Cyber Operations Fundamentals and Doctrine
What the domain covers
Cyberspace operations doctrine treats cyberspace as a global domain within the information environment built from interdependent networks of information technology infrastructure, computer systems, and embedded processors and controllers (JP 3-12). The exam tests whether you can classify an activity into the correct doctrinal category and name the authority that goes with it.
The three core mission sets
- DODIN operations - operate, secure, and maintain the Department of Defense Information Network.
- Defensive Cyberspace Operations (DCO) - defeat or mitigate threats against the DODIN and DoD capabilities. Subdivided into DCO-IDM (internal defensive measures, executed on DODIN terrain by local defenders) and DCO-RA (response actions, executed outside DODIN, requiring SecDef-level approval).
- Offensive Cyberspace Operations (OCO) - project power by the application of force in or through cyberspace. Also know the older triad: cyberspace attack produces denial, degradation, or destruction; cyberspace exploitation gains access for intelligence collection; cyberspace defense protects own networks. Attack and exploitation carry different authorities and different deconfliction chains.
Worked example
A DoD workstation beacons to 203.0.113.45 every 45 seconds. Which response is DCO-IDM and which is DCO-RA? Reasoning: blocking the destination at the DoD boundary firewall is a measure executed on DODIN terrain - DCO-IDM, run by the local cyber protection team. Directing a surgical block on the hosting provider's infrastructure outside the DODIN is a response action - DCO-RA, requiring SecDef authorization and legal review. Neither is OCO, because the primary purpose is defense rather than projecting power.
Traps that cost marks
Treating any hack-back as OCO; assuming DCO-RA is a local commander's call; and answering 'attack' when the scenario's primary purpose is intelligence collection (exploitation).