Europe, Canada, USA,
Australia, and others are now running training exercises to prepare for the
outbreak of cyberwar. Locked Shields is the largest simulation and TechRepublic
takes you inside.
The city of Tallinn,
Estonia serves as the host of NATO's "Locked Shields," arguably the
premier cyberwarfare simulation.
Berylia is under attack.
Again.
The island nation, located
somewhere in the cold waters of the Atlantic Ocean, relies on its state-of-the-art
drone industry for a large part of its income. But recently its drone research
labs have come under cyber attack from unknown assailants, forcing Berylia to
deploy rapid-reaction teams of security experts to its labs, under orders to
find out what's happening, and to stop the attacks as quickly as possible.
Over two hectic days, the
teams will have to battle against mounting attacks on their systems, hijacking
of their drones, and questions from a sometimes hostile press.
And it's not the first time
Berylia has come under attack: strangely these cyber onslaughts happen every
year at around the same time. And these incursions won't be the last time the
country comes under attack either, because the fictional drone-building country
is the setting for the NATO annual cyber defence wargame, Locked Shields.
The exercise is run from
Estonia by NATO's cyberwarfare think tank, the Cooperative Cyber Defence Centre
of Excellence (CCD COE). The annual event, which has been running since 2010,
aims to train the security experts who protect national IT systems on a daily
basis. While the exact scenario changes every year, the setting--the embattled
Berylia--remains the same, and arch-rival Crimsonia often makes an appearance
too.
Berylia might be a
fictional state, but Estonia itself has first hand experience of these sort of
digital attacks: back in 2007 its banks and government systems suffered weeks of disruption from hackers after
Estonian authorities proposed moving a Soviet war memorial. Russia denied any
involvement in the attacks, but the incident accelerated plans for the
formation of the NATO's cyber think tank, located in the Estonian capital,
Tallinn.
This year Locked Shields saw more than 1,700 attacks
carried out against 1,500 virtualised systems being protected by 20 teams,
which separately had to defend online services and industrial control systems
against real malware and digital attacks.
The wargame pits 20 'blue
team' sets of defenders from NATO's member states, against a 'red team' of
attackers which attempt to disrupt their networks. A separate 'white team' of
experts runs the game systems. In total, the exercise involves around 550
people across 26 nationalities, 250 of which are the core planning team in
Tallinn, where the main action takes place over a two-day period.
It's not the only big
cyberwar game. The US runs its own 'Cyber Guard' event every year, which this
year saw around 1,000 players from
various government agencies. Those taking part included the UK, Canada, and
Australia, all dealing with a fictional attack on an oil refinery, power grids,
and ports, while the Bank of England has overseen 'Waking Shark' exercises
across the banks in London. However, Locked Shields describes itself as the largest international technical cyber defence exercise.
All the Locked Shields
teams get the same mission briefing, and the same set of virtual systems to
defend. While the game is run from Estonia by NATO's Cooperative Cyber Defence
Centre of Excellence (CCD COE), most teams log-in remotely from their own
countries. The teams are playing simultaneously but separately, so it is in
some respects 20 games at once, although the teams are allowed to share some
information.
In the scenario, the teams
are playing as a rapid reaction team that has just been dropped into a drone
research lab. That means when the game starts, they don't even know precisely
what systems they have to defend, and whether their adversary has already
managed to breach any.
Even the technical
information they are given about the systems they have been called in to
protect is--as it would be in real life--shoddy and possibly incorrect, making
it even harder for the teams to prepare their defences.
Berylia and Crimsonia are
the two fictional countries involved in the Locked Shields simulation.
"We are trying to use
hacking scenarios and attack scenarios that are taken from real life, so we are
not playing on an abstract simulation, we are actually using the same operating
systems that would be encountered in real life," Dr Rain Ottis, Locked
Shields 2016 scenario master, said.
"We want to see how
they handle themselves as a team in a situation where there's lots of fog of
war, where you do not have full visibility of the scenario of the things that
are happening to you," he said.
Over the course of the
exercise things only get worse. Not only do the teams have to deal with
incoming attacks, they also have to deal with getting blamed for attacks coming
from their networks. "It is as realistic as we can make it," said
Ottis.
The teams of defenders--each
of around a dozen people--have to protect around 2,000 machines making up a
realistic representation of what a business network would look like. The
services the blue teams have to maintain range from websites, email, and online
shopping services, to various kinds of industrial control systems.
The aim is to put constant
pressure on the defending teams, to test them with the sort of full-scale cyber
attack that hardened security professionals would hope to never experience in
real life.
