text: Chapter 4
  information on connections and relationships among individuals, groups, and organizations, and the role and
  importance of aspects of physical or virtual infrastructure.
  4-50. Information collected through network surveillance and other surveillance types are enablers to the
  IPB process. This collected information provides insight into enemy cyberspace and EW capabilities and assets.
  Upon request, the CEMA section supports the G-2 or S-2’s surveillance efforts by requesting OCO support to
  employ cyberspace exploitation or by using EW assets to conduct electromagnetic reconnaissance to conduct
  surveillance in enemy and neutral cyberspace and the EMS. Information collected through cyberspace
  exploitation and electromagnetic reconnaissance includes mission and operational variables such as terrain
  characteristics, enemy and friendly obstacles, and the disposition of enemy forces and civilians.
  Security Operations
  4-51. Security operations are those operations performed by commanders to provide early and accurate
  warning of enemy operations, to provide the forces being protected with time and maneuver space within which
  to react to the enemy and to develop the situation to allow commanders to effectively use their protected forces
  (ADP 3-90). Early and accurate warnings provide friendly forces with time and maneuverability to react and
  create an opportunity for the commander to employ force protection measures. Cyberspace defense, cyberspace
  security, and EP include actions that allow early detection and mitigation of threats in cyberspace and the EMS.
  Additionally, ES missions conduct electromagnetic reconnaissance to attain information about the disposition
  of enemy threats in the EMS and modify security efforts.
  4-52. The ultimate goal of security operations is to collect information on an enemy’s COA that provide
  early warning and continuously disrupt enemy attacks. During security operations, information collected on an
  enemy’s COA in cyberspace and the EMS allows units to take preemptive measures that prevent enemy
  intelligence, surveillance, and reconnaissance assets from determining friendly locations, strengths, and
  weaknesses. Security operations also present opportunities to identify HVTs for future cyberspace attacks or
  EA.
  Note. For more intelligence information, see FM 2-0. For more details of information collection,
  see FM 3-55.
  TERRAIN ASPECTS
  4-53. Key terrain is any locality, or area, the seizure or retention of which affords a marked advantage to
  either force (JP 2-01.3). Key terrain in cyberspace and the EMS is comparable to terrain in the other domains
  in that prevailing affords any combatant a position of advantage. Maintaining a secured prevalence in
  cyberspace and the EMS is a feasible objective when conducting cyberspace operations and EW. Seizing and
  retaining the entirety of cyberspace and the EMS to the exclusion of all enemies and adversaries is an
  unobtainable goal. It is also possible for both friendly and enemy forces to occupy the same terrain in
  cyberspace and the EMS or use the same processes for conducting operations in and through cyberspace and
  the EMS without knowing each other’s presence. Another characteristic of terrain in cyberspace is that virtual
  components, identified in the logical network layer or the cyber-persona layer, constitutes locality in
  cyberspace. For this reason, identification of key cyberspace terrain is an essential component of planning
  cyberspace operations. Like the physical domain, commanders and staff must consider all of the military aspects
  of terrain. However, unlike the physical domain, commanders and staff must remember that the cyberspace
  terrain may change at any time. For example, an attacker may manipulate a firewall to create avenues of
  approach, or the enemy removing a node from the network may be a key terrain.
  4-54. Obstacles in cyberspace may include firewalls and port blocks. Avenues of approach in cyberspace
  can be analyzed to identify nodes and links that connect endpoints to specific sites. Cover and concealment
  may include hiding IP addresses or incorporating password-protected access to networks and network systems.
  Cyberspace observation and fields of fire include areas where network traffic can be monitored, intercepted, or
  recorded. Key cyber terrain provides access points to major lines of communications, key waypoints for
  observing incoming threats, launch points for cyberspace attacks and mission-relevant cyberspace terrain
  related to critical assets connected to the DODIN.