Defining the workforce and training array for the cyber risk management and cyber resilience methodology of an army

Abstract

As ‘middle-power countries’ mature National Cyber Security policies and practices, many have identified a requirement for a military option for governments to either assist or lead cybersecurity responses. For a military force, this could place their operating methodology in a diarchy; the first being the protection and resilience of internal capability networks, the second having the capability to integrate into external networks, including critical infrastructure to defend national interests. Gaining this ability as an Army is not simply a role for the cyber specialist. For this to occur, organisational cyber resilience responses and cyber risk management practices must be established well before a cyber-incident. To meet such a national strategy, an Army must design, educate and train those forces that will undertake these roles both internally and externally to the organisation. Compared to civil industries, this could be akin to being a cybersecurity consumer and a cybersecurity service provider simultaneously; both requiring different business operating models ranging from Human-in-the-Loop (HITL) to Industrial Control System (IDS) security operations against a broad and varying threat array. This paper outlines research to define the nature of Cyber Risk Management and Cyber-Resilience for a Middle-Power Army, noting its likely internal and external requirements. It discusses those intrinsic attributes required for Cyber Risk Management and Cyber Resilience to inform workforce design and training. Finally, this paper proposes a workforce and skilling array design that is required to meet the various methodologies throughout Cyber Risk Management and Cyber-Resilience life-cycles for further experimentation.