Large-Scale Cybersecurity Exercise Focuses on Operational Technology

This year's iteration of the War Department's longest-running unclassified cyber defense exercise is largely focused on operational technology, military cyber professionals said today during a virtual media roundtable.

Hosted by the National Guard Bureau, the roundtable was part of Cyber Shield 2026 - a training event that brings together more than 1,000 participants from 44 states and territories, as well as 23 countries, in Little Rock, Arkansas, July 12-25. It's designed to develop, train and exercise cyber forces in the areas of computer network internal defense measures and cyber incident response.

Whereas information technology focuses on the management of data, networks and software, operational technology refers to the control and monitoring of physical machinery, industrial equipment and operational processes.

One reason operational technology security has become increasingly important this year, and in recent years, is that remote work has become much more prevalent since the 2020 COVID-19 pandemic, said Army Brig. Gen. Russell E. McGuire, National Guard Bureau vice director of cyber operations.

"Pre-pandemic, most of our workforce went to office buildings. … As we transitioned to remote work, it created tremendous vulnerabilities," he said.

Beyond IT professionals working remotely during the pandemic, McGuire said some critical infrastructure employees wanted remote access, which forced companies to connect IT systems to operational technology, thereby creating a new security risk.

Each year, the exercise focuses on different areas of critical infrastructure, which often relies on operational technology; this year's focus is the electric grid.

"As you look to sectors of target, there is a need to continue to come back to the electric sector, as attacks on the electric sector impact all sectors instantaneously," said Tim Conway, a fellow and technical director at the SANS Institute, which provides cybersecurity training, certifications and research to the War Department.

One way the exercise combats threats to operational technology is by simulating real-world cyberattacks with SANS NetWars - a series of hands-on interactive learning exercises.

Roughly 400 participants are taking part in this year's NetWars, contributing their own time during the weekends and in the evenings, McGuire said.

"This is time they could be hanging out, catching a movie [or] relaxing, but the knowledge that they build just being in that room with these other experts, competing with each other is what makes this such a great exercise for them to take back to their units [and] their jobs, and that's why they keep coming back and growing each year," he added.

Members of the Army and Air National Guard have participated in Cyber Shield annually since the event's inception in 2013.