CAPP 227 questions (IT Officer)

[Holding Pattern]

I didn't really see a place for this thread, and I hope this is the best place. I'm on the IT Officer specialty track and have a few questions.

Where can I find templates for a squadron IT plan?

How about finding group, wing, and national plans?

Are these considered to be the same thing as a plan of action? If not, where are these?

Is CyberPatriots coaching/mentoring ever going to be incorporated into this track? Does doing so qualify as Unit IT lessons?

Where do all the IT officers congregate online?

I'm 2 weeks away from starting my second year in CAP as a senior member; I'm now the newly minted IT officer (we never had one before, so no mentor for me) and I want to make sure I do this job well. If you can, please answer my questions, wish me luck, and move this thread if it is in the wrong forum.

[vento]

Partial answer here
http://captalk.net/index.php?topic=18548.msg337516#msg337516

Cap-it.us is an attempt for IT to congregate, not very active though. IT guys are lonely and nerdy.

[JeffDG]

I didn't really see a place for this thread, and I hope this is the best place. I'm on the IT Officer specialty track and have a few questions.

Where can I find templates for a squadron IT plan?

How about finding group, wing, and national plans?

Are these considered to be the same thing as a plan of action? If not, where are these?

Is CyberPatriots coaching/mentoring ever going to be incorporated into this track? Does doing so qualify as Unit IT lessons?

Where do all the IT officers congregate online?

I'm 2 weeks away from starting my second year in CAP as a senior member; I'm now the newly minted IT officer (we never had one before, so no mentor for me) and I want to make sure I do this job well. If you can, please answer my questions, wish me luck, and move this thread if it is in the wrong forum.

Check in with your Group (if you have them) or Wing IT guys...I'm a former squadron ITO, current Group ITO, and Wing Asst ITO.

My first piece of advice is that IT is made up of two components:  Information is first and foremost.  Technology is a tool to achieve the appropriate flow of information.  Don't focus solely on the technology for its own sake, focus on where information either (a) flows or (b) should flow, and then see if you can find solutions (technological or otherwise) to make it flow more smoothly.

[Holding Pattern]

I have an email fired off, and now I just have to wait. Hopefully the activity in cap-it isn't indicative of how long I have to wait.

[JeffDG]

I have an email fired off, and now I just have to wait. Hopefully the activity in cap-it isn't indicative of how long I have to wait.

There are ITOs right from squadrons up to regions hanging out here, so fire any specific questions through here and you'll get plenty of help!

[Holding Pattern]

Here is a question. In Eservices internet operations, there are none listed for our site, but I know we have a website, facebook, etc.

Should these items be listed in there and is there a process document I should follow for making sure everything is properly entered?

[JeffDG]

Here is a question. In Eservices internet operations, there are none listed for our site, but I know we have a website, facebook, etc.

Should these items be listed in there and is there a process document I should follow for making sure everything is properly entered?

It's up to the unit to enter it.

The form is pretty self explanatory.

[Holding Pattern]

Another question. Is there a CAPWATCH data dump with test data in it, and is there a block of CAP member IDs reserved for testing?

[vento]

You can pretty much do whatever you want after you download the CAPWATCH database. You can decide for yourself what IDs to use for testing since you will not mess up the original data. Or you can make up your own test records.

[Tim Medeiros]

Here is a question. In Eservices internet operations, there are none listed for our site, but I know we have a website, facebook, etc.

Should these items be listed in there and is there a process document I should follow for making sure everything is properly entered?

Yes, this information is required IAW CAPR 110-1 para 11.a and 11.c

Another question. Is there a CAPWATCH data dump with test data in it, and is there a block of CAP member IDs reserved for testing?

No, but vento is right on the ball saying that the CAPWATCH DownLoad info is read-only and that it can be used as you develop your programs/reports.

[Holding Pattern]

Next fun question. One of our laptops is old enough to still have a floppy drive. How hard is it to turn this in and get a new one issued?

[Tim Medeiros]

A major computer buy is currently in progress at NHQ.  If the computer is CAP property, I would recommend contacting Wing Logistics to see about cycling the computer out based on its usable life.

