In order to conduct operations successfully and defend its capabilities against all warfighting domains, many have warned the Department of Defense (DoD) of the severity of the cyber threat and called for greater attention to defending against potential cyber attacks. For several years, many within and outside DoD have called for even greater attention to addressing threats to cyberspace. At the request of the Chief of Naval Operations, the National Research Council appointed an expert committee to review the U.S. Navy's cyber defense capabilities. The Department of the Navy has determined that the final report prepared by the committee is classified in its entirety under Executive Order 13526 and therefore cannot be made available to the public. A Review of U.S. Navy Cyber Defense Capabilities is the abbreviated report and provides background information on the full report and the committee that prepared it.

Along with the rest of the U.S. government, the Department of Defense (DoD) depends on cyberspace to function. DoD operates over 15,000 networks and seven million computing devices across hundreds of installations in dozens of countries around the globe. DoD uses cyberspace to enable its military, intelligence, and business operations, including the movement of personnel and material and the command and control of the full spectrum of military operations. The Department and the nation have vulnerabilities in cyberspace. Our reliance on cyberspace stands in stark contrast to the inadequacy of our cybersecurity -- the security of the technologies that we use each day. Moreover, the continuing growth of networked systems, devices, and platforms means that cyberspace is embedded into an increasing number of capabilities upon which DoD relies to complete its mission. Today, many foreign nations are working to exploit DoD unclassified and classified networks, and some foreign intelligence organizations have already acquired the capacity to disrupt elements of DoD's information infrastructure. Moreover, non-state actors increasingly threaten to penetrate and disrupt DoD networks and systems. DoD, working with its interagency and international partners, seeks to mitigate the risks posed to U.S. and allied cyberspace capabilities, while protecting and respecting the principles of privacy and civil liberties, free expression, and innovation that have made cyberspace an integral part of U.S. prosperity and security. How the Department leverages the opportunities of cyberspace, while managing inherent uncertainties and reducing vulnerabilities, will significantly impact U.S. defensive readiness and national security for years to come.

This 2019 report is in response to the request of the Secretary of the Navy to conduct an independent Cybersecurity Readiness Review following the loss of significant amounts of Department of the Navy data. Attached are the findings of that review along with specific recommendations for your consideration as you determine the way ahead for the nation's Navy. The review examined cybersecurity at the governance layer and identified five critical pillars key to cybersecurity readiness: culture, people, structure, processes, and resources. The team interviewed dozens of senior military leaders as well as Chief Executive Officers, Chief Operating Officers, Chief Information Officers, and Chief Information Security Officers from several Fortune 500 companies with deep experience in implementing successful cybersecurity measures following significant incidents of their own. We identified best-practices in both government and private sector organizations who are demonstrating success in contending with cyber threats.This compilation includes a reproduction of the 2019 Worldwide Threat Assessment of the U.S. Intelligence Community. Scope and Methodology * Chapter 1: Introduction * Economic Security, National Security, and Cybersecurity * The Eroded Military Advantage * The Department Today * DIB Observations and Vulnerabilities * What Follows * Chapter 2: Culture * The Role of Culture as a Governance Tool to Achieve Cybersecurity * Culture Best Practices * State of Today's Naval Service Culture * Culture Recommendations * Chapter 3: People * The Role of People as a Governance Tool to Achieve Cybersecurity Resiliency * People Best Practices * State of Today's Naval Service People * People Recommendations * Chapter 4: Structure * Role of Structure as a Governance Tool to Achieve Cybersecurity Resiliency * Structure Best Practices * State of Today's Naval Service Structure * Structure Recommendations * Chapter 5: Process * The Role of Process as a Governance Tool to Achieve Cybersecurity Resiliency * Process Best Practices * State of Today's Naval Service Process * Process Recommendations * Chapter 6: Resources * Resources Best Practices * State of Today's Naval Service Resources * Resources Recommendations * Final ThoughtsIn time, this era's opponent will overmatch our nation in manpower, industrial capacity, intellectual capital, and eventually financial resources. We, not they, stand to become the near-peer. Given this relative erosion of US dominance over time, every differentiating idea or intellectual product gained or lost is material. More importantly, in the years to follow, it will have compounding effects in advantage or disadvantage. That reality demands every bit of relevant intellectual property (IP) must be defended, but the relevant IP to be protected must expand beyond what we now protect, to that which our rivals want.The failure to protect Navy and Marine Corps information systems and IP is an existential threat to their existence. To the extent the Department of the Navy (DON) assesses its performance in this realm, it judges itself against and ahead of the private sector and its sister services. We do not believe either to be true. The DON should be assessing itself against the best of the private sector and its global rivals. We find the DON preparing to win some future kinetic battle, while it is losing the current global, counter-force, counter-value, cyber war. Knowing and acting on that new reality is essential for the DON. The Secretary of the Navy was correct to question if the current cybersecurity governance structure was optimally focused, organized, and resourced. We find it is not. What follows are best practices and solutions that can put the DON on the right path. Getting this right and underway can only be done by those who govern the Navy and Marine Corps.

