Largest Simulated Cyber Attack To Date

Orome1 noted that the government will be running simulated cyber attacks as part of the Department of Homeland Security's Cyber Storm III exercise. It says "The exercise will be controlled from the Secret Service headquarters, where organizers from various agencies will be sending out 'exercise injects,' information that a player will receive that indicates that a certain event has taken place as part of the narrative set up by the organizers. This goes a bit beyond a paper narrative, including fake log data, drives that may contain fake malware, and fake event history, and is dynamic, meaning that it can change dependent on the actions the players take." ...which makes me wonder how effective this test would actually be.

Comments

Uh Oh

[AppleOSuX]

Should we expect a real attack at the same time?

External & Internal attacks?

[Anonymous Coward]

I hope they're not just testing over the wire attacks, that new janitor with the thumb drive could do some damage...

Re:External & Internal attacks?

[dragonhunter21]

From the summary, it appears as though they're using drives with fake malware on them to keep operators on their toes. This should be fun.

I wonder if it is possible to subvert this sim

[JonySuede]

I wonder if a real attacker could subvert this simulation to hide a real attack. The "exercise injects" canals seems like a good way to inject malicious payload.

Now's the time

[Anonymous Coward]

Can anyone think of a good time to run a real cyber attack against DHS?

Dynamic != Static?

[Tekfactory]

"This goes a bit beyond a paper narrative, including fake log data, drives that may contain fake malware, and fake event history, and is dynamic, meaning that it can change dependent on the actions the players take." which makes me wonder how effective this test would actually be."

Why shouldn't the test adapt to moves the player's make, do you think a hacker is going to keep running off the same script when he knows he's been noticed?

Some of the worst botnets move their Command and controls nodes around and the people behind them release new code to adapt to what security researchers are doing to stop them. Including DoSing the researchers.

What idiot thinks we can fight a changing landscape of threats with a static defense?

No Really I can't tell from the context if that's Taco or the submitter, but paper narrative tests that the author mentions basically are just there to make sure you know your job or have memorized your DR plan, but they don't make you think.

I'd be more worried if all facets of the scenario didn't get played out because nobody said "I image the hard drive" and so they skip that part of the test. In that case it would be up to the folks running the exercise to move the scenario along by saying someone at another agency imaged the drive, here is a copy, maybe you should look at it.

It's a lot like preparing for a D&D game and having the players ignore half the story/encounters you wrote up.

Re:Let me guess the results in advance

[Jawnn]

True words, sir. It's almost as if the new "cyber warriors" are nothing more than contractors being provided from new divisions of traditional "brick and mortar", or should I say "bombs and bullets" defense contractors.
Oh..., wait.