[Holding Pattern]

Should I be setting up a techsoup account? I have an upcoming cadet project to build us a dedicated eservices testing/competition lab. I have several PCs but no hard drives or licenses beyond XP. It seems techsoup has been used before by many other squadrons based on my searches of these forums.

[MajorM]

Hmm.. I think the challenge you'll have is that Techsoup accounts are tied to the FEIN of your non-profit.  I have to imagine someone has already set up an account using CAP's FEIN.  I set one up using the FEIN of the non-profit corporation that helps fundraise for our unit, but that's not an option for many units.

[arajca]

The FEIN issue is not an issue. There are MANY MANY units that have TechSoup accounts tied to the same FEIN. As long as you can send the requested information in the form they want, there's no problem.

[Holding Pattern]

Looks like techsoup has everything they need now sans a written letter from the commander approving the account.

Now I'm feeling smart that I cleared this with the commander 

[Holding Pattern]

Ok, so I have some more questions.

Here are my technician activities for this job...

Activities
During the training period, each Information Technology
Technician candidate must complete at least five of the following:
1. Prepare at least one unit IT update each month, for a period
of six months.
2. Conduct at least two unit IT current event discussions.
3. Conduct a unit IT lesson or activity for using necessary
hardware and software to manage unit affairs.
4. Develop one automated information tool for use by unit
leadership for analysis of measurable performance data.
5. Complete the online OPSEC awareness training.
6. Become familiar with and provide updates as needed to the
squadron, group, wing, and national IT plans.
7. Attend a wing or region IT Activity, an online IT Workshop,
or an Annual Conference IT Seminar.

How many IT Officers have done item 4?

On item 7, do those have to be CAP IT workshops, and CAP Annual Conference IT Seminars?

[Eclipse]

On item 7, do those have to be CAP IT workshops, and CAP Annual Conference IT Seminars?

Yes.

[Holding Pattern]

On item 7, do those have to be CAP IT workshops, and CAP Annual Conference IT Seminars?

Yes.

Darn. So Defcon doesn't count. 

So... where are these mystical CAP online IT workshops?

I'm presuming that me holding a teamspeak meeting with cadets for Cyberpatriot training doesn't count...

[Eclipse]

So... where are these mystical CAP online IT workshops?

Like the mythical CAP IT forums, they exist only in someones's mind's eye, and if you look directly at them they disappear.

You probably only have two options - request that the approver of the rating for you waive the requirement based on it not being
possible to complete the participation in a reasonable time, or push for a seminar at your next Wing or Region conference, etc.

One of the reasons I didn't bother with IT, even though I've been doing it for CAP for 15 years and it's my profession, is that
due to the lack of standards, plans, resources, and attention, several of the requirements were all but impossible to complete
without much more effort then they are worth.

[JeffDG]

7. Attend a wing or region IT Activity, an online IT Workshop,
or an Annual Conference IT Seminar.

Offer to host one at your next Wing Conference...easy way to do it!

How many IT Officers have done item 4?

I've done it.

As an idea, pull CAPWATCH and provide an automated way for your commander to get trends out of the data...Excel Pivot tables rock!

[DoubleSecret]

Ok, so I have some more questions.

Here are my technician activities for this job...

Activities
During the training period, each Information Technology
Technician candidate must complete at least five of the following:
1. Prepare at least one unit IT update each month, for a period
of six months.
2. Conduct at least two unit IT current event discussions.
3. Conduct a unit IT lesson or activity for using necessary
hardware and software to manage unit affairs.
4. Develop one automated information tool for use by unit
leadership for analysis of measurable performance data.
5. Complete the online OPSEC awareness training.
6. Become familiar with and provide updates as needed to the
squadron, group, wing, and national IT plans.
7. Attend a wing or region IT Activity, an online IT Workshop,
or an Annual Conference IT Seminar.

How many IT Officers have done item 4?

On item 7, do those have to be CAP IT workshops, and CAP Annual Conference IT Seminars?

