Stories‎ > ‎

Cyber Resiliency and Survivability

posted Jul 1, 2016, 5:49 AM by Michael Lenart   [ updated Jul 1, 2016, 5:50 AM ]
The Defense Threat Reduction Agency's (DTRA) Role in Cyber Assessments

Humphrey Barrera

The heavy reliance on cyber networks, systems, and critical infrastructure for mission accomplishment continues to make cybersecurity a critical focus of the Department of Defense (DoD). As new threats emerge, identification of vulnerabilities remains a top priority. To that end, the DTRA Joint Mission Assurance Assessment (JMAA) and Balanced Survivability Assessment (BSA) teams conduct assessments in support of the Office of the Secretary of Defense, Joint Chiefs of Staff, Combatant Commands, and the Military Services, as well as other DoD and U.S. Government organizations, to ensure continued execution of core functions.

Photo credit:

DTRA JMAA and BSA teams are composed of a variety of functional areas, two of which are Information Operations and Telecommunications. These specialists are responsible for assessing the communications systems, networks, infrastructure, and cybersecurity posture of critical missions around the world. Their knowledge and expertise play a vital role in the protection against a broad spectrum of threats, including accidents, natural disasters, technological failure, cyber attacks, terrorism, radio frequency weapons, sabotage, and weapons of mass destruction.  

Prior to an assessment, JMAA/BSA teams must understand the mission to be assessed and the systems, networks, infrastructure, and data supporting the mission. Therefore, a thorough mission decomposition is conducted to identify the critical assets and dependencies necessary for continued execution of the mission. Once complete, assessors conduct further research using various databases and by coordinating with asset owners and outside agencies.

During assessments, teams work with local experts to identify vulnerabilities and areas of concern in systems, networks, infrastructure, cybersecurity, and processes and procedures. The assessment consists of interviews, on-site observations, diagram and documentation review and, in the case of some BSA assessments, the use of specialized technical tools. Vulnerabilities are based on regulatory guidance from DoD, the Services, best business practices, and professional expertise.

Photo credit:

DTRA JMAAs and BSAs identify vulnerabilities, taking into consideration the effectiveness of the current mitigation measures in place, and provide both procedural and technical mitigation recommendations focused on reducing overall risk-to-mission. A key difference between the JMAA and BSA methodologies is that JMAAs quantify overall risk-to-mission for identified vulnerabilities. BSAs are very narrow in scope, and are able to provide a more detailed look at specific areas than JMAAs. Both teams develop comprehensive reports, which are provided to mission owners and other major stakeholders. These reports allow senior leaders to make informed risk decisions to mitigate vulnerabilities that potentially affect their overall strategic missions.

JMAA and BSA teams are essential in the effort to provide a comprehensive and streamlined approach to risk assessment, risk management, and resource allocation across the DoD and Federal Government.  The assessments provide visibility into systemic risks and trends affecting mission essential function performance across components, installations, and programs. This visibility enables leaders to develop, integrate, and synchronize protection and resiliency policies that assure continued mission accomplishment.

About the Author

Humphrey Barrera is an Air Force Master Sergeant assigned as an Information Operations specialist to the Defense Threat Reduction Agency's Joint Mission Assurance Assessment teams. He has over 14 years experience as an Air Force
cybersecurity professional, working in various capacities of information technology and cybersecurity. His areas of interest include national security, cyberspace operations, and control system security.