Examining Cooperative Strategies
through Cyber Exercises
Presented toMarch Technical Colloquium
Forum for Incident Response and Security Teams (FIRST)
Ernest W. Drew, III
March 26,2008
Tokyo, Japan

Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

Cyber Conflict – A Difficult Problem for Nationsand Enterprises
The conduct of large scale, politically motivatedconflict based on the use of offensive and defensive
capabilities to disrupt digital systems, networks, andinfrastructures, including the use of cyberbased
weapons or tools by nonstate/ transnational actors inconjunction with other forces for political ends
Definition adopted by the Cyber Conflict Studies Associationwww.cyberconflict.org
Mulvenon, James “Toward a Cyberconflict Studies Research Agenda”, IEEE SECURITY & PRIVACY JULY/AUGUST 2005

Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

Observations• Lack of Cyber Situational Awareness:
There does not appear to be an organization at
national levels responsible for providing cybersituational awareness to:• Government Agencies• Private Sector Enterprises• Who is in Charge ?:What National Agency or Private Sector
Enterprise is responsible for taking the lead in
response to a Cyber Attack?
• Whose laws apply?
• Whose regulations apply?
• Is it just a civilian problem or will militaries
become involved?
Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

Roadblocks to Coordination• Laws restrict what an Enterprise can do to defend
against attack• Privacy concerns limit the sharing of information• Regulators place constraints on information sharing• Cooperation among Nations - Treaty requirements• The problem of Attribution• The number of devices and the number of humaninteractions create complex environments

Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

Complexity• Structural complexity is based upon the number of partsin a system. The larger the number of independent partsin a system, the greater its structural complexity.
• Interactive complexity is based upon the behavior of theparts and the resulting interactions between them. Thegreater the freedom of action of each individual part andthe more linkages among the components, the greater isthe system’s interactive complexity.
The U.S. Army Commander’s Appreciation and Campaign Design , TRADOC Pamphlet 525-5-500 , January 2008

http://www-tradoc.army.mil/tpubs/pams/p525-5-500.pdf

Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

A Simple Complexity Illustration
SECTORSECTORSECTORSECTORSECTORSECTOREnterpriseEnterpriseEnterpriseEnterpriseEnterpriseEnterprise

SDM
COOP
Security

SDM
COOP
Security

SDM
COOP
Security

SDM
COOP
Security

SDM
COOP
Security

SDM
COOP
SecurityEnterpriseEnterpriseEnterpriseEnterpriseEnterpriseEnterprise

SDM
COOP
Security

SDM
COOP
Security

SDM
COOP
Security

SDM
COOP
Security

SDM
COOP
Security

SDM
COOP
SecurityEnterpriseEnterpriseEnterpriseEnterpriseEnterpriseEnterprise

SDM
COOP
Security

SDM
COOP
Security

SDM
COOP
Security

SDM
COOP
Security

SDM
COOP
Security

SDM
COOP
Security

Non
State
Actor

Government A
ISP

Nation A

SDM
COG
Security

Government B
ISP

ISP
INTERNET

SDM
COG
Security

ISP

Nation B

Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

The Complexity of the Internet

Lanet-vi program of I. Alvarez-Hamelin et al.
Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

Cyber Conflict Response: a “Wicked Problem”• Horst Rittel, a professor of Design at UC Berkeley,in1972 stated that characteristics of socially complex
problems, were as he defined; “Wicked Problems”– not wicked in the sense of evil, but rather extremelydifficult• The response to Cyber Conflict, because of its
complexity, can be defined as a “Wicked Problem”

Horst W. J. Rittel, “On the Planning Crisis: Systems Analysis of the ‘First and Second Generations,’” Bedriftsøkonomen 8 (1972), pp. 392-393
http://www.uctc.net/mwebber/Rittel+Webber+Dilemmas+General_Theory_of_Planning.pdf

Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

Properties of a “Wicked Problem”
1.
2.
3.
4.
5.

There is no definitive formulation of a wicked problem.
Wicked problems have no stopping rule.
Solutions to wicked problems are not true-or-false, but better or worse.
There is no immediate and no ultimate test of a solution to a wicked problem.
Every solution to a wicked problem is a "one-shot operation"; because there is noopportunity to learn by trial-and-error, every attempt counts significantly.
6. Wicked problems do not have an enumerable (or an exhaustively describable) set ofpotential solutions, nor is there a well-described set of permissible operations that
may be incorporated into the plan.
7. Every wicked problem is essentially unique.
8. Every wicked problem can be considered to be a symptom of another problem.
9. The existence of a discrepancy representing a wicked problem can be explained innumerous ways. The choice of explanation determines the nature of the problem'sresolution.
10. The planner has no right to be wrong (planners are liable for the consequences of theactions they generate).
Horst W. J. Rittel and Melvin M. Webber, “Dilemmas in a General Theory of Planning,” Policy Sciences 4 (1973), pp. 155-169. © Elsevier Scientific Publishing
Company, Amsterdam
http://www.uctc.net/mwebber/Rittel+Webber+Dilemmas+General_Theory_of_Planning.pdf

Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

Representative Types of Cyber Attacks

Nation State attack against
government and infrastructure

Consequence

Terrorist attack
against sector
Terrorist attack
against control systems
Terrorist attack
against companies/local government
Criminal activity against companies
Criminal activity against individuals
Spam, viruses, worms

0Probability

Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

100

Representative Responders for Cyber Attacks
Strategic
Government

ConsequenceFIRST, CERTs, Telcom-ISAC, ISPs, Anti-Virus Software Companies

TacticalLaw Enforcement
Network Operation Centers0Probability

Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

100

Definition of a Cyber Exercise
An activity that replicates disruption of computers andinformation systems to stimulate the decision-making
processes of participants. The participants make decisions
based on their plans, policies and procedures, the decisions
will then impact the course of events.
A specialized emergency preparedness exercise designed tolook at emergencies caused by disruption of the IPinfrastructure. These disruptions can be man-made, theresult of a natural disaster, or the infrastructure coming underattack by hackers, criminals, terrorists, or other governments

Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

Cyber Storm – Findings 1 of 4• Finding 1: Interagency Coordination. While the Interagency
Incident Management Group (IIMG)1 and National Cyber
Response Coordination Group (NCRCG) activated andinteracted constructively during the exercise, further refinement
is needed for operations and coordination procedures. Broader
understanding, both within government and in the private
sector, of the thresholds and ramifications of activation of thesebodies will also improve interagency coordination. Specificallythe cyber community needs to better understand the readinessand security postures to be considered based on suchactivations, as well as the level of Federal engagement they
imply.
http://www.dhs.gov/xlibrary/assets/prep_cyberstormreport_sep06.pdf
Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

Cyber Storm – Findings 2 of 4
• Finding 2: Contingency Planning, Risk Assessment, and Roles
and Responsibilities. Formal contingency planning, risk assessment,
and definition of roles and responsibilities across the entire cyberincident response community must continue to be solidified.
Responses were timely and well coordinated where existing processprocedures were clear and fully understood by players.
• Finding 3: Correlation of Multiple Incidents between Public andPrivate Sectors. Correlation of multiple incidents across multiple
infrastructures and between the public and private sectors remains amajor challenge. The cyber incident response community was
generally effective in addressing single threats/attacks, and to someextent multiple threats/attack. However, most incidents were treatedas individual and discrete events. Players were challenged whenattempting to develop an integrated situational awareness picture andcohesive impact assessment across sectors and attack vectors.

Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

Cyber Storm – Findings 3 of 4• Finding 4: Training and Exercise Program. An establishedtraining and exercise program will strengthen awareness oforganizational cyber incident response, roles, policies, andprocedures.
• Finding 5: Coordination Between Entities of Cyber Incidents.
Response coordination became more challenging as the number ofcyber events increased, highlighting the importance of cooperationand communication across the community.
• Finding 6: Common Framework for Response and Information
Access. A synchronized, continuous flow of information available tocyber incident stakeholders created a common framework forresponse, impact development, and discussions. Early and ongoing
information access strengthened the information-sharing relationshipbetween domestic and international cyber response communities.

Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

Cyber Storm – Findings 4 of 4
• Finding 7: Strategic Communications and Public Relations Plan.
Public messaging must be an integral part of a collaborated
contingency plan and incident response to provide critical information
to the response community and empower the public to takeappropriate individual protective or response actions consistent withthe situation.
• Finding 8: Improvement of Processes, Tools and Technology.
Improved processes, tools, and training—focused on the analysis andprioritization of physical, economic, and national security impacts ofcyber attack scenarios—would enhance the quality, speed, andcoordination of response. This is particularly true in the case ofintegrated or cascading attacks or consequences.

Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

Cyber Exercise - Outcomes
Outcomes may include strategies and planning
frameworks to:• Coordinate responses and consequence
management to cyber-attacks among:• Governments• Organizations• Enterprises• Maintain continuity of operations within
participating organizations – COOP and COG• Sustain confidence in government information
networks during a cyber-attack and, if
necessary, regain public confidence.

Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

Backup Slides

Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

Design Requirements for Cyber Exercises
Sponsor Determines
NeedDetermine
Objectives
Sponsor Determines
Participants

Determine Objectives(Participant)Understand Environments
Business/NetworkPlans, Policies and Procedures
Define Opposition
DefineScenario
DefineAttacks/Disruptions

Phase 1
Phase 2Phase 3Phase 4

Define MSEL

Documents

TTX EXERCISE

Control

AAR

Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

Types of Cyber Exercises• Tabletop Exercises– Tabletop Exercises involve senior staff and other key personnel in an informal
setting to discuss simulated situations. This type of exercise is intended tostimulate discussion of various issues regarding a hypothetical situation. It canbe used to assess plans, policies, and procedures.

• Functional Exercises– The Functional Exercise (FE) is designed to test and evaluate individual
capabilities, multiple functions or activities within a function, or interdependentgroups of functions….. The objective of the FE is to execute specific plans andprocedures and apply established policies, plans, and procedures under crisis
conditions, within or by a particular function team(s).

• Full-Scale Exercises– In a Full-Scale Exercise (FSE), prevention and response elements are required
to mobilize and deploy to a designated site or locale in response to a simulated
attack, generally for an extended period. It involves testing a major portion ofOperations Plans and organizations under field conditions
Homeland Security Exercise and Evaluation Program Volume I: Overview and Doctrine
http://www.crcpd.org/Homeland_Security/HSEEPv1.pdf
Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

Participants••••

In a Cyber Exercise players come from many organizations. They
are usually representatives who have active roles in the daily
management, operations, and security of their information networks,systems, and infrastructure.
These participants play key roles in responding and managing theconsequences of the significant cyber disruption presented in thescenario injects.
Participation is usually voluntary, however depending on theobjectives of the exercise, it may be necessary to make participation
mandatory for designated personnel.
The exercise may have Private Sector enterprises, ISP’s, Managed
Security Providers, law enforcement, regulatory agencies, andgovernments both local and national.

Norwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755

Role of Opposition TeamAn opposition team should develop their assumptions, determine
their resources, and planned their specific attacks
The opposition team is normally an extension of control and shouldtake into account the objectives of the sponsor in order that specificattacks will stimulate a response that can be tied back to anobjectiveNorwich University Applied Research Institutes (NUARI) 57 Old Freight Yard, PO Box 30, Northfield, VT 05663-0030 +1 802 485 2755