How the Pentagon Approaches Cyber Defense: What Official Documents Say
In September 2023, the U.S. Department of Defense released an unclassified summary of its 2023 Cyber Strategy, after providing a classified version to Congress in May. Official DOD News coverage of that release, remarks by department officials, the summary itself, and official U.S. Cyber Command mission pages are the basis of this article. A strategy is a statement of intended approach, not a public inventory of every network defended or every operation conducted.
Four official lines of effort
According to the official DOD News account of the unclassified summary, the 2023 Cyber Strategy asks the department to address current and future cyber threats by pursuing four complementary lines of effort: defending the nation; preparing to fight and win the nation’s wars; protecting the cyber domain with allies and partners; and building enduring advantages in cyberspace. Deputy Assistant Secretary of Defense for Cyber Policy Mieke Eoyang said the document builds on the 2018 DOD Cyber Strategy, is informed by years of real-world DOD cyberspace operations, is the department’s fourth cyber strategy, and represents the secretary’s vision for operationalizing the 2022 National Defense Strategy in cyberspace.
Like the National Defense Strategy, Eoyang said, the cyber strategy identifies China as a pacing threat and Russia as an acute threat. She also said it had been informed by recent activities in Ukraine after Russia’s illegal invasion. “What this conflict has shown us,” she said, “is the importance of integrated cyber capabilities in and alongside other warfighting capabilities.” According to the strategy as quoted in the official story, cyber capabilities are most effective when used in concert with other instruments of national power, and cyberspace operations “represent an indispensable element of U.S. and allied military strength and form a core component of integrated deterrence.”
Allies, partners and “defend forward”
Eoyang said that, distinct from previous iterations, the 2023 strategy “commits to building the cyber capability of global allies and partners and to increase our collective resilience against cyber attack.” The summary, as quoted officially, says that in some cases the department will work toward that goal by augmenting partner capacity, expanding partners’ access to cybersecurity infrastructure, and maturing their cyber workforce through combined training events and exercises, and that in some cases it has also committed to directly helping develop a capability a partner needs but does not yet have. Official remarks on the same strategy also restate a “defend forward” approach: disrupting malicious cyber actors and degrading their supporting ecosystems, primarily through U.S. Cyber Command, in coordination with other departments and agencies and with allies and partners. Officials have cited operations in defense of U.S. elections since 2018 as an example of that policy in practice. Those are official characterizations of policy and of past operations; this article does not invent a catalog of current missions.
How official pages describe U.S. Cyber Command’s role
U.S. Cyber Command’s official “Cyber 101” mission page states that the command’s mission is to plan and execute global cyber operations, activities and missions to defend and advance national interests in collaboration with domestic and international partners across the full spectrum of competition and conflict. It describes three lines of operation: defending the Department of Defense Information Network (DODIN) from cyberattacks and intrusions; strengthening the nation’s ability to withstand and respond to cyberattacks; and conducting full-spectrum cyberspace operations to assist combatant commanders and the joint force. The DODIN, that page says, comprises the classified and unclassified networks that facilitate day-to-day DOD operations. Those official mission statements describe assigned roles. They are not a public log of every defense or disruption, and this article does not treat a strategy line of effort as proof that any particular defensive architecture — including later official goals such as zero-trust migration mentioned in related official remarks — has been completed across the department.
Officials also placed the 2023 strategy in a longer institutional timeline. Related official remarks recorded that U.S. Cyber Command was established in 2010 and that earlier departmental thinking had sometimes treated cyber capabilities more as a reserve instrument than as a domain for persistent campaigning. The 2018 strategy’s “defend forward” language, and the 2023 summary’s four lines of effort, are official policy statements in that sequence. They do not authorize this article to describe the classified contents of the May 2023 congressional version, which official coverage says remains classified.
Sources
- C. Todd Lopez, DOD News, “DOD’s Cyber Strategy Emphasizes Building Partner Capacity,” September 12, 2023, https://www.defense.gov/News/News-Stories/Article/article/3523840/…
- U.S. Department of Defense, unclassified summary of the 2023 DOD Cyber Strategy, https://media.defense.gov/2023/Sep/12/2003299076/-1/-1/1/2023_DOD_Cyber_Strategy_Summary.pdf
- U.S. Cyber Command, “CYBER 101 — U.S. Cyber Command Mission,” https://www.cybercom.mil/Media/News/Article/3192016/cyber-101-us-cyber-command-mission/
