Assigned Byline Made Easy

Assigned byline

[Music] when you think of innovation you don't necessarily think of the department of defense but captain ben allison with the u.s army cyber school is here to talk to us about how the u.s army cyber school created coresource code with git lab they were able to streamline their courseware process using git to track all their instructional material as code this enabled them to reduce effort and increase efficiency and transparency necessary to maintain their curriculum relevance and currency hello my name is ben allison today i'm going to be talking about how the united states army cyber school is using git lab to track and manage our curriculum and courseware as code to briefly introduce myself i'm an army captain i've been in the army for about six years i studied computer science at my in my undergrad and i've been at the cyber school for the past two years working on building a new pipeline for officers who are going to join the army as software engineering and a new specialty of the army is creating the cyber school itself was founded in 2014 the first students came less than a year later in 2015 and when students graduate they primarily work in the severe mission force the cyber mission force is a joint force that works under united states cyber command and so when they go to cyber mission force they work in a joint environment with the air force the navy submarines and then of course the army additionally we have soldiers who now are are going out to the broader army beyond the cyber mission force so they'll go to regular army units as well so when we talk about the cyber branch in the army this this memo was drafted and published in august of 2014 so the time kind of shows how young this hover branch is in the army when you say the term branch everyone's familiar with many people are familiar with the dod has the air force the navy the army and and the marine corps which falls under the navy technically but then within the armor we also use this term branch to just to talk about how we group specialties within the army so you have branches like armor or infantry so those are more familiar combat arms roles that the army associates or people associate with the army uh other things like field artillery aviation so they fly helicopters would be aviation armor tanks field artillery they manage the artillery the mortars things like that uh then you have more technical specialties such as the signal core so the signal core is what enables the army to communicate so all the soldiers who focus on telecommunications and more i.t centric communication now that we have uh the 21st century with actual computers that all falls under the signal core however the army created the cyber branch it's similar to the signal core but rather than being i.t centric the cyber branch is focused on what they say what the phrase is creating offensive and defensive effects in cyber space so when say affects we're thinking the ability to create an outcome so degrade deny so we're trying to deny enemy the ability to create effects in our own equipment and we're trying to support uh army forces in a state of war to create effects against our enemies and when i say cyberspace they're talking about primarily in this context ipcentric computing and rf based computing so so that entire space is kind of what we group under cyberspace within that which is of course cyber is used everywhere but but that's kind of a more more specific term when we use cyber in the army so in that context when the army is building a new schoolhouse and a new training pipeline for for a whole new specialty normally when the army has training they focus on things like what we see in the lower left-hand corner you have that's the abrams tank it was created in the 80s it's approx about 40 years old now in 2020 and not much has changed over that time there are improvements and upgrades and so on but if you're trying to teach someone how to operate this vehicle generally there's not many changes and when they do change they're very controlled changes so you'll get a list of hey there's a new upgrade to this new system and here's how it changes how you teach it which then feeds into a very slow controlled process for how the army is going to update its curriculum and generally this is okay and this is more what you want because tactics are not changing very often maybe over decades technology might change things or different types of warfare might change how you would teach things in your curriculum but you want to be controlled and you want to be able to monitor it and make sure you're not changing things in a way that's harmful uh and that ties back to what we see here as a checklist mentality and that's where if there if there's a maintenance you need to do in this vehicle there's a checklist of maintenance you need to do or if there's a task you're doing you want to follow this procedure i did in the same way every time to ensure everyone knows how to do it and you train it and it becomes muscle memory that way when you're in stressful situations the muscle memory takes over and so that ties into what we see next to this picture of the tank it's a web interface called training development capability so the army uses this this web interface in the backend database to train all of its curriculum so they they map essential tasks which are things that units have to perform at the individual and collective level to prove that they're ready for for their mission and they tie those back to lesson plans at school houses for their respective specialties for how they train their soldiers and so this process is very uh labor intensive there's a when you create a lesson plan there's several different clicks the typing and manual entry use with a mouse and a computer and someone who's trained and has access to the system