Train Like You’re Going to Fight—What Kind of Exercise Meets Your Needs?
•
0 likes•278 views
Cyber-exercises can be used to hone skills, build teams and practice procedures. With several different types of exercises available, which is the right type to achieve your objectives? Which is the right kind for the participants’ skill levels? Cyber-exercise expert Dr. Joe Adams explains the different types of existing exercises, how to create scenarios and how to get results from each event. (Source: RSA USA 2016-San Francisco)
Recommended
Recommended
More Related Content
Similar to Train Like You’re Going to Fight—What Kind of Exercise Meets Your Needs?
Similar to Train Like You’re Going to Fight—What Kind of Exercise Meets Your Needs? (20)
More from Priyanka Aash
More from Priyanka Aash (20)
Recently uploaded
Recently uploaded (20)
Train Like You’re Going to Fight—What Kind of Exercise Meets Your Needs?
- 1. SESSION ID: #RSAC Dr. Joe Adams Train Like You're Going to Fight What Kind of Exercise Meets Your Needs? HUM-F01 Vice President for Research and Cyber Security Merit Network, Inc.
- 2. #RSAC Agenda What is this talk about? Exercises in Context Type of Exercises Putting Cyber in Kinetic Exercises Getting Your Exercise Started 2
- 3. #RSAC Introduction Why you’re here Talk about which type of exercise suits your objectives What you’ll take away from this presentation Steps to create an exercise Survey of exercise types Why this is important Validating processes in a controlled environment 3
- 4. #RSAC Glossary CTF – Capture the Flag. A tactical, hands-on, technical exercise DFIR – Digital Forensics, Incident Response. The two sides of cleaning up a big mess. Inject – What I do, during an exercise, to get a response. This is directly connected to the task and context the exercise is testing. 4
- 5. #RSAC Training Cycle 5 Classes (individual skills) Procedure Exercises Contextual Exercises Assess
- 6. #RSAC Why you need to exercise Complements classes -- Crawl -> Walk -> Run Validates & reviews processes Practices procedures – team dynamics Delivers a big picture view of a process or situation 6
- 7. #RSAC What you need to exercise Legal/Policy Media Engagement/Breach Notification Insurance coverage Response plans Not purely technical! Get everyone involved! 7
- 8. #RSAC Who needs to participate? Managers across the company Sales & Marketing Finance IT IT staff DFIR teams 8
- 9. #RSAC The Key Components 9 Make it worth the time! Record Review Report Show the results
- 10. #RSAC What gets in the way Budget Time Experience in putting an exercise together Unwarranted belief in untrusted skills 10
- 11. #RSAC Who else does exercises? The usual suspects: Government, DoD, DHS Usually kinetic. Increasingly including cyber Healthcare, Finance Moving from tabletop exercises to more hands-on exercises Demonstrate planning and response Utility Companies Large & medium sized companies (CIP v5) 11
- 13. #RSAC Types of exercises Table Top Exercise (TTX) Capture the Flag (CTF) Red vs Blue Red on Red Digital Forensics/Incident Response (DFIR) 13
- 14. #RSAC Table Top Exercises Just like it sounds All you need is a table Use a note taker Applicable to: All levels (technical through executive) All sections (make the geeks talk to accountants!) 14
- 15. #RSAC Table Top Exercises 15 Objectives: - Explore scenarios - Verify procedures Benefits: - Identifies stakeholders - Identifies critical elements of info - Clarifies a taxonomy Time Frame: - 4-6 hours before eyes glaze over Constraints: - Not real time! - Beware of hand waving Table Top Exercises
- 16. #RSAC Capture the Flag Technical Seen at most (all?) hacker conferences Does everyone get a copy or is it a shared environment? Applicable to: Recruits Students Technical staff 16
- 17. #RSAC Capture the Flag 17 Objectives: - Individual or small team skills - Use the tools Benefits: - Technical focus - Fun! Time Frame: - 6-12 hours Constraints: - Development time - Assessment / scoring Capture the Flag
- 18. #RSAC Red vs. Blue I attack, you defend Run locally, run nationally Cyber Patriot National Collegiate Cyber Defense Competition Inter-service Academy Cyber Defense Exercise Applicable to: Students (culmination event) IT Teams 18
- 19. #RSAC Red vs. Blue 19 Objectives: - Practice defense - See cause & effect in an attack Benefits: - Fun, fast, challenging - Very stressful situations Time Frame: - 1 day to a full week Constraints: - Environment development - Repeatable results? Red vs. Blue
- 20. #RSAC Red vs. Red Paintball – everyone attacks and defends Can get very chaotic! Applicable for: Advanced students Pen testing teams 20
