2 KiB
Executable file
| layout | title | date | categories |
|---|---|---|---|
| post | Cyber Security Exercises and Reality | 2017-11-30 18:52:21 | infosec |
Cybersecurity Exercises and The Reality
Alexandre Dulaunoy a@foo.be
version 0.1 - 2017-11-30
When you are facing a potential threat, the most difficult aspect is to understand what you are fighting against. Evaluating a threat in information security is a complex aspect especially when you have no simple ways to scale the threat and know if you have the organisational and technical capabilities to respond to such threat.
In the past years, many cyber security exercises appear at local, national or international levels with the aim to improve the capabilities at organisational or/and technical levels. There are many different organisations involved in such exercise and there are many models depending of their respective focus. After being involved in many of those (including designing or/and playing), I compiled my thoughts and especially the shortcomings in such approach. The idea behind this series of notes is to improve such exercise or experiment other approaches.
Synthetic information/evidences
- Synthetic information or evidences
- The aim is often limited to solve one or more challenges
Reducing operational security aspects to simple games
A critical issue in my eyes with cyber security exercises is the over simplification of cyber security threats at a level which make these understandable for the political or non-operational managerial level. There are some significant risks to reduce complexity of the reality. When operational security teams face real and concrete incidents, their work can be seen as like solving a challenge. In incident response, it's quite common to face complex topics, with different contexts and ultimately being incapable to reach a complete solution of the analysis from partial evidences, multi-compromised infrastructures.
- Resources and allocation
- Outcomes and how results are integrated in operational security