"We have absolutely
everything in there, we have Windows 7, 8, 10, we have Apple OS X, we brought
in most of the Linux versions, so what we want to do is have a wide spectrum of
operating systems. Everything you can imagine in a regular office, all the
software and hardware, we try to simulate that and show that in some way they
can be vulnerable," said Aare Reintam, CCD COE's technical exercise
director.
"We want to show them
everything you have in the environment can be a target or a jumping point into
your internal networks," he said.
That means that everything
from smartphones to humble printers could be a target. "We want to express
that absolutely everything that you have in the network can be a target, that
you have to defend everything. Attackers have to find only one thing to
attack," he said.
As such, teams don't just
have to protect standard PCs or servers, the Internet of Things is part of the
security threat too. In the scenario, the teams are protecting a drone research
lab, so one of the challenges they are faced with is keeping control of the
command and control system for the drones--and regaining control of the drones
if it's lost.
Locked Shields participants
crowd around giant screens of data to analyze attacks in motion.
Perhaps one of the more unexpected
systems they need to protect is an industrial command and control system. The
one that runs the cooling in their own server room. If the teams lose control
of that, then their mysterious enemies can turn up the heat, and shut their
servers down (to add a little drama to the proceedings when this happens sparks
shoot out of the server room simulation board).
The teams respond to the
challenges differently, and one tempting option of course when faced with an
overwhelming cyberattack is to pull the plug--to protect the systems by taking
them offline. But that would be to miss the point: teams must be able to
protect the systems while keeping them up and running, even if they have to
prioritise.
For Reintam, this is one of
the keys to the event: "We are teaching them how to protect our lifestyle.
We have to make sure that the lifestyle that we are used to, that you wake up
in the morning and you turn on your lights, that you turn on the water and can
make yourself a coffee, that you can browse the news with your coffee... you
have to pay attention to every aspect of the ecosystem and you have to protect
it."
The game wouldn't get very
far without the red team, which aims to create that fog of war that surrounds
the defending teams. It has around 60 members to "entertain" the
defending blue team, said Mehis Hakkaja, head of the red team and CEO of
Clarified Security. The red team uses attack methods that are out in the wild
to make attacks as realistic as possible, although still ones that can be
defended against.
Even though the red team
knows most blue team systems and vulnerabilities beforehand and even has
pre-planted backdoors, the situation changes rapidly as soon as the exercise
starts, he said: some of the attacks are based on cybersecurity basics like missing
patches but can rapidly accelerate to attacks on complex industrial control
systems.
The red team can pretend to
be various typical hacker groups--from stealthy 'advanced persistent threat'
actors to noisier and apparently less skilled hacktivists--or perhaps both at
the same time, depending on the scenario. The game plan changes depending on
how well the teams respond. The attackers will attempt to do things like steal
documents which are then leaked to the in-game media, but if the teams managed
to thwart that heist then the game goes in another direction instead.
Playing through such a
variety of attacks and threat actors from various angles allows the red team
and organisers to evaluate the blue teams on their ability to notice and
respond, whether their initial defensive plan worked, and whether they managed
to retain control and a sufficient situational overview.
"Having a good initial
defence strategy is good, but ability to adjust it on-the-fly is even more
important," Hakkaja said, as it seeing the bigger picture, "because
just blocking and blindly trying to apply defences, or only seeing some attack
indications only gets you so far."
As well as the technical
aspects of the game, the teams are also tested on their understanding of the
legal issues involved with protecting against the attacks, how they deal with
the press, and how well they report back to their fictional commanders or
political leaders.
In the media element of the
game, the teams for example have to be able to explain their actions and put
across their point of view accurately, even when being questioned by hostile
journalists who are trying to trick the teams into saying too much or saying
the wrong thing, all of which plays out on the in-game news site.
Another element tested is
around legal issues. The legal picture around hacking, and cyberwarfare in
particular, is often unclear, so the teams have to do everything they can to
ensure that they are behaving legally.
This battlefield has traded
trenches and firearms for desks, monitors, keyboards, and lots of cables.
For example, the legal
framework used during armed conflict is different to those used in standard
policing, so working out whether a cyber incident has risen to the level of an
armed conflict is a key factor, something that is hard for defenders to work
out when many of these attacks are stealthy and anonymous. Malware doesn't wear
a uniform or carry a flag.
During the exercise, the
legal advisors on the team are tested, often in coordination with the other
events in the game: for example, being asked to give military commanders advice
on their options when dealing with hacked drones.