I don't suppose there's any chance of The Powers That Be declaring this thread to be an online IT workshop, thus complying with Item 7?

v/r
Lt Col Enabler

[Holding Pattern]

Ok, so I have some more questions.

Here are my technician activities for this job...

Activities
During the training period, each Information Technology
Technician candidate must complete at least five of the following:
1. Prepare at least one unit IT update each month, for a period
of six months.
2. Conduct at least two unit IT current event discussions.
3. Conduct a unit IT lesson or activity for using necessary
hardware and software to manage unit affairs.
4. Develop one automated information tool for use by unit
leadership for analysis of measurable performance data.
5. Complete the online OPSEC awareness training.
6. Become familiar with and provide updates as needed to the
squadron, group, wing, and national IT plans.
7. Attend a wing or region IT Activity, an online IT Workshop,
or an Annual Conference IT Seminar.

How many IT Officers have done item 4?

On item 7, do those have to be CAP IT workshops, and CAP Annual Conference IT Seminars?

I don't suppose there's any chance of The Powers That Be declaring this thread to be an online IT workshop, thus complying with Item 7?

v/r
Lt Col Enabler

Make sure you reply to my automated data collection tool I'm using to generate statistics!

[Tim Medeiros]

So... where are these mystical CAP online IT workshops?

You probably only have two options - request that the approver of the rating for you waive the requirement based on it not being
possible to complete the participation in a reasonable time, or push for a seminar at your next Wing or Region conference, etc.

Or, you could do the other activities mentioned, you don't have to do all of them.


Starfleet Auxiliary,
I'm another who developed an automated tool, it was doing some nifty things with CAPWATCH but in a combination of MS Access and Excel.  I'm currently working on another for my current unit, think SIMS but online.  I'm using it as a way to teach myself .NET and T-SQL.  Also, yes I answered your survey.

[a2capt]

SIMS online .. yeah, heck of a project, but I had dreams of grandeur .. converting it to a PhP/MySQL solution. Run side by side with eServices.

[Nuke52]

7. Attend a wing or region IT Activity, an online IT Workshop,
or an Annual Conference IT Seminar.

On item 7, do those have to be CAP IT workshops, and CAP Annual Conference IT Seminars?

I don't suppose there's any chance of The Powers That Be declaring this thread to be an online IT workshop, thus complying with Item 7?

v/r
Lt Col Enabler

Ask and you shall receive!

By the powers vested in me by the Commonwealth of Rhode Island and Providence Plantations and in concurrence with Boards of Governors and Trustees of the Middle Tennessee State Vocational College for Women, we, the undersigned, hereby declare this thread to be an official CAP online IT workshop, in compliance with Item 7 above, and with all of the rights, privileges, and responsibilities thereto appertaining.  Signed, this 20th day of February, anno domini 2015.

Please submit your duly completed CAPFs 11 in triplicate and a check or money order for $99.95 to my PayPal account at nuke53@earlscheib.com.

Oh, and:  You're Welcome.

[Spaceman3750]

SIMS online .. yeah, heck of a project, but I had dreams of grandeur .. converting it to a PhP/MySQL solution. Run side by side with eServices.

What would an online sims give that eservices doesn't?

[Eclipse]

SIMS online .. yeah, heck of a project, but I had dreams of grandeur .. converting it to a PhP/MySQL solution. Run side by side with eServices.

What would an online sims give that eservices doesn't?

Less and less every day, but if it maintained current capabilities. it still tracks a lot of stuff eServices doesn't.

[Holding Pattern]

Next question: We have a SUI coming up. I perused this doc: http://capmembers.com/media/cms/SUI_Guide2011_draft_110216_0CA38AF4FE3B5.doc

And found nothing for me to track or otherwise worry about.

That worries me.

Should I just build a benchmark of my own and submit it to the commander for review?

[Eclipse]

That guide is no longer in use.

See here for current checklists:  http://www.capmembers.com/cap_national_hq/inspector_general/sui/

[Holding Pattern]

I looked there, and I see nothing for IT. Am I missing anything?

[lordmonar]

Next question: We have a SUI coming up. I perused this doc: http://capmembers.com/media/cms/SUI_Guide2011_draft_110216_0CA38AF4FE3B5.doc

And found nothing for me to track or otherwise worry about.

