An official website of the United States government
Here's how you know
A .mil website belongs to an official U.S. Department of Defense organization in the United States.
A lock (lock ) or https:// means you’ve safely connected to the .mil website. Share sensitive information only on official, secure websites.

The Cyber Defense Review

A Year of Cyber Professional Development

By MAJ Natalie Vanatta | January 23, 2015

The nation that will insist upon drawing a broad line of demarcation between the fighting man and the thinking man is liable to find its fighting done by fools and its thinking by cowards.

– Sir William Francis Butler, 19th-century British Lieutenant General


After more than a decade at war, the Army is not the same institution that I joined before the 9/11 terrorist attacks. Traditions that bound generations of service members together have been forgotten and institutional knowledge has vanished. The development of leaders in a fiscally constrained environment is one of the key skills that has been lost. With military budgets shrinking now, the art of developing leaders prepared to handle diverse situations seems a daunting challenge. We have relied on mobile training teams, scripted rotations in the box[1], and deployments in sustained bases to train Soldiers and Leaders to handle typical scenarios. All of which incur expenses that are no longer sustainable, while none of them truly focus on stretching leaders’ skills and capabilities to handle the unknown.

According to Army Doctrine, “leader development is the deliberate, continuous, sequential, and progressive process – founded in Army values – that grows Soldiers and Army Civilians into competent and confident leaders capable of decisive action”[2]. Leaders must be prepared to execute decisive action on today’s battlefields but also in future armed conflict situations. However, to do that – we need to train our leaders to think critically and creatively to prepare to fight and win the next battle. How? Well, a professional reading program has been a keystone of leader development for hundreds of years; it is a keystone because it works. It educates about the unknown in order to prepare ourselves to operate there.

This article discusses a leader development program that was instituted in the U.S. Army’s 509th Signal Battalion[3] using reading and critical thinking as a foundation. This program focused on educating leaders (both military and civilian) about the future of our Army. It was a grass-roots effort to revive Army traditional formats of leader development in today’s environment on a modern topic. That topic was cyber. To paraphrase a 60s hit[4], “This is the dawning of the age of Army Cyber”. We, as leaders, need to either learn about it or be left behind.



Development and broadening of the mind is a critical aspect of the true warrior’s preparation for battle.

– General James F. Amos, 35th Commandant of the Marine Corps

Cyber was the over-arching theme for our 2014 leader development program. Why was this theme picked for the program? First, the word ‘cyber’ means different things to different people. This lack of common understanding of what the word means creates a wealth of topics to discuss, analyze, and explore. For if technically minded individuals cannot agree on what cyber is, how can we expect troops on the ground to decipher the mystery of cyber? It just becomes a scary topic with no “right” answer or concrete solutions. This program attempted to de-mystify cyber. Second, cyber has many facets to explore which kept the program vibrant and non-repetitive. Many of these aspects are described later in this article. Third, cyber touches everyone – no matter the military branch or job description. From the bagger at the Commissary to the NSA analyst, we all have a part to play. The fact that this theme intrigues a multitude of people increased the diversity of those that participated.

The fourth reason that cyber was chosen as the theme for the leader development program is that cyber requires critical thinking. This is an important principle of Army leader development. Cyber in its infancy gives us the opportunity to stretch our minds and hone our thinking skills. Finally, the cyber theme was selected because it is very relevant to the operational Army. In today’s Army, everything is networked and associated with a computer-based system. It is the Achilles heel of the modern military. Commanders must understand the threats to these systems, how to protect them, and most importantly, how to train their subordinates to operate without them. They should also be aware of available cyber effects they can leverage within their battlespace and how to maximize their potential. Therefore, cyber is not just a microcosm of the Army but a mainstream concern from the foxhole to the Pentagon.

