# CYBERCOM Details Defend-Forward Strategy Shift

Published: 2019-04-23 · Severity: low · Sectors: government-national, defense
Canonical: https://vorant.io/reports/1fd8b142-505d-505c-a6c1-ea90285e2ba9/cybercom-details-defend-forward-strategy-shift

> US Cyber Command outlines how its elevation to a unified combatant command has clarified DoD's cyber role and partnership model against Russia, China, Iran, and North Korea.

Brig. Gen. Timothy Haugh, commander of the Cyber National Mission Force at US Cyber Command, spoke at the Atlantic Council's International Conference on Cyber Engagement about changes following Cyber Command's elevation to a unified combatant command one year prior. He described three lines of effort: gaining insight into adversary activity in partnership with the NSA, enabling partners (including allied nations and industry) through a 'defend forward' model that hunts adversary activity on foreign networks, and being prepared to impose costs on adversaries.

Haugh referenced legislative changes affirming the Secretary of Defense's authority to conduct cyberspace operations, congressional direction for an inter-agency approach to countering Russia, China, North Korea, and Iran, and a pilot program allowing DoD personnel to support DHS in defending critical infrastructure. He cited the previously reported action in which US Cyber Command disrupted internet access for the Internet Research Agency (IRA), a Russian state-linked troll farm, during the 2018 US midterm elections to prevent influence operations, though he did not directly confirm the specifics of the Washington Post report.

This article is a policy and strategy piece rather than a technical threat report; it contains no indicators of compromise, malware analysis, or specific vulnerability disclosures. It is primarily useful for understanding the evolving US government posture on offensive/defensive cyber operations and information-sharing relationships between DoD, DHS, FBI, NSA, and industry partners.

## Mentioned in this report

- Threat actors: Internet Research Agency

Source reporting: https://www.atlanticcouncil.org/blogs/new-atlanticist/an-increase-in-clarity-in-us-cyber-strategy

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1fd8b142-505d-505c-a6c1-ea90285e2ba9/cybercom-details-defend-forward-strategy-shift.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup