Cyber Warfare
Military operations conducted in, through, and via cyberspace to achieve objectives that support commander's intent. Cyberspace operations encompass offensive, defensive, and network management activities across the digital battlespace — targeting information systems, critical infrastructure, and command-and-control networks.
Operations intended to project power by the application of force in or through cyberspace. Includes cyber attack, exploitation, and operations to degrade, disrupt, or destroy adversary capabilities.
Operations to defend DOD or other friendly cyberspace. Includes passive and active defense measures: monitoring, detection, analysis, and response to cyber threats and vulnerabilities.
Operations to design, build, configure, secure, operate, maintain, and sustain DOD communications systems and networks. Ensures information availability across the joint force.
Seven-stage model: Reconnaissance → Weaponization → Delivery → Exploitation → Installation → C2 → Actions on Objectives. Breaking any link disrupts the attack.
| Attribute | Cyber | Electronic Warfare | Information Ops | Kinetic |
|---|---|---|---|---|
| Domain | Cyberspace | Electromagnetic Spectrum | Information Environment | Physical |
| Speed | Near-instantaneous | Speed of light | Hours to months | Minutes to hours |
| Attribution | Very difficult | Moderate | Difficult | Easy |
| Reversibility | Often reversible | Usually reversible | Variable | Irreversible |
| Range | Global | Line of sight / regional | Global | Theater-dependent |
| Cost | Low to moderate | Moderate to high | Low | Very high |
| Collateral | Unpredictable spread | Limited | Broad influence | High physical damage |
The MITRE ATT&CK framework catalogs adversary tactics, techniques, and procedures (TTPs) based on real-world observations. The 14 tactics represent the adversary's tactical goals during an operation.
Offensive Cyber Operations
OCO projects power by applying force in and through cyberspace — degrading, disrupting, or destroying adversary capabilities and infrastructure. Operations are governed by the Law of Armed Conflict (LOAC) as interpreted in the Tallinn Manual on international law applicable to cyber operations.
Animated visualization: Attacker traverses network layers — Perimeter → DMZ → Internal Network → Critical Infrastructure. Click to restart animation.
| Organization | Nation | Focus | Notable Capability |
|---|---|---|---|
| US Cyber Command | United States | Full-spectrum cyber | 133 Cyber Mission Force teams |
| NSA / TAO | United States | SIGINT / CNE | Tailored Access Operations |
| Unit 8200 | Israel | SIGINT / Cyber | Stuxnet co-development |
| GRU Unit 74455 | Russia | Destructive cyber | Sandworm / NotPetya |
| PLA SSF | China | Espionage / IP theft | APT41 / APT10 operations |
| RGB / Bureau 121 | DPRK | Financial / Destructive | Lazarus Group / WannaCry |
Defensive Cyber Operations
DCO encompasses all measures to detect, identify, protect against, and respond to unauthorized activity within DOD information systems and networks. Employs defense-in-depth strategy across all seven OSI layers with continuous monitoring and active threat hunting.
| Layer | OSI | Attack Surface | Defense Measures |
|---|---|---|---|
| 7 | Application | SQL injection, XSS, API abuse | WAF, input validation, SAST/DAST |
| 6 | Presentation | SSL/TLS attacks, encoding exploits | Certificate pinning, secure protocols |
| 5 | Session | Session hijacking, replay attacks | Token management, session timeouts |
| 4 | Transport | SYN floods, port scanning | Rate limiting, TLS 1.3, IPS |
| 3 | Network | IP spoofing, routing attacks | Firewalls, ACLs, IPSec, segmentation |
| 2 | Data Link | ARP poisoning, MAC flooding | 802.1X, port security, VLAN isolation |
| 1 | Physical | Physical access, wiretapping | Physical security, TEMPEST, air gaps |
NIST SP 800-61r2 defines the standard incident response lifecycle. Post-incident activity feeds back into preparation, creating a continuous improvement loop. Average containment time for breaches: 73 days.
Network & Infrastructure
Military network architecture employs defense-in-depth across classified and unclassified enclaves. From NIPRNet to JWICS, each network tier implements layered security controls including next-generation firewalls, intrusion detection systems, and zero-trust microsegmentation.
Military network zones: Internet → Perimeter/DMZ → Internal Enclave → Restricted/Critical. Each boundary enforces security controls.
Strong authentication (MFA/FIDO2), continuous authorization, least-privilege access per session
Granular network segments per workload, lateral movement prevention, software-defined perimeters
Real-time risk scoring, UEBA analytics, automated policy enforcement, device compliance checks
DNSSEC validation, DNS-over-HTTPS (DoH), DNS sinkholing for malware C2 disruption, DNS firewalling, passive DNS monitoring for threat intel.
