兰德-建设最好的攻防型网络员工队伍（英）-2021.9-138正式版

ResearchReportC

O

R

P

O

R

A

T

I

O

NCHAITRAM.HARDISON,JULIAWHITAKER,DANIELLEBEAN,IVICAPAVISIC,JENNAW.KRAMER,BRANDONCROSBY,LESLIEADRIENNEPAYNE,RYANHABERMANBuildingtheBestOffensiveandDefensiveCyberWorkforceVolumeI,ImprovingU.S.AirForceTrainingandDevelopmentFormoreinformationonthispublication,visit/t/RRA1056-1.AboutRANDTheRANDCorporationisaresearchorganizationthatdevelopssolutionstopublicpolicychallengestohelpmakecommunitiesthroughouttheworldsaferandmoresecure,healthierandmoreprosperous.RANDisnonprofit,nonpartisan,andcommittedtothepublicinterest.TolearnmoreaboutRAND,visit.ResearchIntegrityOurmissiontohelpimprovepolicyanddecisionmakingthroughresearchandanalysisisenabledthroughourcorevaluesofqualityandobjectivityandourunwaveringcommitmenttothehighestlevelofintegrityandethicalbehavior.Tohelpensureourresearchandanalysisarerigorous,objective,andnonpartisan,wesubjectourresearchpublicationstoarobustandexactingquality-assuranceprocess;avoidboththeappearanceandrealityoffinancialandotherconflictsofinterestthroughstafftraining,projectscreening,andapolicyofmandatorydisclosure;andpursuetransparencyinourresearchengagementsthroughourcommitmenttotheopenpublicationofourresearchfindingsandrecommendations,disclosureofthesourceoffundingofpublishedresearch,andpoliciestoensureintellectualindependence.Formoreinformation,visit/about/principles.RAND’spublicationsdonotnecessarilyreflecttheopinionsofitsresearchclientsandsponsors.PublishedbytheRANDCorporation,SantaMonica,Calif.©2021RANDCorporationisaregisteredtrademark.LibraryofCongressCataloging-in-PublicationDataisavailableforthispublication.ISBN:978-1-9774-0785-6Cover:StaffSgtDevinBoyer/AirForce.LimitedPrintandElectronicDistributionRightsThisdocumentandtrademark(s)containedhereinareprotectedbylaw.ThisrepresentationofRANDintellectualpropertyisprovidedfornoncommercialuseonly.Unauthorizedpostingofthispublicationonlineisprohibited.Permissionisgiventoduplicatethisdocumentforpersonaluseonly,aslongasitisunalteredandcomplete.PermissionisrequiredfromRANDtoreproduce,orreuseinanotherform,anyofitsresearchdocumentsforcommercialuse.Forinformationonreprintandlinkingpermissions,pleasevisit/pubs/permissions.AboutThisReportTheU.S.military’ssuccessincyberwarfarehingesinpartonthecapabilitiesofthecyberpersonnelthatthemilitarybringstothefight.GiventhatcyberwarfareisconsideredacoreelementoftheU.S.AirForce(USAF)missionandacorecapabilitythatUSAFprovidestocombatantcommanders,USAFneedstoensurethatitspersonnelaretrainedanddevelopedinawaythatbestsuitsthecybermission.Withthisinmind,USAFhasbeenlookingforwaystorevampandimprovethetraininganddevelopmentofitsoffensiveanddefensivecyberwarfareworkforcetodevelopthebestfightingforcepossible.USAFisalsocognizantoftheimportanceofrecruitingandretentioninrealizingthefullpotentialofanytraininganddevelopmenteffortsandhassoughttobetterunderstandsomeofthedriversofattractiontoandretentioninthecyberfield.Thisreport,thefirstoftwovolumes,summarizesRANDProjectAIRFORCE’sworkexploringtheviewsoftheenlistedandcivilianworkforceonthesetopics.OurstudybuildsuponsimilarrecentRANDCorporationworkfocusedonunderstandingtheviewsoftheofficercyberworkforce(seeHardisonetal.,2019).TheresultsfromthisstudywillinformpolicymakerdecisionsaboutchangestoUSAFoffensiveanddefensivecybertraininganddevelopmentefforts,aswellasUSAFeffortstorecruitandretainthebestpersonnelforthejob.Inthisvolume,wepresentourfindingsontraininganddevelopment;inVolumeII,wepresentourfindingsonrecruitingandretention(Hardisonetal.,2021).Someofthematerialpresentedinthisvolume—suchastheimpetusforourresearchandouroverallapproach—isrepeatedinHardisonetal.,2021.Thisreportshouldinterestcybercommunityleadership,USAFandU.S.DepartmentofDefenseleadersconcernedwiththemanagementofthecyberworkforceandtheeffectivenessofthecyberwarfaremissionmorebroadly,andUSAFandU.S.DepartmentofDefenseseniorleadersresponsibleformanagingUSAFcareerfields.TheresearchreportedherewascommissionedbytheSecretaryoftheAirForce,OfficeoftheAssistantDeputyChiefInformationOfficerforDigitalTransformationandAssistantDeputyChiefofStaffforCyberEffectsOperations,andconductedwithintheWorkforce,Development,andHealthProgramofRANDProjectAIRFORCEaspartofafiscalyear2019project,BuildingandRetainingaMilitaryCyberForce.RANDProjectAIRFORCERANDProjectAIRFORCE(PAF),adivisionoftheRANDCorporation,istheDepartmentoftheAirForce’s(DAF’s)federallyfundedresearchanddevelopmentcenterforstudiesandanalyses,supportingboththeUnitedStatesAirForceandtheUnitedStatesSpaceForce.PAFprovidestheDAFwithindependentanalysesofpolicyalternativesaffectingthedevelopment,iiiemployment,combatreadiness,andsupportofcurrentandfutureair,space,andcyberforces.Researchisconductedinfourprograms:StrategyandDoctrine;ForceModernizationandEmployment;Workforce,Development,andHealth;andResourceManagement.TheresearchreportedherewaspreparedundercontractFA7014-16-D-1000.AdditionalinformationaboutPAFisavailableonourwebsite:/paf/ThisreportdocumentsworkoriginallysharedwiththeDAFonSeptember26,2019.Thedraftreport,issuedonSeptember30,2019,wasreviewedbyformalpeerreviewersandDAFsubject-matterexperts.ivContentsAboutThisReportiiiFiguresviiTablesixSummaryxAcknowledgmentsxiiAbbreviationsxiii1.Introduction1WhyTrainingandDevelopmentChangesAreNeeded2GoalsofThisStudy3OurStudyApproach3OrganizationofThisReport112.ParticipantsReportthatTrainingNeedstoChange12MostFrequentlyDiscussedIssueswithTraining173.TrainingContentandMethods21TrainingIsInapplicableorIrrelevant22ThereIsaLackoforPoorQualityofOtherResources25TrainingDoesNotCapturethe“Why”30ThereIsaLackofSimulationsandHands-OnPractice31CurrentInstructionalMethodsAreIneffective37TrainingShouldBeTargetedtotheSpecializedSkillSetsNeededforEachMission40OffensiveCyberOperationsandDefensiveCyberOperationsShouldBeTaughttoEveryone414.TimelyAccesstoTrainingandtheCurrencyofTrainingResources43TimingofandAccesstoNeededTrainingPresentChallenges44TrainingandResourcesAreNotKeepingPacewithCyber515.AppropriatenessandLengthoftheTrainingPipeline55TheLengthofTrainingortheTrainingPipelineIsNotAppropriate,andTrainingIsRedundant56SkillsAtrophyAfterInitialTraining58TheBreadthofCurrentTrainingIsaProblem60TrainingRequirementsIgnoreAirmen’sCurrentSkillBackgrounds601B4BeingaCross-Train-OnlyCareerFieldPresentsChallenges61TheDevelopmentPathIsAmbiguous63SomeParticipantsSuggestedthatTrainingShouldBeStructuredDifferentlyOverall636.TrainingOwnershipandUtilizationofPersonnel65TrainingOwnership65UtilizationofPersonnel707.OtherSuggestionsforImprovement74ImplementAptitudeTestingtoHelpwithScreening74vParticipantsComparedUSAFMethodswithThoseoftheNationalSecurityAgencyandtheOtherServices76ParticipantsDiscussedKSAOsNeededPriortoEnteringTraining78ParticipantsOfferedOtherSuggestionsforImprovement808.RecommendedNextSteps83ResourceChanges84StructuralandCulturalChanges88AppendixA.AdditionalInformationAbouttheFocusGroupsandtheQuestionnaire92AppendixB.QuestionnaireWrite-InResponsesAboutWaystoImproveTraining95AppendixC.OtherCommentsfromtheFocusGroupDiscussionsandtheQuestionnaire100AppendixD.FocusGroupResults,bySpecialty105AppendixE.InsightsfromCyberTrainingStakeholdersandSubject-MatterExperts111