That worries me.

Should I just build a benchmark of my own and submit it to the commander for review?

No.

a) There is enough BS in the SUI as it is.
b) If it is not in the SUI guide it will not weigh on the SUI one way or the other.  You get your rating based on the grading matrix provided.   You may have the worlds greatest IT program, but as far as the SUI is concerned it just does not matter.

[Eclipse]

I looked there, and I see nothing for IT. Am I missing anything?

Not missing anything, as Lord said just no longer part of the SUI.

[JeffDG]

I looked there, and I see nothing for IT. Am I missing anything?

Not missing anything, as Lord said just no longer part of the SUI.

Never was.

[Tim Medeiros]

To be honest, if IT were going to be a part of the inspection process, it would likely ask questions about approved internet operations, and asking if homegrown systems require the password rules outlined in CAPR 110-1, and maybe ensuring that SSANs are not stored in said systems.  Quick, simple, and to the point.

[Holding Pattern]

To be honest, if IT were going to be a part of the inspection process, it would likely ask questions about approved internet operations, and asking if homegrown systems require the password rules outlined in CAPR 110-1, and maybe ensuring that SSANs are not stored in said systems.  Quick, simple, and to the point.

And that is pretty much what I figured it would be instead of a giant blank space.

On the flip side, I found out our squadron website had a website before it's '90s iteration that is still floating around online in limited fashion... I'm going to reach out to the host later and see if he has any archived files that a squadron historian might be interested in.

[Holding Pattern]

In other news, today I have discovered AFI 33-129, Web Management and Internet Use.



http://www.au.af.mil/au/awc/awcgate/edref/afi33-129.pdf

This may be useful to other people that want to put together internal procedures where none exist.

[Tim Medeiros]

In other news, today I have discovered AFI 33-129, Web Management and Internet Use.



http://www.au.af.mil/au/awc/awcgate/edref/afi33-129.pdf

This may be useful to other people that want to put together internal procedures where none exist.

Heads up, according to epubs, that AFI has been superseded.  Poking around for its current existence now.


Edit: Found, enjoy, http://static.e-publishing.af.mil/production/1/saf_cio_a6/publication/afi33-115/afi33-115.pdf

[kwe1009]

In other news, today I have discovered AFI 33-129, Web Management and Internet Use.



http://www.au.af.mil/au/awc/awcgate/edref/afi33-129.pdf

This may be useful to other people that want to put together internal procedures where none exist.

Heads up, according to epubs, that AFI has been superseded.  Poking around for its current existence now.


Edit: Found, enjoy, http://static.e-publishing.af.mil/production/1/saf_cio_a6/publication/afi33-115/afi33-115.pdf

Good catch.  When looking for Air Force regulations just go to the e-publishing website.  If it is not there then it no longer exists.  It is also where you will see the most current versions of any USAF form or publication.

[Holding Pattern]

Excellent. Thank you all for the great feedback I've gotten from this thread. I've learned an exceptional amount from you all thanks to this thread.

[Tom Eggers]

Reply #21 asks how he can do this for his IT tech rating:
4. Develop one automated information tool for use by unit
leadership for analysis of measurable performance data.

One very good way is to download CAPWATCH data for your unit, then use SQL to write a report that doesn't already exist in eServices, then track the numbers over time by recording the numbers in a graph. Any project needs goals, goals need metrics to measure progress, and progress shows most clearly on a graph.

twe

[Tom Eggers]

I'm in the process of updating the IT specialty track study guide, CAPP227. As a couple of the replies in this topic have noted, some of the activity items for the ratings are hard, if not impossible, to accomplish. Therefore I want to update the list of activities for each of the three ratings. Please post here, or send me an email, your suggestions of what should be kept, what should be removed, and, most importantly, what items might be added to the activity lists to make them more realistic and to give more than seven options.

An example, OPSEC can be deleted: it's now required for Level 1. Another: formal IT or CS education, such as an associates or a bachelor's degree, can be added to the list, thus giving another optional way to get to the five required activities.