- 21. #RSAC Red vs. Red 21 Benefits Exercises the entire spectrum of skills Requires communication Constraints Takes practice and speed – some will get overwhelmed Objectives: - Control the network - Penetrate, harden, defend systems - Communicate & Delegate Benefits: - Fun, fast, challenging Time Frame: - 6-12 hours Constraints: - Environment development - Repeatable results? Red vs. Red
- 22. #RSAC Incident Response Something bad happened Needs a lot of prep or a lot of time Do you give them disk images? Can you generate enough, realistic, log data? Applicable for: Incident response teams Generating results to inject into a TTX 22
- 23. #RSAC Incident Response 23 Objectives: - Validate Incident Response plans - Perform DFIR skills - Rapid familiarization of a network Benefits: - Practice DFIR - Demonstrate what IR teams do Time Frame: - Days, especially if evidence collection is included Constraints: - Environment development Incident Response
- 24. #RSAC Steps to Making an Exercise - Overview
- 27. #RSAC Making an Exercise Sponsor Who are we going to report the results to? Scope Definition What are we going to exercise? Who needs to be involved? 27
- 28. #RSAC Making an Exercise Objective Definition Here’s what we want to test Here’s how we’ll test it Here’s what we think you’re going to do Here’s what you did Task – Condition - Standard 28
- 29. #RSAC Making an Exercise Decide which type of exercise suits your requirements Table Top Exercise (TTX) Capture the Flag (CTF) Red vs Blue Red on Red Digital Forensics, Incident Response (DFIR) 29
- 30. #RSAC Making an Exercise Create the Scenario Realistic Applicable Keep it Simple! 30 scenario tec
- 31. #RSAC Making an Exercise Other Documentation Master Scenario Events List Timeline Communications Governs the flow of information Evaluation Guide 31
- 32. #RSAC Making an Exercise Write the Exercise Directive Objective Definition Scenario Means of Communication Timeframe Evaluation/Assessment 32
- 33. #RSAC Making an Exercise Publish the Exercise Directive Location People Participants Facilitator/Evaluator 33
- 34. #RSAC Making an Exercise - After Hotwash Immediately after the exercise Get everyone’s impressions, perceptions, gripes, and kudos Answer the sponsor’s question: “So how did it go?” After Action Review Walk through each objective and inject Results in a report with Record of what happened Follow ups and due outs 34
- 35. #RSAC Cyber in Kinetic Exercises You’re IT trying add to someone else’s exercise Substitute cyber causes for physical reasons Start small: don’t derail it or you won’t be invited back Stay with published exploits: if you claim “0 Day”, you’ll get called out Target specific systems/effects = task-condition-standard Manage expectations to make sure they know what’s coming 35
- 36. #RSAC An Example of an Exercise
- 37. #RSAC An Example Sponsor – Company CEO Scope - Small company, all sections/directors (about 14 people) Objectives - Continuity of Operations Do you have plans in place if the company is displaced? Where is the company’s data? Type – Table top exercise 37
- 38. #RSAC An Example Created a simple scenario Three phases Created injects in the form of questions Assigned responsibility for each inject Scheduled 4 hours in a conference room Included a scribe with a laptop Focus on communication between teams 38
- 39. #RSAC An Example Scenario – A fire in the office Phase 1 – The fire is happening Reporting Information dissemination Phase 2 – The inspection Temporary location (1 week to 3 months) What information is needed? Information access Phase 3 – The clean up Prolonged displacement (3 to 6 months) 39
- 40. #RSAC An Example How it went IT was defensive Finance and Sales were curious (over confident?) Marketing was the least prepared 5 hours What they discovered No backups in Marketing Many leave their laptops in the office (information access) IT relies on email to communicate and doesn’t have a backup plan 40
- 41. #RSAC An Example The follow up Cloud-based backups Emergency procurement processes Alternative communications paths Still working on Alternate locations Data access issues for specialized applications 41
- 42. #RSAC Apply what we’ve talked about Next week Pick 3 things that need to be exercised Assess your organization Within 3 months Develop a Table Top Exercise Deliver the results to potential sponsors Within 6 months Explore other, more in-depth exercises Start to plan a training cycle 42
- 43. #RSAC Summary Five types of exercises Each exercise is different Pick the type that addresses your objectives 43
- 44. #RSAC Conclusion Let objectives drive what type of exercise Get everyone involved Resources and time will scale the exercise Reports and follow up are key to holding the next one! 44