another point is it doesn't have api access so if you're trying to update something you wanted to automate and update unfortunately this entire process has to be done manually by a human service at the cyber school when we're creating the cyber branch and creating the school to go with it uh the individuals who are here when they were first standing up they wanted to find a way to be more agile in how they manage things because the information security space is much different than than the traditional army apparatus that supports training for example where things don't change very often in typical warfare training the information security space changes very often a three-year cycle would mean that we're always behind the curve because things constantly change in information security something three years ago is not necessarily true now and then tactics and proceed techniques change operating systems update all of that those type of changes we want to be able to capture so that we're not stale and three years behind whenever we're teaching curriculum likewise where the operational force typically in the army is focused on checklists and a very defined definition of what it means to be ready for their mission in cyber that's not really the case in information security the problems are not as concrete that you can follow with the checklist instead we want people to be able to absorb and understand poorly defined problems and then break it down into technical steps and apply what they've learned and learn how to find out what they don't know to teach themselves to solve problems so we're very focused on outcomes that are focused on problem solving rather than solving checklists and then additionally when we look at how the government has approached us before we're not the first course in the army or in the dod that has technical courses but one thing that that we saw in other places is that many times when they have technical environments they they build virtual labs that might be manually configured and so someone would go in who knows what they're doing they configure an environment for to teach students and they might save it as a snapshot and then if you want to give it to every student you would snapshot it multiple times or copy that snapshot across the board other some very well known uh industry certification courses that distribute their their course material and thumb drives to students and virtual machines that you copy over while this can work it's very difficult to scale and it creates a very high cost to develop new curriculum and so if you want to maintain your your curriculum or update it there's a lot of labor that's involved so at the cyber school uh we we decided to apply software engineering principles when we're developing and managing our courser instead so when we talk about courseware this is all the instructor material the student material and the lesson plans that support training development capability that come out of our our curriculum in our for that support a lesson outcome and then additionally it is the the environment the virtual ranges that students practice activities to demonstrate their skills and learn uh that all support that outcome so for us the coursework primarily we use ascii doctor and markdown for all products that would be as a replacement to powerpoint or word or things like that and then we track it in version control using git and gate lab and that provides us by line version control and we can receive feedback for that versus a powerpoint which is a binary blob that you can't really drop it you could you could store it in gitlab or in git but you wouldn't be able to see changes by line in between uh new commits and then finally once we have all the coursework managed we build pipelines that support different end users so if the students if we want to take this product and build for our students we write it once and in the pipeline we'll pull out anything that's restricted to the instructor and then the students will get a view of their content likewise for uh for instructors they would get their own view with all the products that have to go with them to help them teach that way the people who are teaching don't have to actually go into git and view products that way they can actually just pull up in the web interface which we store on gitlab pages to view their products and so and so as a quick example here we see on the screen we have a a this is a byline change that was very cosmetic so it didn't need to go up to a serious process they just wanted to add syntax highlighting so we can track to say hey who made a change to this facilitation guide for the instructor and we can see what was changed and when it was changed and then there was a reason why and so what this builds for us is a web interface so this is a static page hosted in gitlab pages so gitlab pages also gives us the access control so we can say some repositories have a list of users who can access this and then the second repository can have a list of users who are students and students can only access maybe guest access to this project and they can see all the pages that go with it so this one is using asciidoctor and antora which is limited to ascii doctor so it provides all the material necessary for the summon cyber common technical core which is one of our our primary technical courses so here's a different view using hugo so this supports ascii doctor and markdown and so this builds again this is a student view so this would show the the slides and the student guides and all of that in a web format and any additional files or handouts that would go with it to support an outcome for our lesson finally the next piece that goes with this is as we have the coursework for the actual the guides for instructors and students which are the slide decks in in books and all of that material we