Cybersecurity and Computer Forensics Education DUE:0302734 ATE PI Conference Using Cyber Security Command Post Exercises (CPX) To Identify Workforce Needs Larry Lee Cybersecurity and Computer Forensics Education DUE:0302734

Overview Related Terms Critical Infrastructure Types of CPXs Dark Screen Workforce Skills 1

Related Terms CPX (Command Post Exercises) Cyber War Games Desktop Exercises Scenario-based Exercises Scenario-driven Brain Storming TTX (Tabletop Exercises) Tabletop War Gaming War Gaming 2

Critical Infrastructures Definition “those systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety” 3

GAO Designates Cybersecurity a High Risk Significant, pervasive information security weaknesses continue to put critical federal operations and assets at high risk. Among other reasons for designating cyber critical infrastructure protection high risk is that terrorist groups and others have stated their intentions of attacking our critical infrastructures, and failing to adequately protect these infrastructures could adversely affect our national security, national economic security, and/or national public health and safety. GAO Report to Congress on Protecting Information Systems Supporting the Federal Government and the Nation’s Critical Infrastructures (January 2003) 4

Critical Infrastructures Energy Oil, Gas Transportation Air, Ground Banking and Finance Information and Telecommunications Public Utilities Transportation Government Banks/Finance Satellite WALL ST. Wall Street Oil & Gas Production and Storage Water Supply Telecom Business Emergency Services Information Electric Power Agriculture Adapted from Kelly, 2001 and Scalingi, 2003 5

Critical Infrastructure Interdependency Power for Compressors, Storage, Control Systems Fuel for Generators Power for Pump and Lift Stations, Control Systems Power for Switches Water for Cooling, Emissions Reduction Heat Power for Pumping Stations, Storage, Control Systems Fuel for Generators, Lubricants Fuels, Lubricants SCADA, Communications SCADA, Communications Water for Cooling Fuel Transport, Shipping Fuel Transport, Shipping Power for Signaling, Switches Water for Production, Cooling, Emissions Reduction Water Transpor- tation Oil Telecom Natural Gas Electric Power Adapted from Rinaldi et al., 2001, and Scalingi, 2003 6

Critical Infrastructure Interdependency “We, as a country, have put all of our eggs in one basket...we’ve successfully dominated the world economically and militarily because of the systems that we have designed, and relied upon....its our Achilles heel” Richard Clarke 7

Cyber Security CPXs Argonaut (England) Black Demon (USAF/DD) Black Ice (DOE Office of CIP) Blue Cascade (Pacific NW) Cyber Defense Exercise (CDX) 2004 Service Academies Dark Screen (UTSA) Eligible Receiver (DOD/NSA) Hackfest (ARFL/Symantec) Livewire (DHS) TopOff (DHS/ODP) 8

Types of CPX Table Top Exercise Normally very low cost Anyplace, anytime Small number of participants Could be for any type of objective Could be the first phase of a larger exercise 9

Types of CPX Scenario-based Many organizations, not many people Frequently examines existing or new procedures Also could be part of an exercise “buildup” More costs, more disruption to regular activities 10

Type of CPX Full-scaled Highest cost Most people involved Inter-agency, inter-governmental, inter-sector Occasional due to costs 11

Operation Dark Screen Year-long, three phased scenario-based exercise Table top Scenario-based Modified Full-scaled Designed to evaluate regional organizations’ capabilities to prevent, detect, and respond to cyber security incidents Initiated by Rep. Ciro Rodriguez (D-TX) Conducted by UTSA’s Center for Infrastructure Assurance and Security (CIAS) 12

ODS-CC Participants 2003-2004 City of Corpus Christi (CC) MIS Corpus Christi EOC CCPD MIS CCFD MIS CC Emergency Management Office CC Risk Management Division CC Water & Gas FBI Probado Technologies USN USCG Port of Corpus Christi Del Mar College Texas A&M Corpus Christi 13

Workforce Skills Interpersonal skills Analyzation and identification Communications Written or oral Common body of language Analyzation and identification Developing Solutions Team building 14

Workforce Skills Gather and document data with the ability to: Analyze information Ask relevant questions Accurately summarize and document information Synthesize and organize information 15

Workforce Skills Review and test plans and strategies for compliance with applicable regulations and standards with the ability to: Generate and evaluate solutions Compare multiple viewpoints Identify key sources of information Pose critical questions 16

Workforce Skills Identify, analyze and evaluate infrastructure and network vulnerabilities Ability to: Analyze information for accuracy and consistency Evaluate system configuration Use prior training/experience to predict outcome 17

Workforce Skills Implement/test contingency and backup plans and coordinate with stakeholders Ability to: Systematically organize information Evaluate critically of problems, identify possible causes and propose solutions Communicate effectively with clients 18

Workforce Skills Develop information assurance plans and implementation strategies Ability to: Synthesize and organize information Assume responsibility for accomplishing team goals Analyze group/individual response Create and develop new rules/principles 12

Workforce Skills Maintain and update information assurance plans and strategies as appropriate Ability to: Create data gathering process Monitor and correct system Devise and implement plan of action 20

References Kaucher, C.E., “Exercise in Defending Cyberspace: The Capstone of Education, Training and Awareness”, Nation Defense University Long, H.M., “Higher Education Contribution to the National Strategy to Secure Cyberspace”, ITS, Yale University St, Sauver,J., “Practical Steps to Take to mitigate Computer and Network Risks”. Infraguard Conference, March 2004 Goles, T; White, G; Dietrich, G; “Dark Screen: An Exercise in Cyber Security”, University of Texas-San Antonio, 2003 Building A Foundation for Tomorrow, Skill Standards for Information Technology, NWCET