Department of Defense cyber strategy adds to previous guidance with lessons from Ukraine

The Department of Defense presented a new cyber strategy that takes the lessons learned from the Ukraine war and applies them to a changing threat landscape.

A public May 26 fact sheet detailed some of the changes; the strategy itself remains classified. Of primary importance, the department said, is that the strategy continues to prioritize stopping threat actors before they become an immediate danger to US interests. DOD will also continue to work with allies and to assert cyber dominance.

Pentagon officials transmitted the classified strategy to Congress, calling it “subordinate to the 2022 National Security Strategy and the 2022 National Defense Strategy.” The DOD strategy is meant to complement the 2023 National Cybersecurity Strategy released by the White House in March.

School days. Lessons learned from the Ukraine war are expected to help the effort, the Pentagon said in the fact sheet.

“Since 2018, the Department has conducted a number of significant cyberspace operations through its policy of defending forward, actively disrupting malicious cyber activity before it can affect the US Homeland,” DOD said. “This strategy is further informed by Russia’s 2022 invasion of Ukraine, which has demonstrated how cyber capabilities may be used in large-scale conventional conflict.”

US Cyber Command commander Gen. Paul Nakasone told reporters in May that the strategy wouldn’t change much from the 2018 guidance, a key directive of which was for Cyber Command to “defend forward” against threats.

“There was a huge inflection point in 2018 with the Defend Forward,” Nakasone said. “I don’t see, necessarily, a huge change in the strategy coming out.”

DOD said it will release an unclassified summary of the strategy in the coming months.