UNCLASSIFIED 17C Cyber Operations Specialist OCC Approved as of 02 June 2015 UNCLASSIFIED UNCLASSIFIED Agenda • • • • • Purpose 17C Overview 17C Re-Classification Summary Questions 2 UNCLASSIFIED UNCLASSIFIED Purpose To Familiarize Soldiers and Leaders with the new 17C Cyber Operations Specialist MOS and provide a detailed overview of the Reclassification and Training Process 3 UNCLASSIFIED UNCLASSIFIED 17C Overview 4 UNCLASSIFIED UNCLASSIFIED 17C Overview MOS 17C: Cyber Operations Specialist Approved: 11 May 2015 Effective: 1 Oct 2015 • Cyber Operations Specialists execute Offensive and Defensive Cyberspace operations in support of the full range of military operations by enabling actions and generating effects across all domains. • The Cyber Operations Specialist ensures the freedom of maneuver within the Cyberspace domain and denies the same to adversaries. • Cyber Operations Specialists will enable Offensive Cyberspace Operations (OCO) intended to project power by the application of force in and through Cyberspace by targeting enemy and hostile adversary activities and capabilities. • Cyber Operations Specialists also enable Defensive Cyberspace Operations (DCO) in order to protect data, networks, net-centric capabilities, and other designated systems by detecting, identifying, and responding to attacks against friendly networks. 5 UNCLASSIFIED UNCLASSIFIED 17C Overview 6 UNCLASSIFIED UNCLASSIFIED 17C Overview Cyber National Mission Force (NMF) Cyber Combat Mission Force (CMF) Cyber Protection Force (CPF) Defend the Nation by Seeing adversary activity, Blocking attacks and Maneuvering to defeat them Conduct military cyber operations in support of combatant commands Defend DoD Information Networks (DODIN) and, when authorized, other infrastructure NMT x4 National Mission Team (NMT) 64 Pax each NST x3 National Support Team (NST) 39 Pax each 7 CMT x8 Combat Mission Team (CMT) 64 Pax each CST CPT x 20 Cyber Protection Team (CPT) 39 Pax each x6 Combat Support Team (CST) 39 Pax each -National -Combat -Service UNCLASSIFIED UNCLASSIFIED 17C Overview Work Roles • • • • • • • • • 8 Access Network Operator Cyber Defense Analyst Cyber Security Analyst Cyber Intelligence Planner Cyber Operations Planner Digital Network Exploitation Analyst Exploitation Analyst Interactive Operator NCOIC UNCLASSIFIED UNCLASSIFIED 17C Overview SL5 – 6 SL1 – SL4 • Digital Network Exploitation Analyst • Exploitation Analyst • Interactive Operator • Cyber Security Analyst • Cyber Defense Analyst • Access Network Operator • Cyber Intelligence Planner • Cyber Operations Planner 9 • • • • • • • • Cyber Intelligence Planner Cyber Operations Planner NCOIC First Sergeant BN CSM BDE S-3 SGM BDE CSM SGMs in Cyber CoE positions UNCLASSIFIED UNCLASSIFIED 17C Overview USMA Army Cyber Institute FT Meade CYBERCOM HQ 780th MI BDE 781st MI BN FT Belvoir JBSA 782nd MI BN, Det-T Cyber Manning Priorities FT Gordon 1. Cyber Protection BDE 2. 