This report describes commercial practices for cyber workforce management and organization, as determined from a literature review and interviews with reputable organizations that have similarities to the U.S. Air Force (USAF). These practices are applicable to USAF as it endeavors to improve the management of its cyber forces. The authors describe the basis for each practice, the benefits it conveys, and how it could be implemented by USAF.

Cyber Practices

What Can the U.S. Air Force Learn from the Commercial Sector?

Lara Schmidt, Caolionn O'Connell, Hirokazu Miyake, Akhil R. Shah, Joshua Baron, Geof Nieboer, Rose Jourdan, David Senty, Zev Winkelman, Louise Taggart, et al.

ResearchPublished Sep 9, 2015

To meet the challenges of the cyberspace era — including the rapid rate of change in technology, the growing cyber threat, and the need to integrate cyber with operations in other warfighting domains — the U.S. Air Force (USAF) must find effective ways to organize, train, and equip its cyber forces. Cyber Practices: What Can the U.S. Air Force Learn from the Commercial Sector? identifies approaches to cyber organizational and workforce issues. Specifically, this report describes efforts to identify successful processes and practices from the commercial sector that might be applicable to USAF. To ascertain successful commercial practices, the authors took a twofold approach: a wide-ranging literature review and interviews with a carefully crafted set of commercial organizations, selected for their similarities to USAF and for their reputations of cyber excellence. Companies were identified to be similar to USAF in size, cyber functions performed, exposure to cyber threats, and operational environment. The authors found strong parallels in the commercial sector for Department of Defense information network operations and defensive cyber operations. Although none of the companies interviewed were as large as USAF or required to function in deployed and contested operating environments, the commercial practices described in the report are likely to be applicable to USAF and result in effectiveness and efficiency gains. The authors describe the basis for each practice, the benefits it conveys, and how it could be implemented by USAF.

Key Findings

Information Technology (IT) and Information Security Should Be Managed as Two Separate Disciplines

  • Treating the disciplines separately would increase effectiveness and efficiency.
  • Reductions in the size of the cyber workforce might result.

IT Should Remain a Critical Core Function

  • Despite a trend toward outsourcing, USAF must retain some redundancies to ensure that it can deliver services in cyber-contested warfighting environments at operating locations around the world.
  • USAF might be able to find efficiencies above current levels by applying consolidation of IT capabilities to the extent possible.
  • On average, companies maintained approximately 20 times more IT personnel than information security personnel. Given this standard, USAF should consider a cyber manpower review, as its information security workforce is smaller than one might expect based on commercial practices.

Technical Depth of Cyber Leadership Should Be Valued and Cultivated

  • Managing IT and information security as two separate disciples increases the technical depth of individuals in those fields.
  • There is opportunity for gradually developing the breadth required for senior positions by using an approach that still reinforces technical depth.
  • Encouraging technical depth in the officer corps need not be in conflict with USAF promotion and career field management practices.

Recommendations

  • USAF should align career fields with either IT or information security, since these are different disciplines that require different management and training approaches.
  • Increase the size of the USAF information security workforce. Commercial practice should be considered a lower bound for USAF force structure planning assessments.
  • Improve the accession of cyber-capable personnel by looking for candidates with relevant degrees from universities with noted cyber programs and establishing aptitude tests.
  • Structure organizations, including cyber squadrons, according to the guidelines laid out in organizational theory and consolidate the management of these organizations to the greatest extent possible to achieve efficiencies.
  • USAF should approach outsourcing, whether to contractors or other government providers, in a way that bolsters the expertise of USAF cyber personnel, as opposed to replacing the need for it.

Order a Print Copy

Format
Paperback
Page count
108 pages
List Price
$28.50
Buy link
Add to Cart

Topics

Document Details

  • Copyright: RAND Corporation
  • Availability: Available
  • Year: 2015
  • Print Format: Paperback
  • Paperback Pages: 108
  • Paperback Price: $28.50
  • Paperback ISBN/EAN: 978-0-8330-9032-4
  • Document Number: RR-847-AF

Citation

RAND Style Manual
Schmidt, Lara, Caolionn O'Connell, Hirokazu Miyake, Akhil R. Shah, Joshua Baron, Geof Nieboer, Rose Jourdan, David Senty, Zev Winkelman, Louise Taggart, Susanne Sondergaard, and Neil Robinson, Cyber Practices: What Can the U.S. Air Force Learn from the Commercial Sector? RAND Corporation, RR-847-AF, 2015. As of September 11, 2024: https://www.rand.org/pubs/research_reports/RR847.html
Chicago Manual of Style
Schmidt, Lara, Caolionn O'Connell, Hirokazu Miyake, Akhil R. Shah, Joshua Baron, Geof Nieboer, Rose Jourdan, David Senty, Zev Winkelman, Louise Taggart, Susanne Sondergaard, and Neil Robinson, Cyber Practices: What Can the U.S. Air Force Learn from the Commercial Sector? Santa Monica, CA: RAND Corporation, 2015. https://www.rand.org/pubs/research_reports/RR847.html. Also available in print form.
BibTeX RIS

Research conducted by

The research reported here was conducted within a fiscal year 2014 project entitled Best Practices to Inform USAF Cyber Squadrons of the Future, sponsored by Maj Gen Earl Matthews, director of Cyberspace Operations at Headquarters USAF, and conducted within the Force Modernization and Employment Program of RAND Project AIR FORCE.

This publication is part of the RAND research report series. Research reports present research findings and objective analysis that address the challenges facing the public and private sectors. All RAND research reports undergo rigorous peer review to ensure high standards for research quality and objectivity.

This document and trademark(s) contained herein are protected by law. This representation of RAND intellectual property is provided for noncommercial use only. Unauthorized posting of this publication online is prohibited; linking directly to this product page is encouraged. Permission is required from RAND to reproduce, or reuse in another form, any of its research documents for commercial purposes. For information on reprint and reuse permissions, please visit www.rand.org/pubs/permissions.

RAND is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors.