text: Operating in a Contested Environment
  * Report to the next higher echelon G-6 (S-6) or joint force J-6 to determine whether the system
  slowdown is due to known activity on the network.
  * Report suspected attacks to the G-2 (S-2) and G-3 (S-3).
  * Continue operations using alternate or contingency communications means.
  Malware
  A-55. Malware is malicious software intentionally designed to damage a computer, server, or computer
  network. Malware attacks can affect any automated information system, including—
  * Mission command information systems.
  * Logistics systems.
  * Administrative systems.
  * End user devices.
  Preventive Measures
  A-56. Cybersecurity personnel attempt to prevent malware attacks by—
  * Using and maintaining up to date anti-virus software and virus definition files.
  * Creating and changing passwords according to the standards in Army Information Assurance Best
  Business Practices Document 04-IA-O-0001.
  * Keeping system software updated and patched.
  * Ensuring compliance with the most recent security technical implementation guidance.
  * Maintaining properly configured network firewalls.
  Indicators
  A-57. Possible indicators of a malware attack include—
  * Destruction or unexplained changes to files.
  * Spontaneous restart of computers.
  * Erratic, delayed, or unexpected computer or network activity.
  * Anti-virus software warnings.
  Reaction
  A-58. If operators or DODIN operations personnel observe indications of a possible malware attack, they
  should—
  * Report to the next higher echelon G-6 (S-6) or joint staff J-6.
  * Continue operations using alternate or contingency communications means.
  * Report to G-2 (S-2) and G-3 (S-3).
  A-59. DODIN operations personnel should not reconfigure computers or network systems in response to an
  attack unless directed by their next higher echelon.
  Data Exfiltration and Collection
  A-60. Data exfiltration may be either electronic—removing files through the network, or physical—
  removing paper or electronic copies from sensitive areas. Either method may disclose sensitive operational
  information and plans. This compromise may place operations at risk.
  A-61. All automated information system are potential targets of data exfiltration and collection. Affected
  systems include—
  * Mission command information systems.
  * Logistics systems.
  * Administrative systems.
  * End user devices.