1. The value of Cyber Defense Exercises 1

2. Purpose and objectives The aim is to improve information assurance in critical infrastructure by :  Better understanding between technology and policy  Insight about exercise methodology  Take advantage of acquired knowledge  Basis for improving its own operations 2

3. Cyber Defense Exercises A way of building Trust

4. Security is all about Trust Trust between people is fundamental for any cooperation National or International And an efficient way of building trust is to participate in exercises

5. Organization and colored teams ▪Red Team (RT) Plays the adversary ▪Blue Teams (BT) Defenders of an ICT deployment (BT systems) ▪White Team (WT) Exercise control, injects, user simulation, scoring ▪Green Team (GT) Master of the infrastructure and BT systems ▪Yellow Team (YT) Situational Awareness, Info sharing channels

6. Exercise Characteristics WT RT Scenario GT BT Diversity

7. Table-top exercise WT RT Scenario GT BT Diversity BT playing different roles Driven by the scenario Roleplay by WT RT almost non existing GT, communication

8. Pure Technical CDX WT RT Scenario GT BT Diversity BT playing the same role RT provides fair pressure GT provides challenging environment Not depending on scenario WT more to supervise

9. 9

10. Concept Technical Blue/Red Team 1 Red Team VS 20 Blue Teams 3.5 days, day=8 hours for training audience Day0 for preparations Day1 & Day2 for the action Day3 for hotwash up Game: teams in fictional roles, lab networks Almost unknown environment Friendly competition Defence is the focus of training 10

11. Real life simulation 11

12. Locked Shields characteristics WT RT Scenario GT BT Diversity BT still playing the same role The scenario drives RT objectives The scenario is also a base for injects (scenario, media, legal, forensic) Same injects goes to all

13. CRATE - Cyber Range And Training Environment 2016-10-0313 The Swedish Defence Research Agency (FOI) develops and maintains a Cyber Range And Training Environment (CRATE). CRATE makes it possible to smoothly deploy and configure a large number (thousands) of virtual machines in a controlled environment. CRATE is also equipped with host based traffic generators emulating user behaviour and tools for logging and monitoring the environment. This lab resource is used to create computer networks for use during experiments, competitions and exercises in cyber security.

14. The Handbook ▪Handbook for planning, running and evaluating information technology and cyber security exercises ▪Based on Swedish Civil Contingencies Agency (MSB) exercise handbook ▪Focusing on IT and Cyber Defense exercises (CDX) ▪ISBN 978-91-86137-36-6 ▪www.fhs.se/cats (pdf)www.fhs.se/cats

15. Some reflections ▪Working under pressure together with other people to solve some problem in a safe environment enhance the trust-building process. ▪Trust is fundamental for successful cooperation between parties ▪Running CDX is challenging, start with simple technical or table-top exercises ▪To build trust, a pure technical exercise with mixed teams and high pressure from RT is good enough ▪Don't underestimate the effort needed