text: Appendix A
  Preventive Measures
  A-62. Cybersecurity measures and physical security combine to prevent data exfiltration and collection by—
  * Implementing strict identity and access management controls for network systems.
  * Enforcing strict physical security controls.
  * Implementing access control restrictions.
  * Employing data loss prevention software.
  * Encrypting data-at-rest.
  * Maintaining strong passwords for network access.
  Indicators
  A-63. Indicators of enemy data exfiltration and collection efforts include—
  * Attempted or successful unauthorized physical access to sensitive areas.
  * Unusually high volume of outgoing network traffic.
  Reaction
  A-64. The effects of data exfiltration can be catastrophic. If an enemy can steal enough documents, they can
  develop a complete assessment of U.S. capabilities, troop strength, logistics, and even operation plans. If any
  member of the unit suspects an enemy data exfiltration attempt, they—
  * Report to G-2 (S-2) and G-3 (S-3).
  * Report to next higher echelon.
  * Consider changing the maneuver course of action if operation or support plans become
  compromised.
  Malware Attacks Against Combat Platforms
  A-65. Many modern combat platforms rely heavily on embedded computer systems. Any computerized
  system is susceptible to malware injection in the logistics chain, during maintenance, or through corrupted
  or unauthorized software updates.
  Preventive Measures
  A-66. Strict physical security and cybersecurity controls can prevent most potential sources of malware
  injection. Maintainers prevent malware injection by—
  * Verifying the source of all software updates.
  * Checking the software hash to verify software has not been manipulated.
  * Maintaining strict physical control of data storage devices and maintenance computer systems.
  * Avoiding the unauthorized use of removable storage media, such as thumb drives.
  Indicators
  A-67. Possible indications of a malware attack against combat platforms include—
  * Similar faults on multiple systems, either simultaneously or within a short period.
  * Faults related to subcomponents that rely on embedded computers for operation.
  Reaction
  A-68. If equipment maintainers suspect compromised operating software on a combat platform, they
  should—
  * Review maintenance records of software updates.
  * Report incidents to G-2 (S-2) and G-3 (S-3).
  * Report incidents to the next higher echelon.
  * Roll back software updates to the last known good configuration, if possible.