There were two components to this leader development program. The first component was the reading program. In a traditional reading program a hard-copy book is selected, chapters assigned, and discussion questions explored. Books are typically chosen if they are interesting, rich in ideas, and thought provoking. The 509th leader development program was a traditional reading program with a modern twist. Yes, a handful of hard-copy books were used, but other mediums were explored. Traditional books were supplemented with on-line articles, blogs, and videos. Not only did this approach relieve some of the stress of reading full books each month but a significant amount of quality, up-to-date information about cyber has not been traditionally published. The purpose of a reading program is to stretch participants’ minds and exercise their thinking skills. Professional reading programs are essential to self development in the kinetic warfare domain. The cyber domain is no different.

The second component of the leader development program focused on dialogue opportunities. These sessions provided an opportunity for participants to discuss various viewpoints about cyber with individuals and organizations outside our area of operations. In fact, various representatives from the military, government, industry, and partner nations were invited to participate in discussions on how cyber impacts and/or influences their environment. The schedule of speakers was developed to allow for the exploration of different perspectives about what constitutes cyber. These sessions were conducted via video-teleconferencing systems (recall the shrinking military budgets comment at the start of the article) and were patterned after a graduate level seminar series.

The leader development program met monthly, scheduled around operational needs, throughout 2014. In general, the program switched back and forth between the two components in order to keep the program fresh and the participants engaged. More importantly, the sessions were designed to build on each other enabling very complex topics to be examined. Additionally, varieties of different sources were used to provide a breadth of perspectives to the conversations. Invitations to the sessions were distributed to Signal community, Military Intelligence community, Fires community, and the Legal community across Italy. This translated into participation from 173rd Infantry Brigade Combat Team (Airborne), United States Army Africa, United States Army Garrison – Vicenza, and (of course) 509th Signal Battalion.



The problem with being too busy to read is that you learn by experience . . . i.e. the hard way. By reading, you learn through others’ experiences, generally a better way to do business, especially in our line of work where the consequences of incompetence are so final for young men. Thanks to my reading, I have never been caught flatfooted by any situation . . . It doesn’t give me all the answers, but it lights what is so often a dark path ahead.

—General James N. Mattis, USMC


Cyber was illuminated in our first session as it set the stage for the entire program. The Army Cyber Command (ARCYBER) G5/7 section[5] facilitated a discussion to create a foundation for understanding how the Army defines cyber. This was held at the SECRET level in order to reference various classified Army doctrinal manuals and publications on cyber. In fact, materials from 1st IO Command’s Executive Computer Network Operations (CNO) Planner’s course were used to help participants visualize many of the concepts. The session also covered the action arm of Army Cyber – the Cyber Mission Forces. Ultimately, this opening session enabled the participants to better understand the strategic and operational levels of cyber. Creating a shared understanding of basic terms and doctrine on cyber was essential to the success of the program.

The February session expanded the foundational knowledge of cyber by exploring how individuals attack, defend, and exploit systems and networks. “The Basics of Hacking and Penetration Testing: Ethical Hacking and Penetration Testing Made Easy” by Patrick Engebretson[6] was the reading assignment. Not only is this book on most cyber reading lists but General Alexander was also known to give a copy of this book to his fellow general officers so that they could gain an understanding of the basic tools used in the cyber domain and their ethical application. This “How-to” guide contained a multitude of examples that not only explain how our enemies operate against us but also clearly demonstrates how easily it is done. This reading sparked discussion on how to get into a hacker’s OODA (observe, orient, decide, act) loop[7], how the methodology of cyber attacks mimics the steps of the military decision making process (MDMP), and finally how the commander’s visualization in planning military operations is no different than how a hacker combines elements of art and science in his orchestrated attack. This session was able to clearly show how typical Army planning doctrine was also applicable to planning highly-technical cyber missions.