AppendixF.ExamplesofHowTrainingDoesNotAdequatelyPreparePersonnelforTheirUnitAssignments117AppendixG.1B4and1N4ATrainingCourses,TheirOwners,andTheirLocationsintheTrainingPipeline120References122viFiguresFigureS.1.SummaryofTrainingIssuesRaisedbyParticipantsDuringFocusGroupDiscussionsxiFigure1.1.NumberofFocusGroups,byBase,WorkRole,andSpecialty7Figure2.1.PercentageofFocusGroupsCommentingAboutKSAOTrainingGaps13Figure2.2.AverageResponsestoQuestionnaireItemsonTrainingGaps14Figure2.3.AverageResponsestoQuestionsAboutJobPerformance15Figure2.4.AverageResponsestoQuestionsAboutCyberTraining16Figure2.5.AverageResponsestoQuestionsAbouttheQualityandContentofCyberTraining17Figure2.6.ViewsonWhatNeedstoBeImprovedinTraining18Figure2.7.CyberWorkforce’sSuggestedTrainingSolutionsandChanges20Figure3.1.WhatNeedstoBeImprovedinTraining:TrainingContentandMethods21Figure3.2.Workforce’sSuggestedTrainingSolutionsandChanges:TrainingContentandMethodsandInstructors22Figure3.3.AverageResponsestoQuestionsAboutSpecificTrainingFeatures27Figure4.1.WhatNeedstoBeImprovedinTraining:Timing,Access,andResources43Figure4.2.SatisfactionwithTrainingOpportunities44Figure5.1.WhatNeedstoBeImprovedinTraining:AppropriatenessandLengthofTrainingPipeline55Figure5.2.Workforce’sSuggestedTrainingSolutionsandChanges:TrainingStructure55Figure6.1.WhatNeedstoBeImprovedinTraining:TrainingOwnershipandUtilizationofPersonnel65Figure6.2.Workforce’sSuggestedTrainingSolutionsandChanges:TrainingOwnership65Figure6.3.AverageResponsestoQuestionsAboutUtilizationofTalent71Figure7.1.Workforce’sSuggestedTrainingSolutionsandChanges:BetterApplicantandInstructorScreeningandModelingtheOtherServices74Figure7.2.ViewsonKSAOsNeededPriortoEnteringtheCyberTrainingPipeline79FigureC.1.ViewsonWashoutRates101FigureC.2.ViewsonSpecificGoalsforandApproachestoTraining102FigureD.1.CommentsAboutTrainingGaps,bySpecialty106FigureD.2.ViewsonWhatNeedstoBeImprovedinTraining,bySpecialty107FigureD.3.Workforce’sSuggestedTrainingSolutionsandChanges,bySpecialty108FigureD.4.ViewsonKSAOsNeededPriortoEnteringtheTrainingPipeline,bySpecialty...109FigureD.5.OtherCommentsCaptured,UnrelatedtoRecruitment,Retention,orTraining,bySpecialty109viiFigureD.6.ViewsonWashoutRates,bySpecialty110FigureD.7.ViewsonSpecificGoalsforandApproachestoTraining,bySpecialty110viiiTablesTableS.1.RecommendationsxTable1.1.DistributionofPersonnelinthe1N4Aand1B4CareerFields5Table1.2.TotalNumberofFocusGroupParticipants8TableA.1.NumberofParticipantsWhoRespondedtotheQuestionnaire94TableB.1.Open-EndedQuestionResults:HowWouldYouImproveTraining?95TableB.2.Open-EndedQuestionResults:ProvideAdditionalCommentsHere99TableE.1.U.S.AirForceCyberSubject-MatterExpertInterviewees111TableG.1.1B4and1N4ATrainingCourses120ixSummaryIssueTheU.S.AirForce(USAF)hasbeenlookingforwaystorevampandimprovethetraininganddevelopmentofitscyberwarfareworkforcetodevelopthebestfightingforcepossible.Aspartofthiseffort,USAFexpressedinterestinbetterunderstandingtheperspectivesoftheworkforce,whoseinsightscouldinformfurtherstepstoimprovetraining.PriorRANDworkexploredtheseissuesamongofficers;thisreportfocusesontheenlistedandciviliancyberworkforces.ApproachWeconducted30focusgroupsandinterviewstocollectviewpointsofenlistedandciviliancyberpersonnelinoffensiveanddefensivecyberoperations—specifically,thecyberwarfareoperations(1B4)specialty,digitalnetworkanalyst(1N4A)specialty,andciviliansoperatingaspartofthecybermissionforce.Wealsotalkedtoleadershipatthebaseswevisitedandsubject-matterexpertsincyberworkforcetraininganddevelopment.FigureS.1showsparticipants’viewpoints.Conclusions•

