text: Chapter 1
  without becoming an enemy that U.S. forces might engage in the physical domains. For this discussion, threat
  actors encompass both adversaries and enemies.
  1-79. DOD networks and information systems face continuous risk from a variety of threat actors. Every
  day, DOD networks come under attack by threat actors including—
  * Insider threats.
  * Foreign intelligence entities.
  * Military or political opponents.
  * Terrorist groups.
  * Non-state actors (criminal and activist organizations).
  1-80. These threat actors use many methods to disrupt, degrade, destroy, exploit, alter, or otherwise adversely
  affect the Army’s use of cyberspace. Elements of the network reside across the physical domains, with
  different methods of communicating and varying levels of interconnectivity and isolation. Threat actors may
  seek to exploit any network node, communications link, or the data residing in or traversing the nodes and
  links. Connecting critical infrastructure to the network exposes it to the risk of cyberspace attack.
  1-81. Cyberspace allows threat actors to operate anonymously or to obscure their identity and location. This
  allows threat actors to pose as friendly actors and deceive individuals into divulging sensitive information or
  circumventing security measures—likely without realizing they have done so—through social engineering
  or phishing. Threat actors can attack Army systems, networks, and information assets by manipulating
  unsecured systems.
  1-82. The same gateways that facilitate information exchange and allow legitimate outside users to access
  the network present attack vectors threat actors attempt to exploit. Threat actors often use the same
  commercial networks as noncombatant civilian populations, complicating cyberspace attack attribution and
  response.
  Note. Social engineering uses techniques that rely on weakness in human nature rather than
  software. The goal is to deceive people into revealing passwords and other information that
  compromise the security of automated information systems and networks.
  1-83. The broad range of threat actors in cyberspace increases the complexity in securing the Army network.
  The enduring nature of threat activities in cyberspace causes U.S. forces to expend considerable resources
  and effort securing DOD networks. Network-enabled operations are a force multiplier and a traditional
  strength of U.S. forces. However, network-enabled operations also create significant vulnerabilities. The
  extent to which U.S. forces rely on networked capabilities presents broad cyberspace and electromagnetic
  spectrum attack surfaces.
  1-84. Failing to protect even one system can create a foothold into the network and place sensitive data, U.S.
  operations, and lives at risk. Even when cyberspace defenders discover and stop an attack, they might not be
  able to attribute it to a particular source. Following cybersecurity best practices, defending the network, and
  adhering to operations security guidelines help protect DOD networks and data.
  1-85. Threat actors may undertake intelligence gathering within the Department of Defense information
  network (DODIN), either to support their operations or to counter U.S. operations. Exploitation reveals
  information resident on, or transiting through, a system. Threat intelligence activities can compromise
  sensitive operational information.
  1-86. Trusted insiders with legitimate access to systems pose one of the most difficult threats to counter.
  Insiders are the most dangerous threat to operations security because they can readily access sensitive
  information.
  1-87. A peer threat will systematically and continuously combine all available means to attack U.S. and
  allied network capabilities to create effects in the information environment. Peer threats will use deceptive
  tactics such as phishing attacks to gain access to Army networks for follow-on cyberspace operations.