1. 1 The University of Southern Mississippi National Center for Spectator Sport Safety and Security Cyber Security Tabletop Exercise Facilitator: Facilitator: James A. McGee – National Center for Spectator Sport Safety and Security Spring 2010

2. 2 Content Exercise Rules Exercise Rules Exercise Objectives Exercise Objectives Exercise Schedule Exercise Schedule Scenario Briefings Scenario Briefings

3. 3 Exercise Rules Scenario depicts a plausible cyber security event Scenario depicts a plausible cyber security event No trick questions or “hidden” agendas No trick questions or “hidden” agendas Players have no previous knowledge of the scenario, and will receive information at the same time Players have no previous knowledge of the scenario, and will receive information at the same time Players will respond using existing plans, procedures and other response resources Players will respond using existing plans, procedures and other response resources Decisions are not precedent-setting and may not reflect your organization’s final position on a given issue Decisions are not precedent-setting and may not reflect your organization’s final position on a given issue

4. 4 Exercise Objectives Examine the capabilities of USM to prepare for, protect from, and respond to the effects of cyber attacks. Examine the capabilities of USM to prepare for, protect from, and respond to the effects of cyber attacks. Exercise senior leadership decision making and interagency coordination of incident responses in accordance with the USM Cyber Response Plan. Exercise senior leadership decision making and interagency coordination of incident responses in accordance with the USM Cyber Response Plan. Validate information sharing relationships and communications paths for the collection and dissemination of cyber incident situational awareness, response, and recovery information. Validate information sharing relationships and communications paths for the collection and dissemination of cyber incident situational awareness, response, and recovery information. Exercise intra-governmental (Federal-State) coordination and incident response. Exercise intra-governmental (Federal-State) coordination and incident response. Identify policies/issues that hinder or support cyber security requirements. Identify policies/issues that hinder or support cyber security requirements. DRAFT

5. 5 Exercise Objectives (Continued) Identify public/private interface communications and thresholds of coordination to improve cyber incident response and recovery, as well as identify critical information sharing paths and mechanisms. Identify public/private interface communications and thresholds of coordination to improve cyber incident response and recovery, as well as identify critical information sharing paths and mechanisms. Identify, improve, and promote public and private sector interaction in processes and procedures for communicating appropriate information to key stakeholders and the public. Identify, improve, and promote public and private sector interaction in processes and procedures for communicating appropriate information to key stakeholders and the public. Identify cyber physical interdependence of infrastructure of real world economic and political impact. Identify cyber physical interdependence of infrastructure of real world economic and political impact. Raise awareness of the economic and national security impacts associated with a significant cyber incident. Raise awareness of the economic and national security impacts associated with a significant cyber incident. Highlight available tools and technology with analytical cyber incident response and recovery capability. Highlight available tools and technology with analytical cyber incident response and recovery capability.

6. 6 Exercise Schedule Exercise Schedule 8:30 A.M. Participant Sign-In/Coffee 8:30 A.M. Participant Sign-In/Coffee 9:00 A.M.Introduction 9:00 A.M.Introduction Discuss general instructions and ground rules of the exercise 9:15 A.M.Exercise Overview 9:15 A.M.Exercise Overview Discuss exercise objectives, and schedule of exercise 9:30 A.M.Read Module 1 9:30 A.M.Read Module 1 A loose coalition of well financed “hacktivists” with a political agenda, who directed anti-globalization and anarchist activism, introduced a massive computer virus attack into the USM cyber system. 9:45 A.MModule 1 Discussion 9:45 A.MModule 1 Discussion DRAFT

7. 7 Exercise Schedule (Continued) 10:00 A.M.Read Module 2 10:00 A.M.Read Module 2 A cadre of “hacktivists” continued to leverage their collective capabilities to mount a coordinated cyber attack and by generating counterfeit digital certificates, the “hacktivists” directed unknowing web users to “spoofed” websites where funds were extorted and personal information was mined. 10:15 A.M.Module 2 Discussion 10:15 A.M.Module 2 Discussion

