Operational Templates for State-Level Attack and Collective Defense of Countries

## Overview

Greg Conti (senior security strategist Iron Net, West Point military instructor, SIGINT background) and Bob Pinnell (US Cyber Command veteran, product development at Iron Net) presented military operational planning frameworks applied to national-scale cyberspace operations. Core thesis: cybersecurity community focuses on tactical level (kill chains, individual vulnerabilities) while state-level adversaries operate at strategic level with years-long campaigns; nation-states coordinate cyber operations with diplomatic/military/legal/economic instruments of power (DIME model) requiring defense strategy that scales above individual companies. Problem statement (Jeff Moss quote): "Our adversaries have strategies and we have tactics." Current defense model: organizations operate as individual islands, defeated in detail one-by-one (analogy: 2004 US Olympic basketball team lost to Argentina because it played as individuals not as team). Solution framework: tiered operational templates connecting tactical TTPs -> kill chains -> campaigns -> national strategies, enabling defenders to see how individual incidents fit larger offensive operations.

## Offensive Operational Templates and State-Level Attack Capabilities

**State-Level Capabilities**: Nation-states bring asymmetric advantages unavailable to commercial enterprises. Examples include: undersea cable sabotage (single cable break causes weeks repair, coordinated campaign causes years of global connectivity disruption—far exceeding botnet DDoS), satellite/spectrum control (jamming communication links, spoofing positioning systems, RF disruption), national intelligence services (collection/processing at scale surpassing commercial capability, enabling extensive insider recruitment), supply chain control (embedding kill switches/backdoors in hardware/software foundational systems), combined operations coordinating DIME instruments. Operators noted logistics: states can compel cooperation via leverage (examples: Room 641A NSA/AT&T access point, leveraging telecom providers for network manipulation).

**Operational Template Architecture**: Military doctrinal templates (e.g., Soviet motorized rifle division deployment) describe adversary's preferred method of using capabilities to achieve objectives in ideal conditions. Adapted for cyber: offensive templates organized by threat actor profiles and large-scale objectives; defensive templates tiered by current/projected maturity; hybrid templates combining defensive/offensive aspects. Each template shows lines of effort (informational operations, cyberspace operations, physical operations), major effects (high-impact, noticeable), minor effects (subtle, under-radar), three phases (preparatory/developmental/culminating). Enables drilling from national strategy down through campaigns/kill chains to individual TTPs and back up, connecting trees to forest.

**Specific Offensive Templates**: (1) Critical Infrastructure Control—accessing/controlling adversary infrastructure for deterrence/persuasion/economic advantage or physical conflict amplification; includes access-corporate-systems line with kill-chain drill-down showing TTP mapping. (2) Cyberspace Denial—large-scale availability loss hurting adversary more than perpetrator; includes preparatory DDoS testing, DNS hijacking, cloud provider targeting (high-value insider threats). (3) Influence Operations—using cyberspace capabilities as designed (not breaking them) to deliver/shape information, persuade/deceive/influence at national scale; mixes cyberspace and physical efforts to enable information delivery with credibility. (4) The Long Game—years/decades-long strategy with target never realizing conflict occurred; uses indirect approaches and deception; stays below "apathy threshold" (incremental steps avoid triggering organized response, unlike visible major actions like OPM breach or election interference).

**Staircase of Apathy Model**: Adversaries taking small incremental steps toward goals avoid organizational/political/leadership attention if changes stay below notice threshold; larger steps get noticed but carry response cost. Time horizon matters: government tactical response ~news cycle, strategic response ~election cycle; beyond that timeframe, small-step campaigns effective. Example progress: OPM hack (100-page security clearance dossiers stolen) crossed threshold temporarily; election influence crossed threshold and sustained political attention. Implication: multi-year slow campaigns (infrastructure compromise, insider placement, technology adoption) may progress without triggering defense response if well-sequenced below perception threshold.

## Defensive Templates and Collective Defense Strategy

**Maturity-Tiered Defense Model**: Current state (red/basic level)—organizations operate as individual islands, implementing CIS Top 20 basic controls without inter-organization coordination; government and private sector working separately. State-actor attack at this level results in chaos (unplugging computers, weeks-to-months downtime, first-time asking government for help). Progression through amber (moderate) to green (strong) requires: (1) government-private sector information sharing and interoperability (arrows in template), (2) collective defense groups working together (stronger orange, then green), (3) cross-sector coordination (examples: healthcare ISAC, energy sector conference).

**Hybrid Defend-Forward Template**: Augments passive defense with offensive operations (reconnaissance of attacker capabilities, disruption of active attacks, preemption of attacks before execution). Kill chain model provides breakpoints to defeat attacks; larger cycle shows opportunities via DIME instruments. Not advocating hack-back or preemptive strikes, but rather defense-grade interdiction (disrupting/delaying/diverting adversary capabilities at time/place of adversary choosing). Foundational activities (defensible networks, resilient systems, threat monitoring) remain critical; offensive effects provide deterrence and prevent capabilities use without permanent defeat of adversary.

**Collective Defense Context**: NATO model applied to cyberspace; must defend collectively because facing collective offense (state-enabled actor networks with government backing). Individuals competing at scale of armies impossible; must field teams. Training and feedback cycle: participants benefit from multi-year research integration (presentations at Black Hat, SHMOOCON, sector conferences including healthcare/energy ISACs); captured insights feed into next-generation doctrinal development.

## Strategic Implications and Operational Art Application

**Military Planning Discipline Applied**: Military operational art distinguishes tactical (engagements), operational (campaigns), strategic (national goals) levels; most security reporting operates only at tactical level (incident summaries, vulnerability details). Framework enables seeing individual incidents as shaping operations within larger campaigns within national strategies. Allows defenders to ask: "Is this incident a persistent adversary pattern or isolated event? What larger campaign might this indicate? What national strategic objective does this campaign serve?"

**Doctrinal Concepts for Cyber Conflict**: Defeating in detail—military principle of focusing force one opponent at a time, taking them down individually; current cyber landscape repeats this: individual companies defeated without coordinated response. Chess analogy: government has monopoly on offensive force (cannot conduct retaliatory strikes); private sector cannot fight wars as individuals. Theater-wide operations require synchronized responses across organizations/sectors.

**Long-Term Strategic Positioning**: State-level threats employ decades-long strategies (OPM compromise, election interference demonstrating scale/scope). Positioning includes: technology adoption (getting adversary to deploy your backdoor-laden systems), personnel placement (inserting agents in long-term career paths or recruiting/compromising existing staff), access development (hacking OPM, purchasing Grindr data, other sources of personal leverage). Culminating phase brings all DIME instruments to bear; extreme cases include kinetic operations (B-52 dropping live bombs as most powerful capability observed in exercises, framing cyber as element of broader armed conflict).

**Call to Action**: Community needs strategy above tactics; requires moving from individual company defense toward collective defense across sectors; CIS Top 20 handles basic threat actors but state-level/state-enabled actors require strategic templates and coordinated response frameworks; maturity progression from red/isolated to green/collective represents long-term organizational transformation journey.