Gentlemen, start your engines and give me more ideas.

Tom Eggers, Lt Col
Director, COWG/IT
Member, National IT Committee

[Tom Eggers]

Reply #2 asks these questions:
(1) Where can I find templates for a squadron IT plan?
(2) How about finding group, wing, and national plans?
(3) Is CyberPatriots coaching/mentoring ever going to be incorporated into this track?

Answers to be in the revised CAPP 227 I'm working on for the National IT Committee:
(1) This task will be replaced with something realistic. I've never seen such a template either.
(2) Ditto, any echelon plans.
(3) Yes. One of the tasks for each of the three ratings will be "Act as Coach, Team Assistant, or Mentor for one season of a Cyber Patriot team."

I need more tasks to replace the current unrealistic ones. Please post your suggestions here. I'm watching, and I have Notify set.

twe

[Holding Pattern]

I'll review my notes (and my old posts) and post some thoughts on this over the next week.

[Holding Pattern]

Reply #2 asks these questions:
(1) Where can I find templates for a squadron IT plan?
(2) How about finding group, wing, and national plans?
(3) Is CyberPatriots coaching/mentoring ever going to be incorporated into this track?

Answers to be in the revised CAPP 227 I'm working on for the National IT Committee:
(1) This task will be replaced with something realistic. I've never seen such a template either.
(2) Ditto, any echelon plans.
(3) Yes. One of the tasks for each of the three ratings will be "Act as Coach, Team Assistant, or Mentor for one season of a Cyber Patriot team."

I need more tasks to replace the current unrealistic ones. Please post your suggestions here. I'm watching, and I have Notify set.

twe

Ok, I've done a bit of a review and here are my first thoughts.

1. I actually think we do need an IT plan. I've been using Trello to build our squadron IT plan, and it works well, but it has the problem of not being used by anyone but the IT people. Which is a very small group. This leads me to...
2. We need to seriously reach out to IT people to get them to join. The good news is that we have several carrots for this that aren't being utilized:
     a. CyberPatriot Dreamspark membership. This literally hands $20k worth of software to each coach and competitor. With the dissolution of Technet subscriptions, trust me, people in IT want this.
     b. AEX tools. Things like AGI's STK, and the training to use it are suddenly becoming popular because of a silly little computer game called the Kerbal Space Program.
     c. NASA software. Under the CAP banner, we can actually request a slew of tools from the NASA software catalog. This is another one of those best kept secrets we don't talk about because we don't know about them.
     d. Techsoup software. This covers everything from Adobe to Microsoft, and let's people deploy a computer lab at a fraction of the price they might otherwise be able to.

Now, why are these carrots? (and how do we make sure people are joining to use these tools for CAP and not other things?) The good news is that a lot of IT people can be bought for the price of shiny objects to work on. Not own, not be the name on the wall, just work on shiny objects.

[tangent]
That means we need to buy shiny objects sometimes, like lots of ram and solid state drives for issued computers. I bought 4 laptops 2 years ago out of my own pocket and upgraded them to 8/16GB RAM and 120GB SSDs because it shaved an hour off the windows update portion of the cyberpatriot competition. That cost me under $1000 (2 thinkpad x201, 2 w510 models.) Did you know that when you then put refurbished SSDs in the optical drive slot instead and run the VM on that channel the windows updates for the competition images go even faster? The cadets know this now...)

Now I have 2 issued CAP laptops that were sent to me with 4GB RAM and a 32-bit OS on them.

The good news, I got permission to nuke the OS from wing and install 64 bit OSs on them. I got squadron approval to spend $100 on maxing the ram in both machines.
[/tangent]

The point of that tangent is that for one year I put $1k into CAP and got $20k in return. I like that rate of return.

And tech people think that way a lot.

I realize I skipped a portion on part 1: Why we need an IT plan.

Our laptops need to remain "mission-ready," that is, when we are engaging in activities and missions, I need to be able to hand off laptops to the teams and know that:
1. The system is updated fully.
2. The system is secured to the best of my ability.
3. The system has all necessary IT resources the mission/activity needs.
4. The system has a backup on file.
5. The system has a failsafe plan.