8. 8 Exercise Schedule (Continued) 10:30 A.M.Read Module 3 10:30 A.M.Read Module 3 While the nation continued to experience widespread impacts of attacks on the IT and Communications sectors, the adversary targeted individual universities. The adversary’s intent was to cause cascading disruptions stemming from specific, focused attacks. 10:45 A.M. Module 3 Discussion 10:45 A.M. Module 3 Discussion 11:00 A.M.Debriefing about Lessons Learned 11:00 A.M.Debriefing about Lessons Learned 11:30 A.M.End of Exercise/Lunch 11:30 A.M.End of Exercise/Lunch

9. 9 Cyber Security Scenario The exercise simulates a sophisticated cyber attack campaign through a series of modules directed against critical infrastructures. The intent of these modules is to highlight the interconnectedness of cyber systems with the physical infrastructure and to exercise coordination and communication between the public and private sectors. DRAFT

10. 10 Cyber Security Scenario (Continued) The exercise is a simulated event with no real world effects on, tampering with, or damage to any critical infrastructure. While the scenario is based on hypothetical but possible situations, they are not intended as a forecast of future terrorist-related events. The collective modules have three major adversarial objectives: To disrupt specifically targeted critical infrastructures through cyber attacks To disrupt specifically targeted critical infrastructures through cyber attacks To hinder the Universities ability to respond to the cyber attacks To hinder the Universities ability to respond to the cyber attacks To undermine public confidence in the Universities ability to provide/protect services To undermine public confidence in the Universities ability to provide/protect services DRAFT

11. 11 Scenario Briefing – Module 1 March 01, 2010 The following incidents involving disruptions to cyber security at USM have been reported: Hackers recently broke into the USM computer database, which could potentially compromise student, faculty and staff records. Hackers recently broke into the USM computer database, which could potentially compromise student, faculty and staff records. Upon consulting with the MS-ISAC, it was revealed that six other universities were having similar problems. Upon consulting with the MS-ISAC, it was revealed that six other universities were having similar problems. Reports that certain USM on-line service support systems (everything from SOAR to financial aid) are down or behaving erratically due to what appears to be a massive computer virus attack. Reports that certain USM on-line service support systems (everything from SOAR to financial aid) are down or behaving erratically due to what appears to be a massive computer virus attack. DRAFT

12. 12 Module 1 Key Discussion Questions What kind of information is available to faculty, staff, students, and parents about an attack to the cyber system? What kind of information is available to faculty, staff, students, and parents about an attack to the cyber system? Have faculty, staff, community and emergency response partners been involved in providing input and feedback for crisis planning for schools? Have faculty, staff, community and emergency response partners been involved in providing input and feedback for crisis planning for schools? Will faculty and staff play a role in the incident command structure once the Incident Command System (ICS) is activated during an emergency? If so, what is the role? Will faculty and staff play a role in the incident command structure once the Incident Command System (ICS) is activated during an emergency? If so, what is the role? Is the USM current emergency response plan suited for a cyber attack? Is the USM current emergency response plan suited for a cyber attack? Is there a communication plan for keeping faculty, staff and students informed of decisions regarding attacks to the cyber system? Is there a communication plan for keeping faculty, staff and students informed of decisions regarding attacks to the cyber system? DRAFT

13. 13 Module 1 Questions DRAFT

14. 14 Scenario Briefing – Module 2 March 05, 2010 The “hacktivists” specifically targeted several critical infrastructure sectors, along with state and federal agencies, the media, and universities. The “hacktivists” specifically targeted several critical infrastructure sectors, along with state and federal agencies, the media, and universities. By generating counterfeit digital certificates, the “hacktivists” directed unknowing USM web users to “spoofed” websites where funds were extorted and personal information was mined. By generating counterfeit digital certificates, the “hacktivists” directed unknowing USM web users to “spoofed” websites where funds were extorted and personal information was mined. DRAFT