780th MI BDE 3. Joint Forces HQ ARCYBER HQ 1ST IO CMD Schofield Brrks ARCYBER (Future) Cyber CoE Cyber School Joint Forces HQ Cyber Protection BDE 782nd MI BN 782nd MI BN, Det-H 4. Cyber CoE 5. Army Cyber Command 6. US Cyber Command 7. Army Cyber Institute 10 UNCLASSIFIED UNCLASSIFIED 17C Overview • Assigned to the Cyber Mission Force • AIP Program Eligibility: $250/$300/$500 • SDP Eligibility: $150/$225/$300 • Training Opportunities • Promotion Opportunities • Historic Opportunity to Build the Branch 11 UNCLASSIFIED UNCLASSIFIED 17C Reclassification 12 UNCLASSIFIED UNCLASSIFIED 17C MOS Requirements MOS 17C: 611-21 Requirements • • • • • • • • PHYSICAL DEMAND RATING OF MEDIUM. PHYSICAL PROFILE OF 222221. NORMAL COLOR VISION. QUALIFYING SCORES. – A MINIMUM SCORE OF 110 IN APTITUDE AREA FOR GT AND A MINIMUM SCORE OF 116 IN APTITUDE AREA ST ON ARMED SERVICES VOCATIONAL APTITUDE BATTERY (ASVAB) TEST ADMINISTERED PRIOR TO 2 JANUARY 2002. – A MINIMUM SCORE OF 110 IN APTITUDE AREA GT AND A MINIMUM SCORE OF 113 IN APTITUDE AREA ST ON ASVAB TESTS ADMINISTERED ON AND AFTER 2 JANUARY 2002, BUT PRIOR TO 1 APRIL 2014. – A MINIMUM SCORE OF 110 IN APTITUDE AREA FOR GT AND A MINIMUM SCORE OF 112 IN APTITUDE AREA ST ON ASVAB TESTS ADMINISTERED ON AND AFTER 1 APRIL 2014. THE SOLDIER MUST MEET TOP SECRET (TS) SENSITIVE COMPARTMENTED INFORMATION (SCI) ACCESS ELIGIBILITY REQUIREMENTS TO BE AWARDED AND MAINTAIN MOS. (ONLY SECRET REQUIRED FOR APPLICATION PACKET) SOLDIER IS REQUIRED TO RECEIVE AND PASS A COUNTERINTELLIGENCE SCOPE POLYGRAPH (CSP) PRIOR TO BEING AWARDED THE MOS AND MUST CONTINUE TO PASS SUBSEQUENT CSPS TO HOLD THE MOS. SOLDIERS WHO REFUSE TO TAKE OR FAIL A CSP WILL BE RECLASSIFIED. (ONLY REQUIRED AFTER APPLICATION APPROVAL PRIOR TO FIRST DUTY STATION) FORMAL TRAINING (SUCCESSFUL COMPLETION OF 17C CYBER OPERATIONS SPECIALIST COURSE, CONDUCTED UNDER THE AUSPICES OF THE US ARMY CYBER SCHOOL) IS MANDATORY. HOWEVER, CONSTRUCTIVE CREDIT WAIVER FOR FORMAL TRAINING MAY BE GRANTED BY COMMANDANT, US ARMY CYBER SCHOOL, FORT GORDON, GA 30905-5300 THE SERVICE REMAINING REQUIREMENT (SRR) IS 3 YEARS FOR RECLASSIFICATION INTO MOS 17C UNDER THE PROVISIONS OF AR 614-200, CHAPTER 4. 13 UNCLASSIFIED UNCLASSIFIED 17C Reclassification Specifics • AT A MINIMUM, SOLDIERS SFC AND BELOW MUST POSSESS AN SECRET CLEARANCE AT TIME OF APPLICATION. AFTER RECLASSIFICATION APPROVAL SOLDIERS WILL BEGIN APPLICATION PROCESS TO RECEIVE INTERIM TOP SECRET CLEARANCE PRIOR TO ATTENDING TRAINING. SOLDIERS WILL REQUIRE A SECURITY CLEARANCE OF TOP SECRET WITH SCI ACCESS PRIOR TO BEING AWARDED THE MOS • SOLDIERS MUST HAVE NO ADVERSE INFORMATION IN THEIR OFFICIAL MILITARY PERSONNEL FILE, PROVOST MARSHALL RECORDS, OR LOCAL SECURITY OFFICE, AS WELL AS, NO DISQUALIFYING INFORMATION IN THEIR MEDICAL RECORDS THAT WOULD PREVENT THE GRANTING OF A SECURITY CLEARANCE OR MEETING