The lack of guidance in CAPP on this meant that I had a lot of catching up to do. Setting dates on my calendar to watch Patch Tuesday carefully, building group policies, learning how to use windows SCM and the localGPO tool it has to do that in our non-domain environment, adding our crisis plan and cap regs to each laptop, creating users for each laptop and teaching users where resources are, creating bookmarks with links to all relevant resources when used as an internet connected device, backing up files to google drive, and preparing LPS Linux on CDs to use in case of a hard disk failure and USB drives with extra copies of necessary files.

In addition to this:

I need to build a curriculum for Cyberpatriot training. I am unashamed to say that I use the training slides they give us only when I had no time to prepare my own lecture that boils down to how to use the scientific method in conjunction with google to solve problems. But I need to keep coming up with new problems.

Then I also have web design and maintenance to take care of.

And teaching new users how to use CAP apps on google. Every time I see a cap.gov email with a survey question or registration that is NOT using google forms and is relying on individual email responses that need to be manually updated in a spreadsheet, I feel we IT officers have failed our users.

If I don't have a squadron IT plan, the chances of me forgetting to do one of these things? Pretty good to nearly certain.

Right now I'm behind on my projects, and I was thinking: What happens if I take 3 months off from my CAP stuff? I'm replacing carpet and a water heater in my house over the next 3 months, so more personal time is needed.

Then I realized that my trello board is my continuity book, and that the only other IT officer we have is leaving our squadron next month (moving across the state.) Hence a good portion of the above info talking about how to recruit IT people.

I suspect that after a short push on this front using the carrots I mentioned that I should have 5 new people online in short order after advertising this in appropriate areas.

Next up, I would suggest writing the pamphlet requirements with some fuzziness on Cyberpatriot; specifically, make it read that we would need to be a coach/mentor/assistant in a nationally recognized cyber-security competition the cadets participate in. That way when the AFA changes CyberPatriot to CyberCommando you don't have to update the regs (see the NRA badge in captalk history for an example of how this can go poorly.)

I would also suggest that OPSEC/INFOSEC not be removed from the pamphlet: It should be expanded to having the IT officer giving quarterly updates to cadets and SMs on how to use encryption, how to use 2-factor authentication with google apps, how to spot scams, and how to protect our confidential data, along with learning how to separate publicly releasable data from confidential data in an effort to help the PAO/PIOs.

Further thoughts on expanding this can be found here: http://www.af.mil/cybersecurity.aspx

As an aside, I especially like the updated purple dragon patch on there.

Another suggestion is that IT officers either take point or brief PAO/PIOs on how to give presentations WRT protecting critical infrastructure. There are a lot of resources out there that individuals and business owners just don't know about. If we do this right, CAP can become instrumental across the nation in helping to implement PPD-8 and EO 13636. I'd like to envision a point where we got CAP IT respected to the point of being a viable cyber incident responder. It's good to have dreams, right?

Anyhow, these are my current and somewhat disjointed thoughts on the subject. I now return to figuring out what the next thing is on my house that is planning on breaking.

[JC004]

...
Now I have 2 issued CAP laptops that were sent to me with 4GB RAM and a 32-bit OS on them.
...

What is with the 32 bit OSs anyway? 

[SarDragon]

Olde, and cheap.

[Holding Pattern]

Olde, and cheap.

Nope. Since windows 7 at least, Windows product keys are interchangable between bitness.

[JC004]

I didn't think the machines were very old.  I'd have to check.

[Holding Pattern]

I didn't think the machines were very old.  I'd have to check.

The machines aren't old. They are just being shipped with 32-bit OSs because OEMs think that 4GB ram will NEVER need to run a 64 bit OS...

[JeffDG]

I didn't think the machines were very old.  I'd have to check.

The machines aren't old. They are just being shipped with 32-bit OSs because OEMs think that 4GB ram will NEVER need to run a 64 bit OS...

And basically throw 25% of your RAM down the crapper.  32-bit Win7 can address 3 GB of RAM, leaving your fourth completely useless.