TOWSON, Md. – Soldiers from the Maryland National Guard’s 169 Cyber Protection Team have just wrapped up their part in this year’s Cyber Shield exercise, which ran from September 12—27, and was conducted virtually for the first time due to the coronavirus pandemic.
Cyber Shield is an annual, national exercise hosted by the National Guard with more than 800 National Guard soldiers and airmen participating, from more than 40 states and territories.
According to the National Guard Bureau, the mission of Cyber Shield is to develop, train and exercise cyber forces in computer network internal defensive measures and cyber incident response.
“We are proud of the performance of our soldiers in this year’s Cyber Shield exercise,” said Col. Kristine Henry, the commander of Task Force 291, the higher headquarters unit of the 169 CPT in Maryland.
According to Henry, the 169 CPT is an important part of the Maryland Adjutant General’s overall strategic direction toward intelligence, cyber and information capabilities for both federal and state missions.
“We continue to take every opportunity to exercise these capabilities so that they are ready when called,” Henry said. “In the past year alone, our cyber warriors have partnered with the Air Guard to work with various state agencies like the Maryland Director of Information Technology and the Maryland Coordination and Analysis Center to support emergencies such as the coronavirus pandemic response.”
This year, the Maryland National Guard was represented at Cyber Shield by the rear detachment of the 169 CPT. The main element of the unit is deployed as part of Task Force Echo, conducting defensive cyberspace operations in support of U.S. Cyber Command.
“We spent the first week learning about different attack platforms and other techniques we should continue practicing from a defensive perspective,” said Warrant Officer Giovanni Morales, a network infrastructure service specialist with the 169 CPT.
“During the second week, three days were dedicated to OPFOR (opposing force) performing actions on the objective and testing the Blue Team’s defensive measures and cyber incident response,” Morales said.
Throughout the exercise, teams were divided into blue teams and red teams. Morales felt the mission of the exercise was best served during what he referred to as "purple days” or days that were dedicated to the teams collaborating and sharing information.
The 169 CPT performed the role of OPFOR during this year’s Cyber Shield. Morales said that this provided the team particular insight into the attack side of cyber protection.
“It’s important to understand what the threat actors are doing in order to test and improve our own defense,” Morales said.
1st Lt. Clarence Nowell is a member of the 169 CPT and took part in this year’s exercise as the officer-in-charge for the 169 CPT team.
“Our participation is essential because it helps build cohesion across the cyber community as we train in our Warfighter Functions,” said Nowell.
Besides building cohesion within the cyber community, Nowell said the exercise helped his team sharpen skills and improve readiness for their federal mission, while also bolstering skills to support their state mission.
According to Morales, it is important for units like the CPT to participate in exercises like Cyber Shield to measure their success and identify areas they need to improve.
“Just like infantry units need to practice at the range or practice maneuvers, or airborne units need to jump out of planes, a CPT needs to participate in different cyber exercises,” said Morales.
The exercise was led this year by the Virginia National Guard’s 91st Cyber Brigade, the higher headquarters of the 169 CPT for their federal mission, and it included a variety of partners from other government agencies and the private sector.
The exercise featured scenarios to make the experience more realistic for participants. “We try to make the environment for our National Guardsmen more intense, or at least as intense as an actual incident response,” said officer in charge, Col. Teri Williams.
Morales had never participated in a cyber exercise like this, he said it surpassed all of his expectations.
“The virtual environment had its hiccups, but it performed better than anyone expected,” said Morales.
He added that most cyber exercises are done on virtual cyber ranges.
“The biggest challenge was having the team members in different geographic locations and the communications challenges that accompany that,” said Morales.
Nowell agreed that the virtual nature of the exercise did not come without challenges. “It can hinder the direct access to hands-on mentorship,” he said.
But Nowell added that there are unique opportunities that come with the virtual setting as well. One of which is the opportunity to work on communications skills.
“Dispersed teams must rely on clear, concise, timely communication… and develop research skills,” said Nowell.
Morales said the biggest takeaway for him was the value of collaboration.
“Sometimes cyber practitioners struggle with sharing information that can improve the overall capabilities of other teams because they would rather keep those capabilities to themselves and increase their own importance,” said Morales.
From Morales perspective, this was not the case at Cyber Shield 2020.
“The greatest value of the exercise was the sharing of information between teams,” he said. “Participants were willing to take time to share information and make everyone else better whenever they had the opportunity.”
Other members of the team representing Maryland in this year’s exercise include Chief Warrant Officer Dennis Skelton, Staff Sgt. Anthony Schwartz, Cpl. Emmanuel Unaka and Master Sgt. Jon Wachter.
The 169 CPT’s mission is to conduct defensive cyber operations. The unit’s soldiers defend military networks in support of federal missions from the Department of Defense or state missions from Maryland leaders.
Defensive cyber operations can also include conducting cyber command readiness inspections, vulnerability assessments, critical infrastructure assessments, theater security cooperation, support to the Federal Emergency Management Agency (FEMA) and others.
The 169 CPT falls under Task Force 291, which was established as one of the Maryland National Guard’s major subordinate commands on Oct. 1, 2019, to provide command and control for several Maryland National Guard units throughout the deployment of the 58th Expeditionary Military Intelligence Brigade.