PHYSICAL REQUIREMENTS TO BE AWARDED THE MOS. • THE SERVICE REMAINING REQUIREMENT (SRR) IS 3 YEARS FOR RECLASSIFICATION INTO MOS 17C UPON COMPLETION OF TRAINING UNDER THE PROVISIONS OF AR 614200, CHAPTER 4. • SOLDIER IS REQUIRED TO RECEIVE AND PASS A COUNTERINTELLIGENCE SCOPE POLYGRAPH (CSP) PRIOR TO BEING AWARDED THE MOS AND MUST CONTINUE TO PASS SUBSEQUENT CSPS TO HOLD THE MOS. SOLDIERS WHO HAVE PREVIOUSLY FAILED A CSP PRIOR TO SUBMITTING THEIR APPLICATION WILL BE DENIED RECLASSIFICATION. SOLDIERS WHO ARE APPROVED FOR RECLASSIFICATION TO 17C WILL RECEIVE A CSP DURING RECLASSIFICATION TRAINING. 14 UNCLASSIFIED UNCLASSIFIED 17C Reclassification Specifics SSG and Below Reclassification Specifics • SSG AND BELOW MUST MEET THE NCOES QUALIFICATIONS FOR PROMOTION TO THE NEXT HIGHER RANK, INCLUDING STRUCTURE SELF-DEVELOPMENT (SSD) COURSES, AND MEET THE FOLLOWING RANK AND TIME IN SERVICE (TIS) REQUIREMENT: – SPC AND BELOW WITH LESS THAN 4 YEARS TIME IN SERVICE. – SGT WITH LESS THAN 10 YEARS TIME IN SERVICE. – SSG WITH LESS THAN 15 YEARS TIME IN SERVICE. 15 UNCLASSIFIED UNCLASSIFIED 17C Reclassification Specifics SFC and MSG Reclassification Specifics • SERGEANTS FIRST CLASS (SFC) SPECIFIC QUALIFICATIONS FOR SOLDIERS REQUESTING RECLASSIFICATION INTO 17C MOS: – – • ALC GRADUATE WITH AT LEAST 9 YEARS TIS, BUT NO MORE THAN 20 YEARS TIS. SOLDIERS DO NOT NEED TO BE A SENIOR LEADER COURSE (SLC) GRADUATE BECAUSE THEY MUST ATTEND THE 17C MOS SLC AFTER GRADUATION OF THE 17C MOS PRODUCING COURSE. SOLDIERS WHO HAVE COMPLETED SLC WILL ATTEND REQUIRED CYBER MISSION FORCE FUNCTIONAL TRAINING IAW JOINT CYBERSPACE TRAINING AND CERTIFICATION STANDARDS. MASTER SERGEANTS (MSG) SPECIFIC QUALIFICATIONS FOR SOLDIERS REQUESTING RECLASSIFICATION INTO 17C MOS: – – – AT LEAST 11 YEARS TIS, BUT NO MORE THAN 24 YEARS TIS. SOLDIERS WILL ATTEND SPECIFIC CYBER MISSION FORCE FUNCTIONAL TRAINING IAW JOINT CYBERSPACE TRAINING AND CERTIFICATION STANDARDS BEFORE REPORTING TO INITIAL 17C ASSIGNMENT. AFTER COMPLETION OF THE IDENTIFIED TRAINING THEY WILL BE AWARDED A CONSTRUCTIVE CREDIT WAIVER FOR FORMAL 17C MOS TRAINING BY THE COMMANDANT, US ARMY CYBER SCHOOL, FORT GORDON, GA 30905-5300. MUST POSSESS A TOP SECRET CLEARANCE WITH SCI ACCESS AT TIME OF APPLICATION UNDER THE PROVISIONS OF AR 380-67, (PERSONNEL SECURITY PROGRAM), 24 JAN 14. 16 UNCLASSIFIED UNCLASSIFIED 17C Reclassification Specifics 17C Reclassification Packet Requirements EXAMPLE PACKET AND TEMPLATES AVAILABLE AT HTTPS://USCYBERSCHOOL.ARMY.MIL • • • • • • • • • • • • • Cyber Cover Letter DA 4187 Reclassification Request Cyber Questionnaire ERB (E6 and above with photo) DA Pam 611-21 Acknowledgement Memo DA Form 705 within 30 days DA 5500 within 30 days (If applicable) Security Clearance Verification Memo NFNA initial screening packet Last five NCOERs (SSNs blacked out) All NCOES PME DA Form 1059’s (SSNs blacked out) Certifications and