Capstone: Build, Challenge, and Defend a Cyber Campaign
Synthesize strategy, intelligence, law, targeting, access, effects, command, defence, assessment, and communication.
In this lesson, you will learn to:
- Deliver and defend a complete campaign package with evidence, alternatives, approvals, safeguards, measures, and branches.
- Demonstrate how the defensive plan changes the offensive theory and vice versa.
Capstone: Build, Challenge, and Defend a Cyber Campaign
The final lesson is a tabletop campaign laboratory. Learners produce a professional package for a fictional crisis, challenge it from adversary, civilian, partner, and defender perspectives, and revise it before a decision brief.
Scenario and required campaign package
The fictional state of Orinth is coercing neighboring Beloria while positioning forces near a disputed corridor. Intelligence indicates long-term access to regional telecom providers, phishing against logistics firms, reconnaissance of electric distribution, and prepared influence personas. Attribution to an Orinth military-intelligence ecosystem is moderate confidence; evidence of an approved destructive decision is low confidence. Civilian networks, allied traffic, hospitals, and commercial satellite service share dependencies.
Your authorized planning team must support Belorian resilience and develop proportionate cyber options. No live target, exploit, malware, credential, or real infrastructure may be used. Produce:
- policy aim, decision deadline, constraints, and completion criteria;
- actor ecosystem and three competing intent hypotheses;
- prioritized intelligence requirements and collection matrix;
- five-layer mission and target-system maps with civilian and partner co-use;
- three courses of action, including a defence-led option and a non-cyber alternative;
- legal-issues list, authority map, IHL analysis if armed conflict begins, and counsel questions;
- access-stewardship, capability-validation, OPSEC, deconfliction, and abort plan;
- effects estimate with best, expected, and worst cases;
- defensive hunt, continuity, communications, and collective-support plan;
- measures of performance, effectiveness, strategic outcome, unintended effects, and review cadence.
Make every claim traceable. State what is unknown and what would change the choice. The package should let a decision-maker select, modify, defer, or reject action.
Challenge cells and decision injects
Assign independent challenge cells to test the cyber campaign from adversary, civilian, partner, defensive, and legal-policy perspectives. The adversary cell adapts, deceives, reroutes, retaliates, and exploits publicity. The civilian-protection cell maps essential services, vulnerable groups, shared data, and reverberating effects. The partner cell applies caveats, competing intelligence equities, jurisdiction, and communication needs. The defence cell hunts access, changes architecture, restores services, and decides what to reveal. The red legal-policy cell challenges authority, thresholds, proportionality, and escalation.
Inject changes: the suspected telecom access appears on a neutral provider; a hospital begins using the same identity service; a vendor plans an emergency patch; an allied collector depends on the access; a forged leak alleges Belorian escalation; armed conflict begins; execution telemetry becomes incomplete; service degradation crosses a civilian threshold; and the adversary shifts to manual military communications.
At each inject, record decision, owner, authority, evidence, dissent, and effect on the theory of success. Reward teams for stopping or changing an operation when assumptions fail. A responsible operator protects the mission by refusing an obsolete plan.
Final brief, evaluation, and continuing practice
Deliver a ten-minute decision brief: situation, key judgments and confidence, objective, options, recommended course, legal and civilian safeguards, partner position, expected effects, worst case, abort conditions, defensive posture, assessment, and immediate decision. Provide the evidence annex and dissent.
Evaluate six dimensions:
| Dimension | Completion standard |
|---|---|
| Strategic coherence | Actions have a credible, challenged link to policy behavior. |
| Evidence | Material claims are sourced, dated, bounded, and open to revision. |
| Operational quality | Access, timing, capability, OPSEC, command, and alternatives are realistic. |
| Law and protection | Authorities, uncertainty, civilian harm, precautions, and abort rules shape design. |
| Defence and partnership | Continuity, hunting, communication, and partner equities are integrated. |
| Assessment | Baselines and measures can distinguish execution from outcome and harm. |
Complete the journey by writing a personal operating doctrine: how you will define the mission, protect evidence, challenge assumptions, include counsel and engineers, safeguard civilians, preserve options, communicate uncertainty, and learn after action. Revisit it after exercises and incidents. Cyberwarfare competence is not possession of a clever technique. It is disciplined integration under pressure.
Resources
- Course Source and Case Review Set — Revisit the UN, NATO, ICRC, DoD, UK NCF, CISA, DOJ, CCDCOE, ENISA, Microsoft, and Google sources linked throughout the course; distinguish primary facts, official claims, and analytic assessments in the capstone.