After the basics of cyber were covered, the leader development program began to branch out to the different aspects of cyber. The third session focused on the current cyber threats to the United States. This threat discussion was led by a member of the ARCYBER G2[8]. While only limited specifics could be divulged at the SECRET level, the discussion was still eye-opening and engaging. During this session, participants were introduced to the Military Intelligence perspective on cyber, giving them an opportunity to contrast it with the communications (Signal) perspective that they had been previously exposed to. They also learned about basic threat detection and classification methods within the cyber domain. Finally, actual infiltrations and cyber events on our military networks were discussed. These concepts led to a thought-provoking conversation on how to detect threats in the future, both more quickly and more accurately, and how to motivate the typical user to change their behavior in order to better defend our key terrain. This session opened many participants’ eyes to the reality of how our enemies are actively using the tools/techniques, previously discussed in the February session, against us today.

The April leader development session focused on another well-known book, “Cyber War: The Next Threat to National Security and What to do about it” by Richard Clarke[9]. This non-technical book was used to facilitate a discussion on how the United States government creates cyber policy and how the various aspects of national power can be used against adversaries in the cyber domain. This was a great introduction to the complexities of engaging the cyber domain at the strategic levels of government. The group also discussed the division of cyber-security responsibilities between various federal agencies and departments. The debate on what role an individual should be forced to take to secure their portion of cyberspace was especially engaging. The participants walked away with a renewed understanding of how actions taken within the cyber domain have ripple effects across all other domains of traditional warfare.

In June, the leader development program focused on the issue of rights – predominantly, the right of privacy within cyberspace. The discussion revolved around the idea of where to draw the line between actions taken to protect our rights and actions that just take them away. An amazing literary work of fiction was used to highlight the issue, “Little Brother” by Cory Doctorow[10]. In this book, the United States Government suspended portions of the Bill of Rights in order to protect the population from terrorism. This sparked an interesting discussion about when, as military leaders, it would be appropriate to stand up against the government as we swear our Oath of Allegiance to the Constitution, not to a political leader. Debating when that point is reached yielded a diverse set of answers from the participants. This summer session challenged participants to better understand their oaths, explore the greater good theory, and take a peek at motivations within the hacker sub-culture.

Using a group of on-line journal articles[11], in August we discussed the difficulties with planning cyber operations. On this topic, challenges existed in two flavors – educating individuals capable of planning military cyber operations and educating commanders in cyber capabilities/effects. The main issue was captured by Jason Bender in his article – “‘mouth-breathing-knuckle-draggers’ versus the ‘pocket-protector-and-horn-rimmed-glasses-wearing-geeks’”. These two stereotypical groups sometimes have great difficulty communicating with each other, which results in an inability to create a shared understanding. The group discussed how to establish a learning culture in their organizations with importance placed on self study about cyber. They also debated on the key skills and attributes that a cyber planner should have in order to be successful. Results from dialogues after this session sparked increased participation from senior-level operational planners in future professional development sessions.

The Army Cyber Center of Excellence (CCoE)[12] facilitated the next session within the leader development program. Up until this point, most of the discussions revolved around the strategic or operational aspects of cyber. Therefore, we needed to explore the Army Training and Doctrine Command (TRADOC) perspective on cyber and the new Army Cyber branch. The conversation revolved around the DOTMLPF (Doctrine, Organization, Training, Material, Leadership, Personnel, and Facilities) aspects of cyber with the greatest emphasis on the development of personnel, leaders, and doctrine. Senior warrant officers from the CCoE explained how the Cyber branch was designed and how it would be filled with qualified Soldiers. Another important discussion topic was where the differentiation between Signal, Military Intelligence, and Cyber lies for the Army. Participants left the session with a new appreciation of the complexity of beginning a new branch within the Army and how to support it in the future.

In October, the leader development program incorporated another book, “Worm: The first Digital World War” by Mark Bowden[13]. This book facilitated a discussion on war and the requirements for a conflict to become a war. The group used the writings of Clausewitz and Jomini along with Joint and Army doctrine to discuss Mr. Bowden’s claims that the Conficker Worm created a digital war. Discussion subtopics included: How do we know we are at cyber war? What is victory in this type of conflict? and When can cyber war be declared complete? Additionally, many ideas were presented on how to get civilians to have “skin in the game” with regards to cyber-security. The session ended with a great discussion on the importance of having a well-defined and accepted end state before starting a conflict –independent of domain.

