Cyber defence is a team effort

Around 80 cyber security specialists from the ADF, Japan, the US, Canada and New Zealand are strengthening their ability to operate together in an increasingly important operational domain during Exercise Keen Sword 27 in Japan.

Participating in the cyber component of the exercise, these specialists are testing their combined ability to defend critical infrastructure against simulated malicious cyber intrusions.

RAAF Cyber Detachment Commander FLTLT Caro-Lynn Wong said working closely with international counterparts provided an opportunity to overcome technical challenges and learn from the different approaches brought by each nation.

“We experienced some initial administrative and technical challenges on day one, but that’s to be expected any time you have so many participants from different countries coming together,” FLTLT Wong said.

“We quickly learned and adopted [the] best practices to make the most of our systems, and just two days into the exercise, we are now running at full speed.”

Participants are divided across six teams and are responsible for defending simulated critical infrastructure including a hospital, airport, seaport and fuel depot. A simulated adversary or ‘red cell’ attempts to infiltrate the networks, while a ‘white cell’ controls the exercise.

The defending teams undertake intelligence-led cyber activities to identify malicious activity, locate the source of an intrusion and counter it. Importantly, the cyber scenario is integrated with the wider field exercise, meaning the actions of cyber teams can directly affect activities being conducted elsewhere in Keen Sword.

FLTLT Wong said that connection demonstrated how cyber capabilities supported operations beyond the digital environment.

“We have teams protecting the airport and a fuel depot from cyber attacks. If they fail at their tasks in here, then the teams out in the field can’t use those assets in the exercise,” she said.

“Our mission in cyberspace directly supports troops on the ground.”

The multinational structure also allows ADF personnel to work directly alongside Japanese and US cyber specialists, sharing different methodologies, frameworks, tactics and approaches.

Japan Air Self-Defense Force's CAPT Tomoya Kanno said the opportunity to understand how partner nations approached cyber threats was particularly valuable.

“It is very useful for us to see partner countries’ methodologies, frameworks and tactics for countering cyber threats to better enable us to work together in defence of critical infrastructure,” CAPT Kanno said.

US Air Force's MAJ Paul Lucero, team lead for the cyber exercise, said bringing specialists from different nations together was deliberately designed to encourage the sharing of techniques and procedures.

“We may speak different languages, but we all speak cyber,” MAJ Lucero said.

“We deliberately put multinational teams together to ensure that they share techniques and procedures. The main objective here is to learn from each other.”

MAJ Lucero said participants were continuously conducting reconnaissance and defending against simulated intrusions, often adapting techniques shared by the international partners working beside them.

Working side by side allows participating nations to strengthen their ability to respond collectively to cyber threats affecting critical infrastructure.

The cyber activity is being conducted on a closed network and receives real-time injects from the broader Keen Sword field exercise.

About 300 ADF personnel have deployed to Japan to enhance readiness and interoperability as part of Keen Sword.

Read more on Exercise Keen Sword 27 here.