DOD PKI hierarchy, CAC/PIV smart cards, certificate transparency logs, OCSP stapling, automated certificate lifecycle management (ACME).
IPSec site-to-site tunnels, WireGuard, SSL VPN for remote access, HAIPE encryptors for classified traffic, GRE/MPLS overlay networks.
Threat Actors & TTPs
Nation-state advanced persistent threat (APT) groups represent the most sophisticated cyber adversaries. Understanding their tactics, techniques, and procedures (TTPs) through frameworks like MITRE ATT&CK enables proactive defense and threat-informed security architecture.
| APT Group | Nation | Also Known As | Primary Targets | Key TTPs | Notable Operations |
|---|---|---|---|---|---|
| APT28 | Russia (GRU) | Fancy Bear, Sofacy | Government, military, media | Spearphishing, 0-days, credential theft | DNC hack (2016), Bundestag |
| APT29 | Russia (SVR) | Cozy Bear, The Dukes | Government, think tanks | Supply chain, stealth, cloud abuse | SolarWinds (2020) |
| APT41 | China (MSS) | Double Dragon, Barium | Tech, healthcare, gaming | Supply chain, rootkits, dual espionage/crime | CCleaner, ShadowPad |
| Lazarus | DPRK (RGB) | Hidden Cobra, ZINC | Financial, crypto, defense | Watering holes, wiper malware, crypto theft | WannaCry, Sony hack, $625M Ronin |
| APT33 | Iran (IRGC) | Elfin, Refined Kitten | Aviation, energy, petrochemical | Spearphishing, Shamoon wiper, VPN exploits | Shamoon 1/2/3 attacks |
| Sandworm | Russia (GRU 74455) | Voodoo Bear, IRIDIUM | Critical infrastructure, elections | Wiper malware, ICS attacks, supply chain | NotPetya, Ukraine grid attacks |
Equipment & Tools
Cyber operations rely on specialized software tools, hardware appliances, and military platforms. From penetration testing frameworks to network forensics analyzers, these tools form the arsenal of both offensive and defensive cyber operators.
| Tool | Category | Function | Platform |
|---|---|---|---|
| Exploitation Framework | Offense | Exploitation framework — 2,000+ exploits, payload generation, post-exploitation | Cross-platform |
| Adversary Simulation Platform | Offense | Adversary simulation, beacon C2, lateral movement, malleable profiles | Windows/Linux |
| Credential Extraction Tool | Offense | Windows credential extraction — Kerberos tickets, NTLM hashes, plaintext passwords | Windows |
| Active Directory Path Mapper | Offense | Active Directory attack path mapping using graph theory | Cross-platform |
| Network Discovery Scanner | Both | Network discovery, port scanning, service/OS detection, NSE scripting | Cross-platform |
| Web Application Security Tester | Both | Web application security testing — proxy, scanner, intruder, repeater | Cross-platform |
| Network Protocol Analyzer | Defense | Network protocol analyzer — deep packet inspection, pcap analysis | Cross-platform |
| Malware Pattern Matcher | Defense | Pattern matching rules for malware identification and classification | Cross-platform |
| Memory Forensics Framework | Defense | Memory forensics framework — RAM artifact extraction and analysis | Cross-platform |
| SIEM Platform | Defense | SIEM platform — log aggregation, correlation, alerting, dashboards | Cloud/On-prem |
| Network Security Monitor | Defense | Network security monitor — traffic analysis, connection logging, protocol parsing | Linux/macOS |
| Network IDS/IPS Engine | Defense | Network IDS/IPS — signature-based and anomaly detection engines | Linux |
Passive hardware devices that copy network traffic for monitoring without introducing latency or detection risk. Full-duplex TAPs capture both directions simultaneously. Essential for out-of-band IDS deployment.
FIPS 140-2/3 validated cryptographic hardware for key generation, storage, and management. Tamper-resistant modules used for PKI root CAs, code signing, database encryption, and payment processing.
