Mission assurance: Shifting the focus of cyber defence

With the decision by the North Atlantic Council to recognize cyberspace as an operational domain, the NATO Command Structure is now taking on the task of implementing the doctrine, organization and capabilities to incorporate operations in cyberspace into the overall framework of joint operations. This paper outlines some of the challenges implicit in the Council's decision, which was both long-expected due to growing awareness of cyber security challenges within the Alliance and bold in its willingness to recognize what is still an immature and evolving discipline. It addresses two key challenges facing those involved in implementing cyberspace as a domain: understanding the complex composition of cyberspace and accurately identifying the consequences of the asymmetric nature of cyberspace threats. The paper then addresses two key aspects for cyberspace as a domain: mission assurance and collective defense. In the context of implementing cyberspace as an operational domain in traditional military operations and missions, cyberspace operators need to focus on mission assurance, which recognizes the reality of a contested cyberspace, and not simply on cyber security concerns. Although the military role in collective cyber defense is still a somewhat politically-charged issue, the author argues that the best way to enable effective mission assurance in cyberspace is to recognize the need for a clear role for the NATO Command Structure to act as an enabler for the open exchange of cyber defense information with military, civil and commercial organizations.