Slashdot Mirror
Largest Simulated Cyber Attack To Date
Orome1 noted that the government will be running
simulated cyber attacks as part of the Department of Homeland Security's Cyber Storm III exercise. It says "The exercise will be controlled from the Secret Service headquarters, where organizers from various agencies will be sending out 'exercise injects,' information that a player will receive that indicates that a certain event has taken place as part of the narrative set up by the organizers. This goes a bit beyond a paper narrative, including fake log data, drives that may contain fake malware, and fake event history, and is dynamic, meaning that it can change dependent on the actions the players take." ...which makes me wonder how effective this test would actually be.
The only winning move is not to play. Now get me a WOPR with cheese!
Living With a Nerd
Should we expect a real attack at the same time?
I wonder if a real attacker could subvert this simulation to hide a real attack. The "exercise injects" canals seems like a good way to inject malicious payload.
Jehovah be praised, Oracle was not selected
Can anyone think of a good time to run a real cyber attack against DHS?
I can guess the results in advance of this pointless "test".
We did well enough that none of us should be fired. Or we selected a fall guy months ago whom is not playing along, and I guess with "great shock" at the result its time for him to "spend more time with his family".
We did poorly enough that we all need more money. Conveniently I happen to have a brother-in-law in sales at a contractor that provides a magic bullet that claims to do everything we need...
There has never been a public "test" like this with any other result. Therefore its not even "news".
I have participated in things like this (not in this situation or field) and the primary reason they occur is someone wants to send cash to a buddy at a contractor, and everyone else wants a day off eating catered food and enjoying some business travel.
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
From the summary, it appears as though they're using drives with fake malware on them to keep operators on their toes. This should be fun.
Sent from my CR-48
"This goes a bit beyond a paper narrative, including fake log data, drives that may contain fake malware, and fake event history, and is dynamic, meaning that it can change dependent on the actions the players take." which makes me wonder how effective this test would actually be."
Why shouldn't the test adapt to moves the player's make, do you think a hacker is going to keep running off the same script when he knows he's been noticed?
Some of the worst botnets move their Command and controls nodes around and the people behind them release new code to adapt to what security researchers are doing to stop them. Including DoSing the researchers.
What idiot thinks we can fight a changing landscape of threats with a static defense?
No Really I can't tell from the context if that's Taco or the submitter, but paper narrative tests that the author mentions basically are just there to make sure you know your job or have memorized your DR plan, but they don't make you think.
I'd be more worried if all facets of the scenario didn't get played out because nobody said "I image the hard drive" and so they skip that part of the test. In that case it would be up to the folks running the exercise to move the scenario along by saying someone at another agency imaged the drive, here is a copy, maybe you should look at it.
It's a lot like preparing for a D&D game and having the players ignore half the story/encounters you wrote up.