Data diodes and cross-domain solutions (CDS) that enforce one-way data flow between classification levels. Ensures physical isolation of classified networks while enabling controlled information sharing.
| Organization | Nation | Established | Mission |
|---|---|---|---|
| USCYBERCOM | United States | 2009 | Full-spectrum cyberspace operations — unified combatant command under STRATCOM, elevated 2018 |
| UK NCSC | United Kingdom | 2016 | National cyber defense, incident response, and public guidance (part of GCHQ) |
| NATO CCDCOE | NATO (Estonia) | 2008 | Cooperative Cyber Defence Centre of Excellence — research, training, Locked Shields exercise |
| ANSSI | France | 2009 | National cybersecurity agency — defense, certification, and regulatory enforcement |
| BSI | Germany | 1991 | Federal Office for Information Security — standards, certification, cyber defense |
Army-led program providing scalable, on-demand cyber ranges for individual and collective training. Supports realistic adversary emulation, mission rehearsal, and certification of Cyber Mission Force teams. Cloud-based, accessible worldwide.
DOD test and evaluation facility for cyber tools and tactics. Provides isolated, high-fidelity network environments replicating real-world infrastructure. Supports red/blue/purple team exercises and capability assessment.
Skills & Certifications
Cyber warriors require a broad technical foundation spanning networking, operating systems, programming, cryptography, and adversary tradecraft. This section maps core competencies, industry certifications, and career progression pathways for military and civilian cyber professionals.
Radar chart showing relative competency levels across 8 core skill dimensions for cyber operations roles.
SOC Analyst, Security Engineer, IT Auditor. Focus: monitoring, triage, basic incident response. Certs: Foundation cert.
Pen Tester, Incident Responder, Threat Intel Analyst, Malware Analyst. Focus: specialization. Certs: Intermediate certs.
Red Team Lead, Security Architect, CISO, Cyber Mission Commander. Focus: strategy & leadership. Certs: Advanced certs.
Reference Matrix
Comprehensive filterable and sortable reference of all cyber operations, techniques, and tools covered in this guide. Use the category and difficulty filters to narrow results.
| Name | Category | Type | Difficulty | Description |
|---|---|---|---|---|
| Zero-Day Exploit | OCO | Technique | Advanced | Exploitation of previously unknown vulnerability with no available patch |
| SQL Injection | OCO | Technique | Intermediate | Code injection via malicious SQL statements in application input |
| Buffer Overflow | OCO | Technique | Advanced | Memory corruption to achieve arbitrary code execution |
| Credential Harvesting | OCO | Technique | Beginner | Phishing, keylogging, or dump tools to capture authentication data |
| Supply Chain Compromise | OCO | Technique | Advanced | Compromising trusted software/hardware vendors to reach end targets |
| DDoS Attack | OCO | Technique | Beginner | Volumetric or application-layer flood to deny service availability |
| Wiper Malware | OCO | Tool | Advanced | Destructive malware that overwrites or encrypts data irreversibly |
| ICS/SCADA Attack | OCO | Technique | Advanced | Targeting industrial control systems for physical-world effects (Stuxnet-class) |
| SIEM Monitoring | DCO | Tool | Beginner | Security information and event management for log correlation and alerting |
| IDS/IPS | DCO | Tool | Intermediate | Signature and anomaly-based intrusion detection/prevention systems |
| EDR | DCO | Tool | Intermediate | Endpoint detection and response — behavioral analysis, process monitoring |
| Honeypot | DCO | Technique | Intermediate | Decoy systems to detect, deflect, and study attacker behavior |
| Threat Hunting | DCO | Technique | Advanced | Proactive hypothesis-driven search for undetected threats in network |
| Patch Management | DCO | Process | Beginner | Systematic application of security updates to reduce attack surface |
| Zero Trust | DCO | Architecture | Intermediate | Identity-centric, never-trust-always-verify security model |
| Network Segmentation | DCO | Architecture | Intermediate | Dividing networks into zones to limit lateral movement |
| Network Discovery Scanner | Both | Tool | Beginner | Network mapper for discovery, port scanning, and service detection |
| Network Protocol Analyzer | Both | Tool | Intermediate | Network protocol analyzer for deep packet inspection and forensics |
| Exploitation Framework | Both | Framework | Intermediate | Exploitation framework for penetration testing and vulnerability validation |
| Memory Forensics Framework | Both | Tool | Advanced | Memory forensics framework for RAM analysis and artifact extraction |
| Malware Pattern Matcher | DCO | Tool | Advanced | Pattern-matching rules for malware identification and threat classification |
| Adversary Simulation Platform | OCO | Framework | Advanced | Adversary simulation platform with beacon C2 and malleable profiles |
| Incident Response | DCO | Process | Intermediate | NIST SP 800-61 lifecycle: Preparation, Detection, Containment, Eradication, Recovery |
| Digital Forensics | Both | Discipline | Advanced | Evidence acquisition, chain of custody, disk/memory/network forensic analysis |