The 509th leadership development program finished the 2014 series in November with a session covering the legalities of cyber. A cyber lawyer from the Army Cyber Institute (ACI) led our discussion as we explored how the Law of Armed Conflict applies to actions within the cyber domain. Special attention was paid to discussing the Tallinn Manual which interprets international law with respect to cyber operations and cyber warfare. Concepts like ‘use of force’, ‘proportional response’, and attrition were explored within the context of the cyber domain. Additionally, Title 10 and Title 50 responsibilities and legalities were explained. This winter session created a basic understanding of legal terminology and concepts that will be built on in the new year.


End State

For time and the world do not stand still. Change is the law of life and those who look only to the past and the present are certain to miss the future.

– President John F Kennedy, 35th President of the United States of America


The primary goal of this leader development program was to develop individuals’ critical and creative thinking skills using the broad topic of cyber. The secondary goal of this program was to enable individuals to have an increased understanding about cyber operations and apply that knowledge in their everyday approach to enhancing cyber security.

There were many challenges in developing this leader development program. First was the challenge of finding time in the work-day to execute the sessions. As most organizational leaders will attest, there are never enough hours in the day to complete the main mission – let alone add new things to the schedule. Gaining command approval and support for the program was essential. My conversations with unit leaders focused on the intellectual benefits their employees would receive if they participated in these hour+ sessions. Additionally, to support scheduling concerns, I scheduled the sessions six to eight weeks in advance so participants and their supervisors could plan around them. As the program progressed and participants became more interested in the topics it was easier for individuals to gain approval from supervisors ,and our numbers increased. Finally, it should be noted once more that command support was essential to making the program work. If leadership feels the program is important, then the program will be successful.

Another challenge was the development of session topics. Other than knowing I wanted to start the program covering basics (to make it accessible to all), I was unsure how to start. In the early days of planning, I reached out to the leadership of ACI and ARCYBER for ideas. BG Nakasone, then ARCYBER G3, supported the concept and provided introductions to various ARCYBER staff elements to assist. It was in these follow-on conversations and brainstorming sessions that the framework of the program was developed. With the support of ACI, ARCYBER leadership and my personal working relationships across the community, I was able to sell the various session topics to organizations/individuals to garner participation. Each session was designed to last approximately one hour. Once the concept was explained, all of the Subject Matter Experts (SME) were enthusiastic to assist and many provided ideas on future session topics to explore.

Deciding on the reading material to use in the professional development program was also a challenge. There are already a few good reading lists on the topic of cyber. As I was developing the program, I reviewed lists from the following military organizations: U.S. Strategic Command[14], U.S. Air Force Chief of Staff[15], and Joint Special Operations Command[16]. I also talked to COL Conti, director of ACI, for his recommendations[17]. Other sources include Rick Howard’s, CISO of Palo Alto Networks, Cybersecurity Cannon[18] and Intelink’s compiled cyberspace reading list[19]. I wanted the program to use a mixture of books (both fiction and non-fiction), on-line journal articles, and videos to support the various cyber topics. The worst thing that could happen to the program is for participants to get bored because every session used the same medium. Finally, not only did ACI provide ideas for reading material but they were also able to cover some of the costs of purchasing books for active participants. Fortunately the balanced mixture of materials and subject matter experts kept the sessions interesting and made for fluid transitions.

Sessions are already planned for the opening months of 2015. In January, the group will explore the legal and ethical implications of utilizing cyber tools on foreign soil. The case study will be the STUXNET virus and the participants will be playing the role of the individual that must decide whether to unleash it or not. We will analyze the virus against the Law of Armed Conflict to determine the legality of executing the mission along with the projected collateral effects of its use. Then we will discuss the ethical implications of making the decision to use the tool. This is extremely relevant in today’s environment as the President must currently decide the appropriate response to the cyber terrorists’ campaign against Sony and the movie “The Interview.” Additionally, early 2015 sessions will include examining the Coast Guard’s unique perspective on cyber, Kevin Mitnick’s hacking successes, current Chinese Cyber doctrine, and cyber crime as a threat to national security.

