"In order to detect, help us hunt and find where the incident started… the digital forensics, I believe we need to do, and focus, and invest in that world," said Wanda Jones‑Heath, the principal cyber adviser for the Department of the Air Force, speaking at the Datadog Threat Response Forum produced by FedScoop. Her remarks on Thursday framed digital forensics not as a secondary, after‑the‑fact discipline but as a necessary capability for keeping pace with incidents as they unfold in cyberspace.
Wanda Jones‑Heath on investing in digital forensics
Jones‑Heath argued that forensics must move from a purely retrospective role to one that supports detection and hunting in near real time. She acknowledged that forensic teams often work “after the fact,” examining weeks or months after an incident, but stressed that this reactive posture is insufficient. Her recommendation was straightforward: invest in forensic capabilities so defenders can identify where incidents begin and trace the path of compromise while operations continue.
Forensics, attribution and keeping operations running
Jones‑Heath outlined a sequence she believes forensic capability enables: identify an incident, then use forensics to determine “what happened, who did it, where they are, where it originated from” and to carve out — or “partition” — areas of a network that “are still under fire” while preserving mission continuity. That framing ties forensic work directly to operational resilience: the ability to separate compromised segments from those that must remain active during an ongoing response.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadJeffrey Hunt on the operations‑security divide
Jeffrey Hunt, global operations branch chief for the Department of Defense Cyber Crime Center, addressed a related organizational challenge at the same event. He said the split between operations and security — particularly around network visibility into threats — is “an issue that needs to be addressed early.” Hunt warned against the instinct to merge the two teams into one large unit, calling that approach a “disaster.” Instead, he advocated for a liaison model: have someone from security in the room as part of the planning team from the beginning of an operational plan, preserving separation while ensuring visibility and coordination.
Changing cyber exercises: offensive and defensive roles
Jones‑Heath also urged a rethink of how cyber exercises are run. Her critique was direct: exercises are typically not designed to mirror how forces would operate during a real engagement, and they can leave participants “in reactive mode” with “poisoned” data. She urged letting cyber teams engage on both the offensive and defensive side during exercises and encouraged sharing real‑world intelligence about adversary behavior to persuade non‑cyber participants to include cyber teams in broader formations. The goal, she said, is that when units are “in formation and you get disconnected,” everyone will “know exactly what to do.”
What this means for DoD cyber teams, security planners, and exercise coordinators
- DoD cyber teams: Expect calls to expand digital forensics capabilities beyond post‑incident analysis to support detection and real‑time hunting, and to play a more active role in exercises that test offensive and defensive coordination.
- Security planners and operations leaders: Hunt’s proposal for liaison relationships signals a push toward formalized inclusion of security personnel at the planning table rather than wholesale organizational merges that could blur roles and degrade effectiveness.
- Exercise coordinators: Jones‑Heath’s remarks press coordinators to incorporate realistic adversary behavior and allow cyber teams to operate in both attack and defense modes so exercises reflect operational realities and prepare units to respond when communications or formations break down.
The officials’ prescriptions converge on a simple operational logic: better forensic capability and earlier, structured security participation in planning can shorten the time between detection and attribution, and exercises that mirror operational complexity can reduce paralysis during real incidents. Jones‑Heath framed the problem as both technical and cultural — “we have to get over the fact that it could never happen” — and recommended sharing intelligence about adversary behavior to bring skeptics into the exercise loop.
The immediate question left by these proposals is procedural and fiscal: who within the Department of the Air Force and the wider defense enterprise will translate the call to “focus, and invest” in digital forensics into budgets, acquisition decisions and revised exercise designs, and how quickly will those changes be implemented?
