exercise and certainly outpaced my knowledge with some of their explanations about the techniques they were using.
My reflections on the visit were:
- The exercise is mostly aimed at sharpening defensive capabilities. I learned that the Army does not hold a standing brief for offensive Cyber: this lies with other organisations within our government fabric.
- The Army struggles to recruit and retain specialist Cyber skills. These capabilities are in high demand in the corporate world, with very attractive packages on offer for the best experience and skills. However, a significant fraction of the young generation of soldiers entering the forces these days do bring a self-learned capability, interest and skillset, which can then further be developed.
- These exercises are a means not only to exercise the Army’s capabilities, but to draw in the experience of partners and suppliers (very fast-moving landscape), to inform the Army’s training agenda and structures and to surface the best talent for further specialisation.
- The participants not only learn from the “Live Fire” context but enjoy the competitive nature of the exercise. This elevates what can seem to be a dry and sometimes routine skillset to a more relevant and exciting level.
I came away full of admiration for the decision-makers in the Army with the foresight to make a substantial investment in such an innovative approach. I was impressed with the participating soldiers I met. I left with confidence that the leadership of the armed forces understand the critical importance of this key capability.
Whilst everything above is not classified in any way, the taking of photos at the event was somewhat restricted, so the photos accompanying this article are symbolic rather than substantive. My presence was as part of a briefing day for industry partners and for other military leaders who do not yet have their own personnel in the exercise.
My thanks to the Royal Signals Institution, who arranged for the WCIT and other suppliers and partners to attend this event.
Gary Moore, Master Information Technologist