The private-sector focus of the Pentagon's annual cyber exercise

An annual cyber defense exercise held last month by the departments of Defense and Homeland Security and the FBI simulated a “whole-of-nation response” to attacks on critical infrastructure, with an emphasis on the private sector, where most of the potential targets reside.

The exercise held at a Joint Staff J-7 facility in Suffolk, Va., from June 8 to June 26 had more than 1,000 participants from over 100 organizations, including information-sharing hubs for the electric and financial sectors. All five military services, including National Guard and Reserve units, took part, as did the Federal Aviation Administration, according to a U.S. Cyber Command statement.

“Most critical infrastructure in the United States, particularly in the information technology area, is owned by the private sector,” said Rear Adm. Kevin Lunday, Cyber Command’s director of training and exercises, according to the Pentagon’s official news service. “So we rely on them, particularly when we are responding to a major incident or attack on the private sector.”

National Security Agency Director Adm. Michael Rogers, who heads Cyber Command, said the exercise was an opportunity to practice inter-service and inter-agency coordination. “Cyber Guard is designed to exercise the interface between the Department of Defense -- the active and Reserve and Guard components -- that are focused on the cyber mission, and to partner with other elements of the U.S. government as well as state and local authorities,” he said. A more detailed list of federal participants can be found here. The list does not name private firms that participated, and a Cyber Command spokesperson could not be reached for comment.

The Cyber Command statement referenced the participation of “allied partners,” and that included British officials, according to a Wall Street Journal report. British participation makes sense in light of deepening bilateral cooperation in the field.

Jim Penrose, a former senior NSA official who has participated in Pentagon cyber drills, said the exercises were crucial in helping identify cyber vulnerabilities in advance of a real-world incident because “once those cyber bullets are flying, all bets are off.”

By involving critical-infrastructure firms in the exercises, federal officials are “going to the next level … when it comes to cyber readiness,” said Penrose, who is now an executive vice president at cybersecurity firm Darktrace. Involving private-sector executives in the exercises also encourages them to share the latest cybersecurity best practices with their boardrooms, he added.