The C5ISR Center Cybersecurity Service Provider (CSSP), a key component to the U.S. Army Futures Command, U.S. Army Combat Capabilities Development Command, provides advanced Defensive Cyberspace Operation (DCO) services and solutions to DoW subscribers globally impacting the soldier and their warfighting capabilities, thereby ensuring DoW readiness and lethality. A provider and premier leader in the advancement of 24/7/365 cybersecurity services (i.e., identify, protect, detect, respond, and recover), the C5ISR Center is home to an authorized (certified and accredited) DoW CSSP responsible for protecting and defending a portion of the DoW Information Network (DODIN). Throughout the course of its history, the Adelphi, Maryland headquartered, cost-reimbursable DoW CSSP has evolved and changed. The following sections chronicle the major initiatives, decisions, and achievements that have contributed to the most impactful accomplishments of the C5ISR Center CSSP over the last three decades.

THE LATE 1990s

The now C5ISR Center CSSP has gone through various evolutions since its formal inception in 1996 as the Army Research Lab (ARL) Computer Security Incident Response Team (CSIRT) – one of the first U.S. Army CSIRTs. While the organization stands strong today as a trendsetter and a top performing DoW CSSP protecting and defending against the most sophisticated and damaging cyber threats, its formative years were marked by significant challenges, changes, and growth. While its role was set at inception, its identity was forming, reforming, and slowly, but positively reshaping. Despite initial hurdles, the latter part of 1996 saw a significant turning point for the ARL CSIRT as it completed its first prototype, the first government-off-the-shelf (GOTS) multitool Intrusion Detection System (IDS) suite – the inspiration to what would eventually become its next generation and current IDS tool named Interrogator. With a first proven solution under its belt, the ARL CSIRT closed the century with a stable version of the GOTS multitool IDS Suite, but more importantly, a newly-gained focus on the next steps for achieving its mission, vision, and brand authority objectives. With a strong guiding direction for action and the motivation to move forward, the ARL CSIRT was now ready to make an impactful transition into the 21st century.

THE 2000s

The first decade of the 2000s saw a fast-paced incursion of sophisticated and organized non-state and state sponsored cyber espionage. In addition, the growing number of new DoW network systems and the significant rise of internet usage further expanded the attack surface and the proliferation of persistent malware. In response, to organize the way the DoW conducted Computer Network Defense (CND), the Department promptly implemented a 3-tier CND operational hierarchy with corresponding incident response requirements. With new standards in play, the ARL CSIRT saw the higher benchmark as a new reference point and opportunity to become a leader in the Department’s new construct.

In 2000, the ARL CSIRT kicked off the century by partnering with the DoW High Performance Computing Modernization Program (HPCMP) to establish the High Performance Computing (HPC) Computer Emergency Response Team (CERT). Through the HPC CERT, the ARL CSIRT helped design and implement a protection strategy for DoW Research, Development, Test, and Evaluation networks. In 2001, as the HPC CERT was lifting off, the ARL CSIRT was directed to support the American war in Afghanistan. As a U.S.-led coalition under Operation Enduring Freedom responded to the September 11 attacks carried out by al-Qaeda, the ARL CSIRT provided attack sensing and warning capabilities, computational power, and cybersecurity expertise to protect tactical networks and soldiers deep into enemy territories against undesirable grid dynamics. In 2004, the ARL CSIRT followed one of its most significant achievements with another showcase, the release of what would eventually become the backbone for its customized cybersecurity services, Interrogator. In a short span of time, the success of Interrogator framework echoed throughout the many branches of the government, resulting in a DoW-wide peer recognition and eventually, the rapid expansion of its mission. For instance, as the DoW Computer Network Defense Service Provider (CNDSP) Program navigated its formative years, the ARL CSIRT was one of the first entities invited by DoW CIO to participate, on a voluntary basis with other DoW cyber and non-cyber principals, to attend working groups that eventually resulted in the formation of the program’s evaluation process. Later, in 2007, after a successful certification and accreditation evaluation process, the ARL CSIRT earned its designation as a DoW CNDSP Tier 2 entity; that is, from that point on the ARL CSIRT became known as the ARL CNDSP.

The following year, under its new designation, the ARL CNDSP was invited to participate in the 2008 Office of the Secretary of Defense (OSD) Enterprise-wide Cybersecurity Solutions Steering Group (ESSG) Approval and DoW Pilot. Among others, the DoW Pilot was organized to validate newly released Evaluator Scoring Metrics (ESM) v7 (2007) requirements on DoW-Cleared Defense Contractors (CDCs) and other participant sub-scribers. ARL CNDSP’s successful participation in the DoW Pilot resulted in the firsthand recommendation and request from DoW CIO to the ARL CNDSP leadership to assist the Department in protecting CDCs, a cybersecurity service that became offered by the ARL CNDSP in 2010.

THE 2010s

The 2010s witnessed a significant increase in data volume, variety, veracity, and velocity; the proliferation of nation-state actor’s advanced persistent threats; and a growing concern about zero-day exploits due to the widespread adoption of new technologies, which all generated daily new sets of attack vectors and vulnerabilities. In response, throughout the 2010s, the ARL CNDSP expanded its DoW cyber cooperation and collaboration boundaries to also include other Federal, industry, academia, and international partners such as the National Cyber Investigative Joint Task Force and the North Atlantic Organization. Through these partnerships, the ARL CNDSP ushered in an unparalleled growth period marked by back-to-back waves of rapid and creative innovation cycles. With each innovation often leveraging lessons learned and advancements from the previous one, the ARL CNDSP maximized the potential of its fast-paced solutions, causing significant shifts and profound impacts on the cyber and intelligence communities within a relatively short time frame. By studying, researching, and developing capabilities and solutions that were simply unavailable at the time, the ARL CNDSP turned each disruption point into an opportunity to further its partnerships and alliances. This marked an emergence of unparalleled subscriber market growth, particularly with agencies and organizations in need of enhanced cybersecurity protection services for classified systems.

During the first half of the 2010s, while successfully navigating the release of the DoW ESM v8 in 2011 and ESM v9.2 in 2016, the ARL CNDSP sponsored 12 proof of concepts and demonstrations, prototypes, test and evaluations (T&Es), pilots, and products development for the DoW. The end of this first wave of innovations was marked by the establishment of the ARL Cyber Analytics Lab in 2015, which was formed to coordinate big data, artificial intelligence (AI), and machine learning (ML) undertakings.

The organization started the second half of the 2010s with a new designation. In essence, the release of DoW Instruction 8530.01, Cybersecurity Activities Support to DoW Information Network Operations advanced the DoW cyber lexicon by replacing the term CNDSP with the term Cybersecurity Service Provider (CSSP). The ARL CNDSP was from that point on known as the ARL CSSP. Alongside, as the DoW boosted the deployment of DoW-wide defense mechanisms, the ARL CSSP continued to customize cybersecurity solutions to satisfy the unique operational threat environments of its subscriber set. Specifically, during the latter portion of the 2010s, the ARL CSSP sponsored a second wave of rapid innovation cycles including 15 additional prototypes, T&Es, pilots, and products.

After a decade of innovations and remarkable milestones, the ARL CSSP transitioned to the U.S. Army Communications-Electronics Research, Development and Engineering Center in 2018 and realigned under the C5ISR Center while navigating the release of ESM v10 in 2019. The ARL CSSP was from that point on known as the C5ISR Center CSSP.

THE 2020s