Based on input from participants, some future sessions will be designed to also count as continuing education credits towards required IT certifications (i.e. CompTia Security+). This will assist individuals in justifying their participation with their supervisors and provide truly quantifiable value in their professional development. Ultimately, 2014 focused mainly on the military’s perspective of cyber operations – therefore, 2015’s program will strive to include other federal agencies and their perspective on their portion of cyberspace responsibility and the challenges that they face. Some of these sessions could include participation from the Department of Homeland Security, Department of State, Federal Bureau of Investigation, and the Central Intelligence Agency.

So, did we make it to the desired end state? Was the program worth it? Absolutely. The individuals that participated grew and developed as leaders and professionals; minds were opened, thinking skills were honed, and understanding about cyber was increased. While information is out there about all the topics that we covered, participants found it more exciting and engaging when the information was presented by an individual from within the infrastructure. This led to great conversations where information was shared and knowledge gained. Being in the remote location of Italy, it is not easy to have access to programs, conferences, and courses that our stateside counter-parts may be able to attend. Therefore, this program filled a niche that has been neglected for our workforce due to our geographical limitations. For a grass-roots effort, this program was a resounding success.

In truth, it is a shame that this program has to be a grass-roots effort. Developing agile and adaptive leaders is a key mission within the Army. These competent and capable individuals are the reason that the United States Army is the best in the world. Determining ways to continue to grow proficient leaders ready for tomorrow’s battle while adhering to fiscal constraints should be every commander’s concern. This inexpensive (in terms of funding) program harnessed techniques from the past and modernized them. I believe cyber has a huge role to play in modern and future warfare. We need to educate leaders at all levels across the force about cyber. The Army recognizes the importance of developing cyber capabilities – the Army leadership should also remember that our strongest capability is our people. Through programs like this we can create a better trained cyber force, more agile cyber personnel, and leverage new relationships between diverse organizations to more effectively operate within and defend our cyberspace. 



[1] Units (Brigade size and larger) transport personnel (~4,000-~10,000 individuals) and equipment (~400-450 railcars) to the Mojave Desert for a 28-day rotation to conduct live fire attack and defense against a scripted enemy. These scripted scenarios are typically based on their upcoming deployment mission.

[2] U.S. Army Publishing Directorate, “Army Regulation 350-1: Army Training and Leader Development”, August 19, 2014.

[3] 509th Signal Battalion is located in Vicenza, Italy.

[4] The Fifth Dimension, The Age of Aquarius, Soul City Records, 1969.

[5] The G5/7 section is responsible for long-term planning, policy development, and coordination with outside agencies.

[6] Patrick Engbretson, The Basics of Hacking and Penetration Testing: Ethical Hacking and Penetration Testing Made Easy, (New York: Syngress, 2013).

[7] The OODA loop was developed by U.S. Air Force pilot COL John Boyd based on his experiences in the Korean War. More information can be found in the John Boyd Compendium, provided by the Project on Government Oversight at

[8] The G2 section is responsible for conducting analysis and planning to tailor intelligence capabilities to support the mission.

[9] Richard A. Clarke and Robert Knake, Cyber War: The Next Threat to National Security and What to Do About It, (New York: Ecco, 2010).

[10] Cory Doctorow, Little Brother, (New York: Tor, 2008).

[11] Matthew Miller, Jon Brickey, and Gregory Conti, “Why Your Intuition About Cyber Warfare is Probably Wrong”, Small Wars Journal, 2012. Jason Bender, “The Cyberspace Operations Planner”, Small Wars Journal, November 5, 2013. Scott Applegate, “The Principle of Maneuver in Cyber Operations”, (paper presented at the 4th International Conference on Cyber Conflict, Estonia, 2012).