15. 15 Scenario Briefing – Module 2 March 05, 2010 Coordinated attacks on domain name servers and telecommunications router infrastructure resulted in a distributed denial of service and unreliable telephony. Users were intermittently unable to access websites, send email, and make phone calls. Victims of the attack were forced to explore alternative methods of communication during the disruptions. Coordinated attacks on domain name servers and telecommunications router infrastructure resulted in a distributed denial of service and unreliable telephony. Users were intermittently unable to access websites, send email, and make phone calls. Victims of the attack were forced to explore alternative methods of communication during the disruptions. The USM Chief Security Officer (CSO) has received e-mail threats and false Amber Alerts have been broadcast. The series of suspicious events compelled the USM CSO to request activation of the State’s Emergency Operations Center. The USM Chief Security Officer (CSO) has received e-mail threats and false Amber Alerts have been broadcast. The series of suspicious events compelled the USM CSO to request activation of the State’s Emergency Operations Center. DRAFT

16. 16 Module 2 Key Discussion Questions DRAFT Does the university have firewalls and countermeasures in place to protect the cyber system? Does the university have firewalls and countermeasures in place to protect the cyber system? Does the university plan to maintain educational operations in the case of a large scale cyber attack? If so, what plan is in place for maintaining continuity of instruction/business? Does the university plan to maintain educational operations in the case of a large scale cyber attack? If so, what plan is in place for maintaining continuity of instruction/business? Does the university have established communication protocols with community and emergency response partners during a massive cyber attack? Does the university have established communication protocols with community and emergency response partners during a massive cyber attack? What is the universities plan to communicate with media for latest information dissemination? What is the universities plan to communicate with media for latest information dissemination? What is the universities plan to communicate with emergency response partners during a cyber attack of this nature? What is the universities plan to communicate with emergency response partners during a cyber attack of this nature?

17. 17 Module 2 Questions DRAFT

18. 18 Scenario Briefing – Module 3 March 09, 2010 After evaluating the alleged incidents, the Governor determined that the threats were coordinated and serious enough to stand up the State Emergency Operations Center and reported the situation to the MS-ISAC. Several Federal law enforcement, intelligence, homeland security, defense, and sector-specific departments/agencies were notified. After evaluating the alleged incidents, the Governor determined that the threats were coordinated and serious enough to stand up the State Emergency Operations Center and reported the situation to the MS-ISAC. Several Federal law enforcement, intelligence, homeland security, defense, and sector-specific departments/agencies were notified. The State obtained one of the counterfeit Malware CDs and successfully installed countermeasures to successfully halt the attacks, the USM CSO received indication from the attackers that this type of situation would reoccur if their extortion demands were not met. The State took the threat seriously, coordinating efforts with the Federal Bureau of Investigation (FBI) to apprehend the adversary and continued their cyber response procedures. The State obtained one of the counterfeit Malware CDs and successfully installed countermeasures to successfully halt the attacks, the USM CSO received indication from the attackers that this type of situation would reoccur if their extortion demands were not met. The State took the threat seriously, coordinating efforts with the Federal Bureau of Investigation (FBI) to apprehend the adversary and continued their cyber response procedures. DRAFT

19. 19 Scenario Briefing – Module 3 March 09, 2010 While the nation continued to experience widespread impacts of attacks on the IT and Communications sectors, the “hacktivists” targeted individual universities. The “hacktivists” intent was to cause cascading disruptions stemming from specific, focused attacks. While the nation continued to experience widespread impacts of attacks on the IT and Communications sectors, the “hacktivists” targeted individual universities. The “hacktivists” intent was to cause cascading disruptions stemming from specific, focused attacks. As the events unfolded, law enforcement and intelligence agencies gathered information and responded as necessary. In coordination with the impacted private sector entities and other government agencies, law enforcement and the Intelligence Community worked to halt attacks and restore confidence in the Internet. All participating organizations relied on trusted relationships and forged new communications paths to share information and build and pass along situational awareness. As the events unfolded, law enforcement and intelligence agencies gathered information and responded as necessary. In coordination with the impacted private sector entities and other government agencies, law enforcement and the Intelligence Community worked to halt attacks and restore confidence in the Internet. All participating organizations relied on trusted relationships and forged new communications paths to share information and build and pass along situational awareness.