"In every military
operation the idea is to get the commander the options to chose from, and each
of those option need to be assessed by a lawyer to say what legal issues do
they raise, is it lawful in the first place, which is the best option from a
legal perspective," explains Dr. Heather Harrison Dinniss, head of the
Locked Shields legal team and senior lecturer in International Law at the Swedish
Defence University.
It's only in the last few
years--with the publication of documents like the Tallinn
Manual which looks at how international law applies to
cyberwarfare--has the legal framework around cyberwarfare has become clearer.
"The difficulty when
you are dealing with cyber, of course, is you don't necessarily know who it is
that is launching the attack," Harrison Dinniss said. "Cyber makes
that assessment more difficult."
"There's a much
greater acceptance now that the law applies," she added, although there
are still things that are uncertain: for example, while it's generally agreed
that a serious cyber attack could be considered the equivalent of an armed
attack, there's less agreement about how to treat less physically destructive
attacks.
"There are still
interpretation issues, something that's still up in the air is what do we do
about data-only attacks," she said. We're talking about ones that don't
cause any physical damage but wipe computer systems, like the attack on Saudi Aramco
in 2012 which wiped more than 30,000 devices.
"There is still a
question of how do we treat that because there is no physical harm. What do you
do when they wipe the computers and make them unusable. Is that enough? Is that
a use of force? There's still significant disagreement on [that]," she
said.
Teams also have to make
sure they do the paperwork.
"We do want them to be
able to write human-readable reports about what is going on, something they
could send to a manager or a government minister--so condense what they know
into something that a non-tech expert can understand, because we have seen time
and again that this is a weak spot in the cybersecurity community. We like the
lingo that we use and it's sometimes why the message gets lost, and we train for
that," said scenario master Ottis.
The exercise puts a lot of
emphasis on team communication, team leadership, and delegation. So what makes
a good cyber defence team?
The best teams tend to have
done some preparation by thinking through the skills and tools that they will
need. Those teams typically figure out who is taking which role quickly, too,
so they don't have to worry about who is looking after which systems when the
action begins.
Winning teams try to
understand the battlefield, predict what their attackers are going to do next,
and try to be ready for it, said Ottis.
A Locked Shields cyber
warrior puzzles over the state of the Live Attack Map.
"We like to see where
you are trying to figure out the battlefield, know yourself, know your
adversary, and make your plan based on that," Ottis added. "Figure
out where you need sensors, which service require more manual monitoring, and
which ones you can leave on the back burner. We are talking about being
proactive within the network that you have."
Head of the red team
Hakkaja makes a similar point: "To see, understand, and communicate the
big picture, not being lost in the small technical pieces, is probably the
hardest for techies. Large scale cyber exercises like Locked Shields provide a
unique opportunity for blue teams to be in such rapidly evolving situations
where they rarely are in their daily job as a team."
However, there's one thing
that teams can't do, and that is strike back against their adversaries.
"This is a strictly defensive exercise so we want them to defend what they
have, we want them we want them to cooperate if it makes sense, we want them to
keep communications up with the rest of the world and with their higher
command. But we do not want them to go on the offensive because that has very
serious legal repercussions," said Ottis.
The team from Slovakia won
this year's event at the end of April,
closely followed by the NATO Computer Incident Response Capability (NCIRC) team
from NATO and Finland, which won last year.
The Slovakia team scored highest in the media challenges of the exercise and
Germany came out on top of the forensic game, while NCIRC did the best in
providing legal analysis, and the Czech Republic won scenario challenges.
"When under intense
pressure, network security professionals have to monitor the environment,
consider social, political, and legal consequences as well as keep ahead of the
constant technical challenges," said Thomas Svensson, inject master of
Locked Shields 2016.
Technical exercise director
Reintam said there is huge demand for the exercise, reflecting how many
countries in NATO are increasingly worried about cyber defence, especially the
Baltic states. Worried about Russian cyber attacks, Estonia has even been
discussing backing-up vast amounts of public data,
from birth records to property deeds, in a secure location outside
of the country.
As such, NATO has been
taking cyberwarfare increasingly seriously in recent years, first making it
clear that a serious cyber attack could trigger its
collective defense clause and more recently defining cyberspace as a
an operational domain--that is, a likely
battlefield.
However, many members lack
the trained staff to recognise or deal with a serious cyber attack on their
critical national infrastructure. Events like Locked Shields are aimed at
encouraging members to take their digital defences more seriously, and perhaps
also to show potential aggressors that NATO takes the threat seriously, too.
Right now, all is quiet
again in Berylia. But perhaps for not too much longer.
www.vsoftsystems.co.za
