The president's authority to direct military operations and intelligence activities against external threats$--$including cyber threats$--$resides in his powers as

Title $10$ and Title $50$ of the US Code

The Computer Fraud and Abuse Act

Chief Executive and Commander$-$in$-$Chief under the Constitution

The War Powers Act