ATE PI Conference Using Cyber Security Command Post

ATE PI Conference Using Cyber Security Command Post Exercises (CPX) To Identify Workforce Needs Larry Lee Cybersecurity and Computer Forensics Education DUE: 0302734

Overview n Related Terms n Critical Infrastructure n Types of CPXs n Dark Screen n Workforce Skills 1

Related Terms CPX (Command Post Exercises) Cyber War Games Desktop Exercises Scenario-based Exercises Scenario-driven Brain Storming TTX (Tabletop Exercises) Tabletop War Gaming 2

Critical Infrastructures Definition n “those systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety” 3

GAO Designates Cybersecurity a High Risk Significant, pervasive information security weaknesses continue to put critical federal operations and assets at high risk. Among other reasons for designating cyber critical infrastructure protection high risk is that terrorist groups and others have stated their intentions of attacking our critical infrastructures, and failing to adequately protect these infrastructures could adversely affect our national security, national economic security, and/or national public health and safety. GAO Report to Congress on Protecting Information Systems Supporting the Federal Government and the Nation’s Critical Infrastructures (January 2003) 4

Critical Infrastructures n n Energy n Oil, Gas Transportation n n Oil & Gas Production and Storage Government Transportati on Satellite Air, Ground WALL ST. Wall WALL Banking and Finance Information and Telecommunications Public Utilities Business Street Electric Power Telecom Water Supply Emergency Services Government Banks/Finance Information Agriculture Government Adapted from Kelly, 2001 and Scalingi, 2003 5

Critical Infrastructure Interdependency Fuels, Lubricants Power for Signaling, Switches Water Power for Pump and Lift Stations, Control Systems or Water f , n li Coo g uction ns Red Emissio Electric Power Fuel Transport, Shipping Power for Compressors, Storage, Control Systems or Fuel f ors at Gener S Com CADA, mun icati ons Wat Po er fo r Co Sw wer olin g itch for SCA es DA, Co mmu nica ti Natural Gas SCADA, Communicatio ns Power for Pumping Stations, Storage, Control Systems ing Water for Production, Cooling, Emissions Reduction SCADA, Communications Fuels, Lubricants Transportation Sh ipp Oil Fuel Transport, Shipping Fuel for Generators, Lubricants Heat DA, ns SCAnicatio mu Com Telecom ons ing p Ship Fuel for Generators Adapted from Rinaldi et al. , 2001, and Scalingi, 2003 6

Critical Infrastructure Interdependency n “We, as a country, have put all of our eggs in one basket. . . we’ve successfully dominated the world economically and militarily because of the systems that we have designed, and relied upon. . its our Achilles heel” Richard Clarke 7

Cyber Security CPXs n n n Argonaut (England) Black Demon (USAF/DD) Black Ice (DOE Office of CIP) Blue Cascade (Pacific NW) Cyber Defense Exercise (CDX) 2004 n n n Service Academies Dark Screen (UTSA) Eligible Receiver (DOD/NSA) Hackfest (ARFL/Symantec) Livewire (DHS) Top. Off (DHS/ODP) 8

Types of CPX n Table Top Exercise n n n Normally very low cost Anyplace, anytime Small number of participants Could be for any type of objective Could be the first phase of a larger exercise 9

Types of CPX n Scenario-based n n Many organizations, not many people Frequently examines existing or new procedures Also could be part of an exercise “buildup” More costs, more disruption to regular activities 10

Type of CPX n Full-scaled n n Highest cost Most people involved Inter-agency, intergovernmental, intersector Occasional due to costs 11

Operation Dark Screen n Year-long, three phased scenario-based exercise n n n Table top Scenario-based Modified Full-scaled Designed to evaluate regional organizations’ capabilities to prevent, detect, and respond to cyber security incidents Initiated by Rep. Ciro Rodriguez (D-TX) Conducted by UTSA’s Center for Infrastructure Assurance and Security (CIAS) 12

ODS-CC Participants 2003 -2004 n n n n City of Corpus Christi (CC) MIS Corpus Christi EOC CCPD MIS CCFD MIS CC Emergency Management Office CC Risk Management Division CC Water & Gas n n n n FBI Probado Technologies USN USCG Port of Corpus Christi Del Mar College Texas A&M Corpus Christi 13

Workforce Skills n Interpersonal skills Communications n Written or oral n Common body of language n Analyzation and identification n Developing Solutions n Team building n 14

Workforce Skills n Gather and document data with the ability to: Analyze information n Ask relevant questions n Accurately summarize and document information n Synthesize and organize information n 15

Workforce Skills n Review and test plans and strategies for compliance with applicable regulations and standards with the ability to: Generate and evaluate solutions n Compare multiple viewpoints n Identify key sources of information n Pose critical questions n 16

Workforce Skills n Identify, analyze and evaluate infrastructure and network vulnerabilities Ability to: Analyze information for accuracy and consistency n Evaluate system configuration n Use prior training/experience to predict outcome n 17

Workforce Skills n Implement/test contingency and backup plans and coordinate with stakeholders Ability to: n n n Systematically organize information Evaluate critically of problems, identify possible causes and propose solutions Communicate effectively with clients 18

Workforce Skills n Develop information assurance plans and implementation strategies Ability to: Synthesize and organize information n Assume responsibility for accomplishing team goals n Analyze group/individual response n Create and develop new rules/principles n 12

Workforce Skills n Maintain and update information assurance plans and strategies as appropriate Ability to: Create data gathering process n Monitor and correct system n Devise and implement plan of action n 20

References n Kaucher, C. E. , “Exercise in Defending Cyberspace: The Capstone of Education, Training and Awareness”, Nation Defense University n Long, H. M. , “Higher Education Contribution to the National Strategy to Secure Cyberspace”, ITS, Yale University n St, Sauver, J. , “Practical Steps to Take to mitigate Computer and Network Risks”. Infraguard Conference, March 2004 n Goles, T; White, G; Dietrich, G; “Dark Screen: An Exercise in Cyber Security”, University of Texas-San Antonio, 2003 Building A Foundation for Tomorrow, Skill Standards for Information Technology, NWCET n