Membersofthecyberworkforceandsubject-matterexpertsacknowledgedthatthereisroomforimprovementintraining,and,accordingtosome,majorimprovementsareneeded.•

Farmoreflexibilityisneededinhowcybertrainingisstructuredanddeliveredtoensurecurrencyandtotailortrainingtotheneedsoftheworkforce.RecommendationsWegroupedourrecommendationsintotwocategories,showninTableS.1.TableS.1.RecommendationsResourceChangesStructuralandCulturalChangesWouldrequireadditionalhumanormonetaryresourcesorshiftingaroundofcurrentresourcesMayrequireresourcechangesbutalsorequirestructuralorculturalchanges••Developandproliferatemoretrainingsimulationsandranges.Findnewwaystotestcybercapabilitiesusingliveredforces,butdososelectively.•Redesigntrainingtobeflexibleandresponsivetojust-in-timeneedsandtailoredtoairmen’sexistingcapabilities.xResourceChangesStructuralandCulturalChanges••Institutecyberaptitudescreening.Createanonlineforumforlearning,information-sharing,andtalentmanagement.Providemorestructureandoversightoftrainingsdevelopedbyindividualunits.••Createseniortechnicalrolesthatarenotmanagementoriented.BettereducatetheentireAirForceaboutwhatthecyberworkforcedoesandhowthatworkfitsintothebiggerUSAFmission.••Hireandretainexperiencedinstructors.NOTE:LiveredforcesreferstoliveexercisesthatallowUSAFpersonneltopracticeengagingenemyforcesbyfightingagainsteachother.Thepersonnelengagingtheenemyareblueforces;enemyforcesareredforces.FigureS.1.SummaryofTrainingIssuesRaisedbyParticipantsDuringFocusGroupDiscussionsxiAcknowledgmentsWewouldliketoacknowledgeseveralpeoplewhocontributedtothiswork.First,wethankMajGenKevinKennedy,AssistantDeputyChiefInformationOfficerforDigitalTransformationandAssistantDeputyChiefofStaffforCyberEffectsOperations,forhisguidanceandinputoverthecourseoftheproject.Wethankourstudypointofcontact,ColBobbyThompson,forhisinsightsandassistanceindevelopingandscopingthework.WealsothankDanielleVannandLtColMaryKingfromoursponsor’sofficefortheirassistanceinidentifyingandcontactingthevarioustrainingsubject-matterexperts(SMEs)whoparticipatedinourstudy.WearegratefultoseveralkeyindividualsattheRANDCorporationwhocontributedtothestudy.SarahSoliman,anintegralmemberoftheteam,contributedideasoverthecourseoftheproject,ledfocusgroupsatoneofthemilitarybases,andparticipatedinseveraloftheSMEdiscussions.ColKatrina(KT)Terry,whoalsoservedasanimportantmemberoftheteam,assistedintheprojectduringheryearservingasanAirForceFellowatRANDbyparticipatinginteammeetingsandofferingfeedbackonthequestionnaireitems,thefocusgroupdiscussionquestions,theSMEsandbasesbeingtargeted,andotheraspectsoftheoverallstudydesignandscope.Inaddition,wethankourpeerreviewers,CaolionnO’Connell,JeffreyKendall,andMariaLytell.Lastly,andmostimportantly,thisstudywouldnothavebeenpossiblewithouttheassistancefromourbasepointsofcontactandtheparticipantsthemselves.Ourbasepointsofcontactgraciouslygavetheirtimetoplanoutandcoordinatethevisits,scheduledconferenceroomsforustoholdourdiscussions,reachedouttomembersoftheworkforcetoletthemknowaboutthefocusgroupsandtoencourageparticipation,andcheckedinonandescortedusasneededthroughoutourvisits.Itisbecauseofthemthatourvisitsweresuccessful.Wearealsogratefultoallofthepeoplewhovolunteeredtoparticipateinourstudy(SMEsandworkforcemembersalike)andtooktimeoutoftheirbusyschedulestosharetheirviewsontheworkforce’strainingchallenges.xiiAbbreviationsACCAirCombatCommandAETCAF/A1AFBAirEducationandTrainingCommandDeputyChiefofStaffforManpower,PersonnelandServicesAirForceBaseAFOQTAFSAirForceOfficerQualifyingTestAirForcespecialtyAFSCASVABCBTAirForceSpecialtyCodeArmedServicesVocationalAptitudeBatterycomputer-basedtrainingCMFCNOQCCTcybermissionforceComputerNetworkOperationsQualificationCoursecybertestCTAGCWOCYBERCOMDCOCryptologicTrainingAdvisoryGroupcyberwarfareoperationsU.S.CyberCommanddefensivecyberoperationsU.S.DepartmentofDefenseDepartmentofDefenseInformationNetworkexploitationanalystDoDDoDINEAFTUformaltrainingunitFYfiscalyearINWTIQTIntermediateNetworkWarfareTraininginitialqualificationtraininginitialskillstrainingISTITinformationtechnologyxiiiJBSAJCACKSAJointBaseSanAntonioJointCyberAnalysisCourseknowledge,skills,andabilitiesknowledge,skills,abilities,andothercharacteristicsmajorcommandKSAOMAJCOMNSANationalSecurityAgencyoffensivecyberoperationspermanentchangeofstationRemoteInteractiveOperatorTrainingsubject-matterexpertOCOPCSRIOTSMESNCOTAPASTDYseniornoncommissionedofficerTailoredAdaptivePersonalityAssessmenttemporarydutyUCTundergraduatecybertrainingU.S.AirForceUSAFxiv1.IntroductionTheU.S.military’ssuccessincyberwarfarehingesinpartonthecapabilitiesofthecyberpersonnelthattheU.S.militarybringstothefight.GiventhatcyberwarfareisconsideredacoreelementoftheU.S.AirForce(USAF)missionandacorecapabilitythatUSAFprovidestocombatantcommanders,USAFneedstoensurethatitspersonnelaretrainedanddevelopedinawaythatbestsuitsthecybermission.Withthisinmind,USAFhasbeenlookingforwaystorevampandimprovethetraininganddevelopmentofitsoffensiveanddefensivecyberwarfareworkforcetodevelopthebestfightingforcepossible.USAFisalsocognizantoftheimportanceofrecruitingandretentioninrealizingthefullpotentialofanytraininganddevelopmenteffortsandhassoughttobetterunderstandsomeofthedriversofattractiontoandretentioninthecyberfield.1Thisreport,thefirstoftwovolumes,summarizesRANDProjectAIRFORCE’sworkexploringtheviewsoftheenlistedandcivilianworkforceonthesetopics.PriorRANDCorporationresearchexploredtheseissuesamongofficers(seeHardisonetal.,2019).2TheresultsofourstudyareintendedtoinformpolicymakerdecisionsaboutchangestoUSAFoffensiveanddefensivecybertraininganddevelopmentefforts,aswellasUSAFeffortstorecruitandretainthebestpersonnelforthejob.Inthisvolume,wepresentourfindingsontraininganddevelopment;inVolumeII,wepresentourresultsonrecruitingandretention.1ThissectionalsoappearsinHardisonetal.,2021.2Notethatthecyberworkforcecommunityencompassesamuchlargersetofpersonnelthanjustthoseexploredinthisstudy.WithinUSAF,thecyberworkforceincludesadditionalenlistedcareerfields,suchasthe3DXs(thecyberspacesupportcareerfields),officers,othermembersofthecivilianworkforce,andUSAFreserveandguardpersonnel.Unfortunately,becauseofresourceconstraints,wewereunabletoexplorealloftheseworkforcesinthisstudy.Instead,tofitwithinourstudybudget,thesponsorscopedthisefforttofocusjustonactive-duty1N4As(digitalnetworkanalysts)and1B4s(cyberwarfareoperationspersonnel).However,thesponsoralsoacknowledgedthattherewasinterestinexploringtheseissuesinthereserveandguardcommunitiesandintheotherenlistedcareerfields(suchasthe3DXs)andthattherewouldbebenefitsindoingso.Inaddition,aviewoftheseissueswiththetotalforceinmindmightprovidedifferentinsightsandsolutions.Forexample,theabilityforreservistsandguardsmentoworkintheprivate-sectorcyberfield,attainadditionalcertifications,andstaytechnicallycurrentwhilestillhavingtheopportunitytoengageinmilitaryoffensivecyberoperations(OCO)–typeworkmightbeespeciallyattractiveforsomepersonnel.Lastly,itisworthnotingthatthestudywasscopedtofocusonlyontrainingandrecruitingissuesinUSAFbutmuchofthecyberworkandtrainingbeingconductedexistinajointenvironment,andmanyoftheissuesmightbesharedacrosstheservices.Therefore,ajointviewoftheseissuescouldbeworthwhile.AlthoughweapproachenlistedcyberworkforceissuesinthisreportfromaUSAFperspectiveonly,theseissuesareinfactU.S.DepartmentofDefense(DoD)–widechallenges.Giventhejoint,interagency,allied,andcoalitionoperatingenvironmentsthatdependoncyberasacrosscuttingdomain,thisforce-wideviewmightbeespeciallyimportantinunderstandingcyberworkforceissues.1WhyTrainingandDevelopmentChangesAreNeededUSAFinterestinrevampingtrainingandattentiontorecruitmentandretentionisaresponseinparttorecognitionwithinandoutsideUSAFthatchangesareneededinhowthecyberworkforceismanagedanddeveloped.Theneedforchangehasbeenhighlightedinseveralrecentstudies(see,forexample,Chiaramonte,Howe,andCollins,2016;Hardisonetal.,2019;andU.S.GovernmentAccountabilityOffice,2019).However,inthepast,complexitiesinthedevelopmentofthecyberworkforcehavepresentedchallengestoachievingthisgoal,andsomeofthesechallengesarelikelytocontinuetovaryingextents,atleastinthenearfuture.Onechallengeisthatthecyberlandscapehasexperiencedprofoundgrowthandsubstantivechangesinsophisticationandcomplexityinrecentyears.Asaresult,theuseofcyberonthebattlefieldandtheassociateddemandsforskilledpersonnelhavealsochangedrapidly.USAFhascontinuedtoexplorehowbesttomanagethisnewandevolvingcyberenterpriseanditscorrespondingworkforce,andtheneedtorevisitworkforcetraininganddevelopmentisonepieceofthisevolution.Asecondcomplicatingfactorinvolvesthemanycareerfieldsthatmakeuptheenlistedandciviliancyberworkforces(includingnineseparateAirForcespecialties[AFSs]forenlistedpersonnel,aswellasengineering,intelligenceanalysis,computerscience,andmoreonthecivilianside).Inaddition,severaltypesofcyberworkarebeingperformedinUSAF,eachwithitsownrequirementsfortechnicalexpertise.Athirdcomplicatingfactoristhevarietyofkeystakeholders(i.e.,AirUniversity,24thAirForce,AirForceInstituteofTechnology,SecretaryoftheAirForce/ChiefInformationOfficer,AirEducationandTrainingCommand[AETC],AirCombatCommand[ACC],squadroncommanders,DeputyChiefofStaffforManpower,PersonnelandServices[AF/A1],andothers3),eachofwhomlikelyhasuniqueandimportantinsightsintotrainingandthechangesthatareneeded.Understandingthedifferencesacrossstakeholderperspectiveswillbecriticalinensuringthatanypolicychangesareaddressingthatfullvarietyofneeds.Afourthcomplicatingfactorisachangethatisunderwayinhowcyberworkwillbemanaged;personnelarebeingshiftedtocybermissionforce(CMF)andmissiondefenseteamconstructs.4Thisincludesmovingawayfromtraditionalcommunicationsquadrons(i.e.,3ThisincludesstakeholdersoutsideUSAF,includingU.S.CyberCommand(CYBERCOM)andtheNationalSecurityAgency(NSA).4TheCMFconsistsof133teamsservingDoD’scybermission.TheseteamsareorganizationallypartofCYBERCOMandincludeCyberNationalMissionForceteamsthat“defendthenationbyseeingadversaryactivity,blockingattacks,andmaneuveringincyberspacetodefeatthem,”CyberCombatMissionForceteamsthat“conductmilitarycyberoperationsinsupportofcombatantcommands,”CyberProtectionForceteamsthat“defendtheDODinformationnetworks,protectprioritymissions,andpreparecyberforcesforcombat,”andCyberSupportTeamsthat“provideanalyticandplanningsupporttoNationalMissionandCombatMissionteams”(Theohary,2018,p.1).MissiondefenseteamsareteamswithinUSAFthatprovide“activedefenseatthebaselevel”and“protectkeycyberterrainatwingandbelowinordertodelivercyber-basedmissionassuranceforunit’sassignedmissionsandweaponsystems”(Weggeman,2018,p.7).2squadronsfocusedontraditionalinformationtechnologyservicesandbuildingandmaintainingtheDoDInformationNetwork[DoDIN])5andmovingtowardcyberoperationssquadrons(i.e.,squadronsfocusedonoffensiveanddefensivecybermissions).Thesechangeswilloccurslowlyoverseveralyears,andhowtrainingneedsmightchangewhilethetransitionisongoingandoncethetransitioniscompleteisnotwellunderstood.GoalsofThisStudyMajGenKevinKennedy(AssistantDeputyChiefInformationOfficerforDigitalTransformationandAssistantDeputyChiefofStaffforCyberEffectsOperations)andhisstaffhavealreadyidentifiedmanyideasforchangestotraininganddevelopmentthatmightbebeneficialforimprovingthecyberworkforce,manyofwhichareinprogress.However,GeneralKennedyhasalsonotedthatadditionalinsightsfromtheworkforceinthefieldmightbeespeciallyusefulinhelpingshapeandinformadditionalchangestotrainingastheygoforward.HeturnedtoRANDProjectAIRFORCEforassistanceingatheringthoseinsights.Wefocusedoureffortsonexploringtheworkforce’sviewsonthefollowingbroadquestions:•

Isthetraininganddevelopmentprocessthatexistsnowworkingwellforthecyberworkforce?Isthereaneedforimprovement?•

Ifcybertraininganddevelopmentneedtobeimproved,howmighttrainingbechangedtobetteraddresstheworkforce’strainingneeds?•

Whatwouldbetheidealwaytotrainanddevelopcyberpersonnel,andwhatobstacles,ifany,mightbepreventingthecyberworkforcefromimplementingthatideal?WethenofferoptionsforchangestothetrainingprocessthatUSAFcouldconsidertohelpaddresstheworkforce’scommentsandviewsonareasforimprovement.OurStudyApproachIndiscussionwithoursponsor,wescopedthisefforttofocusontheenlistedandciviliancyberworkforces.6Atthesponsor’sdirection,weexploredtheOCOanddefensivecyberoperations(DCO)workforces,specificallypersonnelintheenlisted1B4(cyberwarfareoperations)and1N4A(digitalnetworkanal