NATIONAL HARBOR, Md.—The United States Air Force is actively strengthening its cyber defenses for critical infrastructure, encompassing both on-base facilities and external support systems, such as water and electrical power. Concurrently, industry specialists are advocating for an expansion of these efforts, proposing the development of dedicated, specialized microgrids located off-site to ensure the continuity of Air Force operations in the event of widespread power outages caused by cyberattacks.
This strategic shift reflects an evolving threat landscape, as highlighted by retired USAF Lt. Gen. Chris “Wedge” Weggeman during a panel discussion at the Air & Space Forces Association’s Air, Space & Cyber conference on Sept. 16. Weggeman emphasized that while military cybersecurity historically concentrated on protecting direct combat capabilities, adversaries are increasingly targeting the foundational support systems that enable these capabilities.
“We have spent years protecting and defending the tip of the combat spear, but right now, ladies and gentlemen, our adversaries have decided to focus time, resources, and interest on the hand that wields the spear, and that’s where we have to focus,” stated Weggeman, who now works in cybersecurity with Deloitte.
Weggeman further clarified that while the specific threat to infrastructure through cyber means is relatively new, the underlying principles of ensuring mission continuity are well-established. He suggested that existing frameworks for mission assurance can be adapted to address these new challenges.
“We really don’t need a new playbook. It’s really the same playbook,” Weggeman explained. “You’ve just got to know: what does this capability do in terms of enabling my mission? What happens when an adversary takes it away from me, and how long does it take me to recover? And do I have the ability to fight?”
For an extended period, the military’s cybersecurity endeavors primarily focused on Information Technology (IT), which involves the software, hardware, and networks used to manage data. However, there is a growing consensus among experts that greater attention must be paid to Operational Technology (OT). OT refers to the hardware and software used to monitor and control physical devices, processes, and events, such as those found in utility grids, industrial control systems, and critical infrastructure.
In response to this growing concern, Airmen from the 16th Air Force, based at Joint Base San Antonio-Lackland, Texas, have recently forged partnerships with various research centers, government agencies, and private sector organizations. These collaborations aim to bolster the defense of OT systems that interface with Air Force assets, recognizing their crucial role in base operations and mission execution.
Brig. Gen. Jason Christman, the 16th Air Force’s lead for OT initiatives, affirmed the organization’s proactive approach in a recent statement. “We are getting after it—workforce development, capabilities, intelligence, and everything else we need to execute this mission,” Christman said.
One notable achievement resulting from these efforts was the rapid development and deployment of an OT Certification Joint Qualification Record within a two-month timeframe. The next phase for the 16th Air Force team involves disseminating this certification across the broader joint force and facilitating the sharing of vital “threat telemetry and defense strategies” with their program partners. Additionally, the work included the establishment of an OT Cyber Defender Schoolhouse within the 16th Air Force, designed to train personnel specifically in the defense of operational technology systems.
Identify and Defend Critical Infrastructure
Following the panel discussion, Weggeman elaborated on the primary challenge facing the Air Force: the necessity to swiftly and thoroughly identify critical mission resilience, redundancies, and dependencies associated with operational technology. A significant portion of this OT, he noted, exists beyond the physical perimeter of military installations.
“We can’t just say there’s a fence line, so I don’t do anything about it,” stated Weggeman, who previously served as Air Forces Cyber commander and director of strategy, plans, and policy at U.S. Cyber Command, underscoring the interconnected nature of military bases with surrounding civilian infrastructure.
Another panelist, retired Army Col. Candice Frost, highlighted Project Watershed 250 in Texas as a potential model for safeguarding public works OT from cyberattacks. Launched in August, this initiative integrates state resources with support from the White House’s Office of the National Cyber Director, focusing specifically on preventing cyber-attacks against water and wastewater facilities.
Frost, now vice president for mission engagement with Parsons, stressed that future protective measures must include the segregation of essential services like water and electricity, the provision of robust backup systems, and potentially the construction of offsite electrical “microgrids.” These microgrids would enable bases to maintain power independently if their primary power supply is compromised through a cyberattack.
“Defend the ecosystem, not just the base, because the base is the stronghold, but the ecosystem supporting it is the area that we see in industry that needs the most support,” Frost affirmed, emphasizing a holistic approach to defense.
Identifying critical OT systems is the initial phase of this strategy, followed by efforts to enhance their resilience. Weggeman pointed out that older, disconnected equipment, which he metaphorically referred to as the “hand-carved wooden shoe problem,” often possesses an inherent level of protection from cyber threats precisely because it lacks internet connectivity. However, a growing concern is that much of the operational technology supporting military bases is being integrated into the internet.
While this connectivity can offer benefits, it also introduces new vulnerabilities. “Which is good because we know how to do that, but also terrifying because an adversary can get in now,” Weggeman observed.
Weggeman further noted that while significant progress has been made in reducing recovery times for IT systems after cyber incidents, the ability to quickly restore functionality when OT systems are compromised still lags. “We have less operational readiness to derive the mission back to where it needs to be from the OT perspective,” Weggeman concluded, signaling a crucial area for continued development and investment.
Why This Matters
The Air Force’s intensified focus on defending operational technology (OT) and critical infrastructure, both on and off military installations, reflects a profound shift in modern warfare and national security priorities. This initiative is crucial for several reasons:
Ensuring Military Readiness and Mission Continuity:Military bases are not isolated entities; they rely heavily on interconnected civilian infrastructure for essential services like water, electricity, and communications. A cyberattack targeting these external systems could cripple a base’s ability to operate, train, deploy forces, or sustain ongoing missions. By securing this “hand that wields the spear,” the Air Force directly safeguards its combat readiness and global operational capabilities.
Adapting to Evolving Cyber Threats:Adversaries are increasingly sophisticated, moving beyond traditional IT systems to target OT—the very systems that control physical infrastructure. This represents a strategic shift from disrupting data to disrupting physical operations. The Air Force’s recognition and active response to this threat demonstrate an essential adaptation to the evolving nature of cyber warfare, where infrastructure becomes a key battleground.
Protecting National Security and Civilian Infrastructure:Many military installations are deeply integrated into civilian communities, sharing resources and infrastructure. Efforts to protect base-supporting critical infrastructure directly contribute to the resilience of civilian utilities. This collaboration, exemplified by initiatives like Project Watershed 250, strengthens the overall national cyber defense posture, protecting not just military assets but also the public services that civilians rely upon daily.
Economic Implications:Disruptions to critical infrastructure, whether civilian or military-supporting, can have cascading economic impacts. Power outages, water supply interruptions, or transportation system failures can lead to significant financial losses, impede commerce, and undermine public trust. Investing in robust OT cybersecurity helps mitigate these potential economic repercussions.
Fostering Innovation and Collaboration:The development of specialized training (like the OT Cyber Defender Schoolhouse), new certifications, and partnerships with research centers and private sector entities drives innovation in cybersecurity. This collaborative approach leverages diverse expertise and resources, fostering a more robust and adaptable defense ecosystem capable of responding to future threats.
In essence, securing the operational technology that underpins military bases and their surrounding infrastructure is not merely an IT challenge; it is a fundamental requirement for national security, military effectiveness, and the resilience of society in an increasingly interconnected and vulnerable world.