Breaking Stovepipes: Bridging Gaps in Air Force Industrial Control Systems Management to Enable Multi-Domain Mission Assurance - Improperly Organized for Missions Across Air, Space, and Cyberspace

This report has been professionally converted for accurate flowing-text e-book format reproduction. Air Force doctrine inadequately addresses Industrial Control Systems (ICS) security and as a result, the service is improperly organized and trained to secure missions across the domains of air, space, and cyberspace. In response, the Air Force must consider significant changes at the strategic, operational, and tactical levels to provide mission assurance to commanders.
An important question that the Chief of Staffs Task Force Cyber Secure (TFCS) asks is: How do we organize, train, and equip Air Force forces to support the five core missions, in and through cyber? By their nature, air, space, and cyber dominance are tied to physical platforms from which the Air Force projects power. Increasingly, the line between physical and cyber has blurred as ICS become a key factor in enabling mission assurance through the basing system. Functional "stovepipes," specifically those of civil engineer and cyber surety, have resulted in ICS vulnerabilities, threating mission assurance at every one of the service's installations.

While changes can be made to the way units analyze systems or task organize under a wing, none of that will be effective until Air Force doctrine, both civil engineer and cyber surety adequately recognizes the differences between cyberspace and the traditional physical domains of air and space. The TFCS infrastructure work group should prioritize revising both sets of doctrine to enable the force to view cyberspace for what it is, a digital battlefield that comes under fire every day, whether at home station or forward deployed. Without this revision, the limited mindset of Airmen in the field employing ICS enabled installations and the mission commanders they serve will never change.

This compilation includes a reproduction of the 2019 Worldwide Threat Assessment of the U.S. Intelligence Community.

The purpose of this paper is to influence the Air Force Deputy Chief of Staff for Logistics, Engineering, and Force Protection and the Chief, Information Dominance and Chief Information Officer to direct doctrinal changes that will drive modifications to the organization and training of civil engineer and cyber surety Airmen to better provide multi-domain mission assurance through securing ICS. First, the paper will suggest that the civil engineer and cyber surety views of ICS originate from fundamentally divergent perspectives, which in-turn, have led to the service unknowingly taking on infrastructure induced risk to mission accomplishment such as that illustrated by the opening vignette. The argument presented will offer that the root of this disconnect lies in doctrine. After framing the problem, the paper will recommend convergent solutions to align and alter the organization and training of civil engineer and cyber surety Airmen with the goal of closing the gap and subsequently, enhancing mission assurance. While the vignette offered provides a deployed example, the lessons are equally valid for home station or deployed-in-place missions.

Dettagli