A Navy cyber effort is fixing thousands of holes—and building tech talent

The Navy is looking for, and training up, its next generation of cyber talent from reservists who don’t necessarily have a technical background.

Chief Warrant Officer Scott Bryson said he didn’t have the manpower to go after the thousands of common vulnerabilities that plague Navy networks, like unpatched software and incorrect security settings. So U.S. Fleet Cyber Command authorized him to tap reserve components for what it calls Operation Cyber Dragon, whose sailors learn cyber techniques as they hunt down and fix problems in unclassified networks.

The program, which started earlier this year and is to complete its second phase on Aug. 19, relies on reservists who typically are joining to fulfill their required two weeks of annual training. The most recent batch of 30 sailors was rotated in on July 25.

“When we did the posting it wasn't limited,” said Bryson, who leads the operation. “I said I'll take anybody.”

About 10 out of the 50 participants so far were not Navy-designated network analysts, yet in March alone the team fixed more than 3,300 problems, he said. The team also discovered several “probable spoofing certificates” and developed ways to fix problems and manage DOD work in commercial clouds.

“Probably the most beneficial thing about this is I can take anyone, as long as you have a [common access] card, and we have a network terminal, and you can read a [standard operating procedure] and you're familiar with the internet,” Bryson said. “We're not programming anything. We're not writing any scripts. We're scanning, we're utilizing commercial scanning tools.”

Moreover, sailors who lack security clearances can participate while they wait. 

Rear Adm. Steve Donald, the deputy commander of U.S. Fleet Cyber Command/U.S. Tenth Fleet, said he wants to expand the program to cover the Navy’s swath of unclassified networks that aren’t necessarily national security concerns but still pose cybersecurity risks.

“Yes, we have a headquarters enterprise network that does our email and PowerPoints and what everyone typically uses a computer for. But then we have all these one-off or bespoke systems, like our [morale, welfare and recreation] networks, like our facilities management, our emergency management—all these other things that don't quite fit the enterprise network model, but they're still connected to the [DOD] network,” Donald said. “And they need the security as well.”

Security for those networks are often managed locally, the admiral said, at the sub-command level and the organizations “don't necessarily have the tools, the talent, or even the bandwidth to be doing what we're doing”: taking a holistic look at a network’s vulnerabilities from a hacker’s perspective.

Donald said the Cyber Dragon teams have found default usernames and passwords being used in some computer systems, which could have led to identity theft. 

“And there's not just one, necessarily, instance of that,” he said, recalling when Navy data turned up on a cloud provider’s servers in Southeast Asia. 

“We have found data where we didn't want data to be, right. And it's, again, not because of any maliciousness. It's just, you know, when you talk about the cloud, you don't know what server it's on... or where that server is hosted, and with the technology today, where that data sits right now can actually change and morph over time and can sit in a different place, just like that.”

Donald said he wants future iterations of the program to focus on working with network operators to find and more quickly fix vulnerabilities.

“Because it's one thing to have somebody from on high call down and say, ‘Hey, this is wrong, or you need to do this.’ It's a much different experience, if we're calling down and we have our folks embedded there just as human beings to say, ‘Hey, listen, this is a little off; we need you to correct it. We think these are the corrective measures. We're not the experts on your network’...and then come together as a group to figure out what the correct mitigation remediation is.”

Career inspo

In an era when the Pentagon struggles to woo tech talent away from higher private-sector salaries, the Cyber Dragon program has already inspired several participants to deepen their knowledge and even their Navy career.

Petty Officer 2nd Class Sarah Tierra, a Chase banker who is also a Navy Reserve cryptologic collection technician, said she often felt “underutilized” during her eight-year reserve career.  That changed as she participated in both phases of Cyber Dragon.

“So honestly, I want to change career paths; I don't want to be a banker anymore,” said Tierra, who helped develop some of the program’s procedure playbooks and now wants to learn more about networks and IT.

“It's nice to actually see the results from your work instead of leaving after two weeks and not hearing anything back and just wondering like, ‘Oh, I wonder if I made a difference at all.’ And that's the reason why I enlisted. So it just puts…more hope in the future for me staying within the Navy career.”

Some of the reservists were often assigned to a cyber-related unit but did not necessarily have a technical background or education. And sometimes they felt like they weren’t doing enough on their reserve training days and the program helped spark interest while also fulfilling DOD needs and sailors' compulsion to serve.

Trainees were paired off with one having some cyber experience and the other being a novice. The results were teams that could learn from each other. 

Lt. Blake Blaze, an active duty cyber specialist-turned-reservist, said the program was a good way to stay close to the fight with near-peer adversaries. 

“We're not directly engaging with the enemy, so to speak, but we are trying to prevent their avenues of access to our networks. So it seemed like a really cool mission. And I was excited about being part of a team for a small period of time.”

Blaze said he’ll take his new cyber knowledge into his day job at a startup that makes data science tools for high schools and universities.

Petty Officer 2nd Class Christopher Manzano, an intelligence specialist assigned to a cyber unit out of Naval Base Point Loma, said he’s now looking at cybersecurity education programs.

“Yeah, I didn't know a thing coming in. My civilian job: I'm a truck driver for UPS. So all the cyber stuff is all new to me. So day one [was] pretty rough; did a lot of homework when I went back to my room. And day two was more trial and error. Day three, I picked it up and ran with it,” Manzano said. 

“It definitely motivated me to keep going and pushing for something else. Just driving…it's different, I’m just on the road. But here, I feel like I'm making a difference. So it is pushing me to look for schooling.”