also have the infrastructure so the infrastructure we we apply the concept of infrastructure as code which means you define your networks your virtual machines your servers all of that in code using a we use yaml which is a simple markup language uh to define an entire template for a network for classroom activity or for an entire module in some cases and in those templates they have what's called user data for virtual machine and that is where we put all the configuration scripts that get fed into the virtual machine after boots so what happens is we have a single standardized set of windows and linux virtual machines or other different architectures and operating systems as necessary and they are stored as a we store that once we manage those once but then when we want to deploy it for a class we use these heat templates which are those yaml templates to get fed into openstack which is our private cloud and then the user data feeds into cloud init post boot and custom configurations can be applied across all those virtual machines so one individual or one instructor can build an exercise for a student once and then we can scale it across the board as many times as we want so every student can get their own identical range which gives us then the guarantee that everyone's getting the same experience from their testing when they're when they're completing exercises and testing additionally allows us to take advantage of get lab ci pipelines so when we make changes and then say we want to update it for the next class and there was a cosmetic change we just make all of our changes in code make the newest commit and then we have a manual ci pipeline that can then deploy all of our infrastructure into openstack automatically through gitlab and so we can see again here here's an example of the byline version control for this so here when someone's fixing a typo and that's one of those this is examples of that granular control we get from it and so once this deploys we have uh this is here's an example of the ci pipeline for that course we saw earlier cctc this is a security module for that it's one of the sub modules and so they have they deploy every student gets one deployment for their entire class so the ci pipeline runs and it it clones all the repositories it needs it uploads any objects uh to open stacks direct object stores it builds all the templates into openstack saves the output from those templates which are you can configure heat temperature to return variables like public iop ranges and ip addresses that get assigned and then it builds a capture the flag framework using ctfd which is an open source project to manage capture flags and it builds custom activities for the students with guides and prompts and all of that tailored to that specific deployment and finally it's able to validate all of that to ensure that all the stacks deployed so that every every student's uh environment we know that more or less it actually deployed the way we wanted it to and someone's not going to get into class and be in the middle of an activity and we find out oh this didn't deploy writing we have to go back and manually do it while students are in class the goal is to get that done before ahead of time in case something fails so in the product that we see here this is a student range this is a single identical range deployed twice so on the left you see in the lower left hand corner there's the same environment and then the top it's the same thing deployed and this is this is a security module of cctc deployed by the framework and this is what it looks like in openstack when it's deployed and that was all done through a pipeline so we only had to do it once and then we were able to repeat it across for the entire class in the rest of the screenshots it's cropped out but you can see the entire class is in this project and all of their ranges are built at the same time in the same fashion so this has done for us we've gone from a three-year process what is what the army provides us before and now we have the ability to support instant feedback and then we can tailor how we change our curriculum based on the nature of that feedback if it's a small cosmetic change and we can make it immediately if it's a outcome altering change it has to go up a more formal process but we can tailor that based on the need of the the change we now have version control that's by line versus no version control we now have automated builds versus manual infrastructure deployment so we can automatically build it after we have it set and ready to go and then we have interactive tests so rather than having a paper test which was before in the early days of the course uh schools rather now we have interactive tests especially in like courses like cctc where the entire capstone is a several hour test in an interactive environment in the future we'd like to do standardization so become cloud agnostic with technologies like terraform standardize how we're doing it across all classes rather than every class implementing its own on its own and then implement gamification as code uh to make ctfd really standardize we'd also like to collaborate with other partners in the joint environment so other service branches like the air force we're working with to help build a to work towards it and how come we have a standardized technical curriculum across the board that we can share downstream and not repeat ourselves and then finally we'd like to apply these standardized formats in the future to create make technical curriculum available to people in high schools who may not otherwise have access to technical curriculum by reducing the cost by employing courseworkers code across the board this concludes my talk i'd like to say thank you to gitlab for the opportunity for the cyber school to tell our stories and thank you for your time for watching