Use of Force Policies & Procedures Flashcards

Which framework introduced the concept of 'defend forward'—engaging adversaries outside US networks before they can attack—as a guiding principle for US Cyber Command?

Answer: The 2018 US Department of Defense Cyber Strategy

The 2018 DoD Cyber Strategy introduced 'defend forward' as a proactive posture, authorizing US Cyber Command to operate in adversary networks to contest malicious activity before it reaches US systems.

A private sector organization wants to automatically block traffic from IP ranges associated with a nation-state threat actor. Under most use-of-force policies, automated IP blocking is classified as:

Answer: Passive defense within normal operational authority

Automated IP blocking is a passive defense measure—it restricts inbound traffic to your own systems without accessing, modifying, or disrupting external infrastructure.

An attacker has compromised a hospital's OT network. The defender's use-of-force policy includes a 'harm to human life' threshold. Exceeding this threshold typically:

Answer: Elevates the incident to the highest escalation tier and may require law enforcement notification

A threat to human life escalates an incident to the highest policy tier, triggering mandatory executive and law enforcement notification and potentially emergency government assistance.

Which concept describes a pre-authorized set of cyber response actions that can be executed without real-time approval when specific, pre-defined trigger conditions are met?

Answer: Standing Rules of Engagement (SROE)

Standing Rules of Engagement define pre-authorized actions and their trigger conditions, allowing rapid response without requiring fresh approval each time a known situation arises.

A company suffers a data breach traced to a competitor. The CISO proposes infiltrating the competitor's systems to retrieve stolen files. The MAIN legal risk of this action under US law is:

Answer: Criminal liability under the Computer Fraud and Abuse Act

Accessing a competitor's systems without authorization—regardless of the reason—constitutes a federal crime under the CFAA, exposing the company and individuals to criminal prosecution.

In a use-of-force policy review, the term 'escalation dominance' refers to the ability to:

Answer: Maintain a credible capacity to respond at higher intensity levels than the adversary at any escalation rung

Escalation dominance means maintaining capabilities at every level of the conflict ladder so adversaries know any escalation on their part will be met with an even more capable response.

A use-of-force policy requires a 'sunset clause' for all emergency authorities granted during a cyber incident. What is the purpose of a sunset clause?

Answer: To ensure emergency powers expire automatically after a defined period unless explicitly renewed

A sunset clause automatically terminates emergency authorities after a set time, preventing temporary crisis powers from becoming permanent and ensuring oversight returns to normal governance.