[12] The Cyber CoE is the U.S. Army’s force modernization proponent for Cyberspace Operations, Signal/ Communications Networks and Information Services, and Electronic Warfare (EW) and is responsible for developing related DOTMLPF solutions. (

[13]Mark Bowden, Worm: The First Digital World War , (New York: Atlantic Monthly Press, 2011).




[17] Gregory Conti, et al, “Self-Development for Cyber Warriors”, Small Wars Journal, November 10, 2011.


[19] only for Federal personnel as it is CAC-protected

US Army Comments Policy
If you wish to comment, use the text box below. Army reserves the right to modify this policy at any time.

This is a moderated forum. That means all comments will be reviewed before posting. In addition, we expect that participants will treat each other, as well as our agency and our employees, with respect. We will not post comments that contain abusive or vulgar language, spam, hate speech, personal attacks, violate EEO policy, are offensive to other or similar content. We will not post comments that are spam, are clearly "off topic", promote services or products, infringe copyright protected material, or contain any links that don't contribute to the discussion. Comments that make unsupported accusations will also not be posted. The Army and the Army alone will make a determination as to which comments will be posted. Any references to commercial entities, products, services, or other non-governmental organizations or individuals that remain on the site are provided solely for the information of individuals using this page. These references are not intended to reflect the opinion of the Army, DoD, the United States, or its officers or employees concerning the significance, priority, or importance to be given the referenced entity, product, service, or organization. Such references are not an official or personal endorsement of any product, person, or service, and may not be quoted or reproduced for the purpose of stating or implying Army endorsement or approval of any product, person, or service.

Any comments that report criminal activity including: suicidal behaviour or sexual assault will be reported to appropriate authorities including OSI. This forum is not:

  • This forum is not to be used to report criminal activity. If you have information for law enforcement, please contact OSI or your local police agency.
  • Do not submit unsolicited proposals, or other business ideas or inquiries to this forum. This site is not to be used for contracting or commercial business.
  • This forum may not be used for the submission of any claim, demand, informal or formal complaint, or any other form of legal and/or administrative notice or process, or for the exhaustion of any legal and/or administrative remedy.

Army does not guarantee or warrant that any information posted by individuals on this forum is correct, and disclaims any liability for any loss or damage resulting from reliance on any such information. Army may not be able to verify, does not warrant or guarantee, and assumes no liability for anything posted on this website by any other person. Army does not endorse, support or otherwise promote any private or commercial entity or the information, products or services contained on those websites that may be reached through links on our website.

Members of the media are asked to send questions to the public affairs through their normal channels and to refrain from submitting questions here as comments. Reporter questions will not be posted. We recognize that the Web is a 24/7 medium, and your comments are welcome at any time. However, given the need to manage federal resources, moderating and posting of comments will occur during regular business hours Monday through Friday. Comments submitted after hours or on weekends will be read and posted as early as possible; in most cases, this means the next business day.

For the benefit of robust discussion, we ask that comments remain "on-topic." This means that comments will be posted only as it relates to the topic that is being discussed within the blog post. The views expressed on the site by non-federal commentators do not necessarily reflect the official views of the Army or the Federal Government.

To protect your own privacy and the privacy of others, please do not include personally identifiable information, such as name, Social Security number, DoD ID number, OSI Case number, phone numbers or email addresses in the body of your comment. If you do voluntarily include personally identifiable information in your comment, such as your name, that comment may or may not be posted on the page. If your comment is posted, your name will not be redacted or removed. In no circumstances will comments be posted that contain Social Security numbers, DoD ID numbers, OSI case numbers, addresses, email address or phone numbers. The default for the posting of comments is "anonymous", but if you opt not to, any information, including your login name, may be displayed on our site.

Thank you for taking the time to read this comment policy. We encourage your participation in our discussion and look forward to an active exchange of ideas.