20. 20 Module 3 Key Discussion Questions What key procedures are in place to support the continuity of essential university operations, during a school closure? The following items should be considered during discussion What key procedures are in place to support the continuity of essential university operations, during a school closure? The following items should be considered during discussion Air quality/HVAC system functions Air quality/HVAC system functions Communication/Eagle Alert Systems Communication/Eagle Alert Systems Payroll Payroll Student Accounts Student Accounts How much time/school days does the university need to repair the cyber system? How much time/school days does the university need to repair the cyber system?

21. 21 Module 3 Key Discussion Questions (Continued) What is the universities plan to maintain monitoring for possible resurgence of the computer virus/attack? What is the universities plan to maintain monitoring for possible resurgence of the computer virus/attack? Does the university have agreements in place with local and/or State emergency response entities regarding cyber security measures? Does the university have agreements in place with local and/or State emergency response entities regarding cyber security measures? What are USM procedures to maintain communication with community and emergency response partners? What are USM procedures to maintain communication with community and emergency response partners? What are USM procedures to communicate with parents, students, and staff? What are USM procedures to communicate with parents, students, and staff?

22. 22 Module 3 Questions DRAFT

23. 23 Does the USM emergency management plan adequately address key issues, such as faculty and staff training in the event of a cyber attack? Does the USM emergency management plan adequately address key issues, such as faculty and staff training in the event of a cyber attack? What problems did you identify in the emergency management procedures that could hinder emergency management efforts associated with a cyber attack? What problems did you identify in the emergency management procedures that could hinder emergency management efforts associated with a cyber attack? Does the USM emergency management plan adequately address key issues faced during a cyber attack, including continuity of business operations (e.g., payroll) and student accounts? Does the USM emergency management plan adequately address key issues faced during a cyber attack, including continuity of business operations (e.g., payroll) and student accounts? Exercise Debriefing Questions DRAFT

24. 24 Exercise Debriefing Questions (Continued) Does the USM emergency management procedures properly coordinate communication as an emergency response activity among colleges, students, faculty, staff and community and emergency response partners during a cyber attack? In your opinion, what can be done to improve communication during an emergency situation such as the cyber attack scenario presented in the exercise? Does the USM emergency management procedures properly coordinate communication as an emergency response activity among colleges, students, faculty, staff and community and emergency response partners during a cyber attack? In your opinion, what can be done to improve communication during an emergency situation such as the cyber attack scenario presented in the exercise? Does the emergency management plan include partnerships with local and regional partners ensuring service and support during a cyber attack? Does the emergency management plan include partnerships with local and regional partners ensuring service and support during a cyber attack? In what ways were/will parents be engaged as stakeholders during the response to cyber attack? In what ways were/will parents be engaged as stakeholders during the response to cyber attack?

25. 25 Exercise Debriefing Questions (Continued) Is there adequate support for students, faculty, and staff before, during, and after a mass cyber attack? If not, what activities and partnerships did the team identify to enhance assistance to faculty, staff, and students? Is there adequate support for students, faculty, and staff before, during, and after a mass cyber attack? If not, what activities and partnerships did the team identify to enhance assistance to faculty, staff, and students? Overall, what activities hastened recovery of the USM cyber system? What strategies prevented a greater prevalence of disruption? What are lessons learned for responding to future cyber attacks? What activities were the most helpful for recovering from the cyber attack? Overall, what activities hastened recovery of the USM cyber system? What strategies prevented a greater prevalence of disruption? What are lessons learned for responding to future cyber attacks? What activities were the most helpful for recovering from the cyber attack? What activities or processes were identified as gaps or weaknesses and will be addressed in future efforts? What activities or processes were identified as gaps or weaknesses and will be addressed in future efforts?

26. 26 END OF EXERCISE The input, feedback, and questions you generate during participation in this exercise will help improve university emergency management efforts. Currently, there is no known cyber attack in the United States and all events depicted in this exercise are fictional. The goal of this exercise is to provide universities as well as their respective community and emergency response partners an opportunity, through discussion of possible events, to better prepare for a cyber attack. DRAFT