Just a sample of the contents ... contains over 2,800 total pages .... PROSPECTS FOR THE RULE OF LAW IN CYBERSPACE Cyberwarfare and Operational Art CYBER WARFARE GOVERNANCE: EVALUATION OF CURRENT INTERNATIONAL AGREEMENTS ON THE OFFENSIVE USE OF CYBER Cyber Attacks and the Legal Justification for an Armed Response UNTYING OUR HANDS: RECONSIDERING CYBER AS A SEPARATE INSTRUMENT OF NATIONAL POWER Effects-Based Operations in the Cyber Domain Recommendations for Model-Driven Paradigms for Integrated Approaches to Cyber Defense MILLENNIAL WARFARE IGNORING A REVOLUTION IN MILITARY AFFAIRS: THE NEED TO CREATE A SEPARATE BRANCH OF THE ARMED FORCES FOR CYBER WARFARE SPECIAL OPERATIONS AND CYBER WARFARE LESSONS FROM THE FRONT: A CASE STUDY OF RUSSIAN CYBER WARFARE ADAPTING UNCONVENTIONAL WARFARE DOCTRINE TO CYBERSPACE OPERATIONS: AN EXAMINATION OF HACKTIVIST BASED INSURGENCIES Addressing Human Factors Gaps in Cyber Defense Airpower History and the Cyber Force of the Future How Organization for the Cyber Domain Outpaced Strategic Thinking and Forgot the Lessons of the Past THE COMMAND OF THE TREND: SOCIAL MEDIA AS A WEAPON IN THE INFORMATION AGE SPYING FOR THE RIGHT REASONS: CONTESTED NORMS IN CYBERSPACE AIR FORCE CYBERWORX REPORT: REMODELING AIR FORCE CYBER COMMAND & CONTROL THE CYBER WAR: MAINTAINING AND CONTROLLING THE “KEY CYBER TERRAIN” OF THE CYBERSPACE DOMAIN WHEN NORMS FAIL: NORTH KOREA AND CYBER AS AN ELEMENT OF STATECRAFT AN ANTIFRAGILE APPROACH TO PREPARING FOR CYBER CONFLICT AIR FORCE CYBER MISSION ASSURANCE SOURCES OF MISSION UNCERTAINTY Concurrency Attacks and Defenses Cyber Workforce Retention Airpower Lessons for an Air Force Cyber-Power Targeting ¬Theory IS BRINGING BACK WARRANT OFFICERS THE ANSWER? A LOOK AT HOW THEY COULD WORK IN THE AIR FORCE CYBER OPERATIONS CAREER FIELD NEW TOOLS FOR A NEW TERRAIN AIR FORCE SUPPORT TO SPECIAL OPERATIONS IN THE CYBER ENVIRONMENT Learning to Mow Grass: IDF Adaptations to Hybrid Threats CHINA’S WAR BY OTHER MEANS: UNVEILING CHINA’S QUEST FOR INFORMATION DOMINANCE THE ISLAMIC STATE’S TACTICS IN SYRIA: ROLE OF SOCIAL MEDIA IN SHIFTING A PEACEFUL ARAB SPRING INTO TERRORISM NON-LETHAL WEAPONS: THE KEY TO A MORE AGGRESSIVE STRATEGY TO COMBAT TERRORISM THOUGHTS INVADE US: LEXICAL COGNITION AND CYBERSPACE The Cyber Threat to Military Just-In-Time Logistics: Risk Mitigation and the Return to Forward Basing PROSPECTS FOR THE RULE OF LAW IN CYBERSPACE Cyberwarfare and Operational Art CYBER WARFARE GOVERNANCE: EVALUATION OF CURRENT INTERNATIONAL AGREEMENTS ON THE OFFENSIVE USE OF CYBER Cyber Attacks and the Legal Justification for an Armed Response UNTYING OUR HANDS: RECONSIDERING CYBER AS A SEPARATE INSTRUMENT OF NATIONAL POWER Effects-Based Operations in the Cyber Domain Recommendations for Model-Driven Paradigms for Integrated Approaches to Cyber Defense MILLENNIAL WARFARE IGNORING A REVOLUTION IN MILITARY AFFAIRS: THE NEED TO CREATE A SEPARATE BRANCH OF THE ARMED FORCES FOR CYBER WARFARE SPECIAL OPERATIONS AND CYBER WARFARE LESSONS FROM THE FRONT: A CASE STUDY OF RUSSIAN CYBER WARFARE ADAPTING UNCONVENTIONAL WARFARE DOCTRINE TO CYBERSPACE OPERATIONS: AN EXAMINATION OF HACKTIVIST BASED INSURGENCIES Addressing Human Factors Gaps in Cyber Defense Airpower History and the Cyber Force of the Future How Organization for the Cyber Domain Outpaced Strategic Thinking and Forgot the Lessons of the Past THE COMMAND OF THE TREND: SOCIAL MEDIA AS A WEAPON IN THE INFORMATION AGE SPYING FOR THE RIGHT REASONS: CONTESTED NORMS IN CYBERSPACE AIR FORCE CYBERWORX REPORT: REMODELING AIR FORCE CYBER COMMAND & CONTROL THE CYBER WAR: MAINTAINING AND CONTROLLING THE “KEY CYBER TERRAIN” OF THE CYBERSPACE DOMAIN WHEN NORMS FAIL: NORTH KOREA AND CYBER AS AN ELEMENT OF STATECRAFT AN ANTIFRAGILE APPROACH TO PREPARING FOR CYBER CONFLICT AIR FORCE CYBER MISSION ASSURANCE SOURCES OF MISSION UNCERTAINTY Concurrency Attacks and Defenses Cyber Workforce Retention