Credentials verification Memo Civilian Education Transcripts 17 UNCLASSIFIED UNCLASSIFIED 17C Packet Approval Process Soldier Prepares Packet Career Counselor Submits to OCC Packet received by OCC Assigned to CMF UNIT N Soldier Notified Packet Returned to Career Counselor N Meets 17C 611-21 Criteria Y 17C Work Role Certified N Y Meets 17C 611-21 Criteria Soldier Notified Packet Returned to Career Counselor N Packet Accepted N Packet Accepted N Packet Returned to Career Counselor Y Packet Screened against ADGM Y Packet Screened against ADGM Y Soldier Notified Soldier Notified HRC Changes MOS 1 Oct 2015 Y 17C Training Screening (Cont) UNCLASSIFIED UNCLASSIFIED 17C Training Screening Process 17C Training Screening (Cont) Training Waiver Full Training Waiver Approval to Career Counselor Submit to HRC RRB HRC change MOS / issue PCS Orders Soldier Reports to CMF UNIT Partial Training Waiver Approval to Career Counselor Submit to HRC RRB HRC slots in phase 2 & issues PCS Orders Reports to 17C Phase 2 FT Gordon Soldier Notified Approval to Career Counselor Submit to HRC RRB HRC slots in training & issues PCS Orders Reports to 17C Phase 1 Corey Station Y N UNCLASSIFIED UNCLASSIFIED 17C MOS Training Overview 230-17C10 Ph1 Cyber Operations Specialist (Corry Station FL) (~24 weeks) 230-17C10 (CP) C15-185 Cyber Operations Specialist (Fort Gordon, GA) (~22 weeks) Cyber Common Technical Core (Intermediate Cyber Core equiv) Joint Cyber Analysis Course (JCAC) Joint Cyber Analysis Course (26 weeks) *CTS course, Navy executed • • • • • • • • • • • • • • • • • Introduction Discrete Structures Programming Fundamentals Computer Organization & Architecture Operating Systems Networking Concepts & Protocols Windows UNIX Programming Enterprise Level Networking Protocol Analysis Wireless Technologies Target Research/SIGINT Analysis Active Exploitation CND Forensics Methodologies & Malware Analysis Capstone Cyber Common Technical Core (8-9 weeks) A) Windows 1) Command-Line Interface 2) Windows Registry 3) Windows Boot Process 4) Forensically Relevant Registry Keys 5) Windows Resource Protection 6) Processes 7) NTFS File System 8) Auditing 9) Windows Networking 10) Windows Forensics 11) Active Directory B) Unix 1) Shells and Scripting 2) Boot Process 3) Processes, File Systems, Logging 4) Networking and Redirection 5) Survey Analysis and Risk Assessment C) Networking 1) LAN Communications 2) Inter-Network Communications 3) Transport and Helper Protocols 4) Services and Network Discovery 5) Filtering Devices 6) File Transfer, Tunneling, and Redirection 7) SSH Forward Tunnels 8) SSH Reverse Tunnels 9) Exploits through Tunnels D) Security Concepts: Exploit Meth. & Hacker Mindset 1) Exploitation Methodology 2) Threats 3) Access Methods 4) Risk Analysis 5) Understanding the Mindset CPT Methodologies (1-2 weeks) *Air Force developing Common core, tool agnostic methodologies for CPT squads: • • • • • Mission Protection Discovery/Counter-Infiltration Cyber Threat Emulation Cyber Readiness Cyber Support CPT Methodologies OCO/Analyst Course (2-4 weeks) *Under Development Proposed CBTs (Pre-reqs): • CYEC1200 – Basic Adversary Tactics • CYEC1250 – Basic Cyber Adversary Awareness • CYEC2150 – CNO at NSA • NETA1021 – Internet Technologies • NETA2002 – Orientation to Applied Digital Network Analysis • RPTG1012 – Basics of SIGINT Dissemination • TOOL2201 – Intro to PINWALE OCO Analyst Training Immersive Cyber Ops Exercise Capstone (3 weeks) *Under Development • Concept: Cyber Knight meets Cyber Ranger School • OCO vs. DCO scenarios, including team leadership, cyber planning, and operator and analyst missions Proposed Resident Lessons: • CRSK1000 – Intro to SIGINT Development • CYEC2200 – Advanced Adversary Tactics • NETA1030 – DNI Gateway • NETA2030 – Basic Metadata Queries 17C MOS training consists of two phases. The first phase is the Joint Cyber Analysis Course taught under the auspices of the U.S. Navy at Corry Station, FL. The second phase will be will be conducted at Fort Gordon, Georgia UNCLASSIFIED UNCLASSIFIED 17C Selection and Training 17C MILPER 17C NOFC FY 15 FY 16 OCT OCT NOV NOV DEC DEC JAN JAN FEB MAR FEB MAR APR APR MAY MAY JUN HRC PCS WINDOW 17C Packet Review HRC 17C Packet Review HRC 17C Packet Review HRC 17C Packet Review HRC JUL SEP JUN AUG PCS to Unit PCS to Unit 17C Phase 1 JCAC Corry Station, FL (16) 17C Phase 1 JCAC Corry Station, FL HRC PCS WINDOW JAN FEB MAR APR MAY JUN Graduates of Classes 1 thru 5 given will conduct pipeline training IAW Bridging Strategy PCS PCS to Unit PCS to Unit 17C Phase 1 HRC 17C Phase 1 JCAC Corry Station, FL (16) HRC PCS WINDOW DEC 17C Packet Review 17C Phase 1 JCAC Corry Station, FL (16) HRC PCS WINDOW NOV SEP HRC 17C Phase 1 JCAC Corry Station, FL (16) HRC PCS WINDOW OCT AUG 17C Packet Review 17C Phase 1 JCAC Corry Station, FL (16) HRC PCS WINDOW FY 17 JUL JUL AUG SEP 17C Phase 2 is not conducted until Mid Feb 2017 due to inadequate SCIF Space and course development PCS to Unit 17C Phase 1 JCAC Corry Station, FL PCS 17C Phase 2 FT Gordon (16) PCS to Unit UNCLASSIFIED UNCLASSIFIED 17C Selection Timeline • NOFC Published 11 MAY 2015 • MILPER 15-164 Published on 2 June 2015 • Packets accepted starting 1 June 2015 • Packet Screening and Approval Windows for FY16 Training seats – FY16 Packets Accepted: Jun 2105 – Aug 2015 – FY16 Packet Screening Panel: Sep 2015 • Soldier Notified and Slotted for training in ATRRS – Notification Window: 15-30 Sep 2015 – First FY16 Class for reclassification Soldiers Starts Mar 2016 22 • Soldier will report to Corey Station (PH1) and Fort Gordon (PH2) on 10th of month prior to class start date. • Course is PCS move only. (BAH PME waiver authorized) • All Reclassification Soldiers must live off post. No Barracks avail/auth UNCLASSIFIED UNCLASSIFIED Questions ? 23 UNCLASSIFIED
