Advertisement

Blue Team Communication and Reporting for Enhancing Situational Awareness from White Team Perspective in Cyber Security Exercises

  • Tero KokkonenEmail author
  • Samir PuuskaEmail author
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 11118)

Abstract

Cyber security exercises allow individuals and organisations to train and test their skills in complex cyber attack situations. In order to effectively organise and conduct such exercise, the exercise control team must have accurate situational awareness of the exercise teams. In this paper, the communication patterns collected during a large-scale cyber exercise, and their possible use in improving Situational awareness of exercise control team were analysed. Communication patterns were analysed using graph visualisation and time-series based methods. In addition, suitability of a new reporting tool was analysed. The reporting tool was developed for improving situational awareness and exercise control flow. The tool was used for real-time reporting and communication in various exercise related tasks. Based on the results, it can be stated that the communication patterns can be effectively used to infer performance of exercise teams and improve situational awareness of exercise control team in a complex large-scale cyber security exercise. In addition, the developed model and state-of-the-art reporting tool enable real-time analysis for achieving a better situational awareness for the exercise control of the cyber security exercise.

Keywords

Cyber security Exercise Training Situational awareness Communication 

Notes

Acknowledgment

This research is partially done in JYVSECTEC Center project funded by the Regional Council of Central Finland/Council of Tampere Region and European Regional Development Fund/Leverage from the EU 2014–2020.

References

  1. 1.
    The Apache Software Foundation: Apache ActiveMQ. http://activemq.apache.org/. Accessed 23 Apr 2018
  2. 2.
    Azimirad, E., Haddadnia, J.: The comprehensive review on JDL model in data fusion networks: techniques and methods. (IJCSIS) Int. J. Comput. Sci. Inf. Secur. 13(1), 53–60 (2015)Google Scholar
  3. 3.
    Brilingaitė, A., Bukauskas, L., Krinickij, V., Kutka, E.: Environment for cybersecurity tabletop exercises. In: Pivec, M., Josef, G. (eds.) ECGBL 2017 11th European Conference on Game-Based Learning, pp. 47–55. Academic Conferences and Publishing Limited (2017)Google Scholar
  4. 4.
    Brilingaitė, A., Bukauskas, L., Kutka, E.: Development of an educational platform for cyber defense training. In: Scanlon, M., Nhien-An, L.K. (eds.) Proceedings of the 16th European Conference on Cyber Warfare and Security, pp. 73–81. Academic Conferences and Publishing Limited (2017)Google Scholar
  5. 5.
    Brynielsson, J., Franke, U., Tariq, M.A., Varga, S.: Using cyber defense exercises to obtain additional data for attacker profiling. In: 2016 IEEE Conference on Intelligence and Security Informatics (ISI), pp. 37–42, September 2016.  https://doi.org/10.1109/ISI.2016.7745440
  6. 6.
    Brynielsson, J., Franke, U., Varga, S.: Cyber situational awareness testing. In: Akhgar, B., Brewster, B. (eds.) Combatting Cybercrime and Cyberterrorism. ASTSA, pp. 209–233. Springer, Cham (2016).  https://doi.org/10.1007/978-3-319-38930-1_12CrossRefGoogle Scholar
  7. 7.
    Endsley, M.: Toward a theory of situation awareness in dynamic systems. Hum. Factors 37(1), 32–64 (1995).  https://doi.org/10.1518/001872095779049543CrossRefGoogle Scholar
  8. 8.
    European Comission: Cybersecurity Strategy of the European Union: An Open, Safe and Secure Cyberspace, February 2013Google Scholar
  9. 9.
    Evesti, A., Kanstrén, T., Frantti, T.: Cybersecurity situational awareness taxonomy. In: 2017 International Conference on Cyber Situational Awareness, Data Analytics And Assessment (Cyber SA), pp. 1–8, June 2017.  https://doi.org/10.1109/CyberSA.2017.8073386
  10. 10.
    Franke, U., Brynielsson, J.: Cyber situational awareness - a systematic review of the literature. Comput. Secur. 46, 18–31 (2014)CrossRefGoogle Scholar
  11. 11.
    Han, X., Sheng, H.: A new method of multi-sensor data fusion. In: 2017 IEEE 3rd Information Technology and Mechatronics Engineering Conference (ITOEC), pp. 877–882, October 2017.  https://doi.org/10.1109/ITOEC.2017.8122479
  12. 12.
    JAMK University of Applied Sciences, Institute of Information Technology, JYVSECTEC: RGCE cyber range. http://www.jyvsectec.fi/en/rgce/. Accessed 23 Apr 2018
  13. 13.
    Kick, J.: Cyber exercise playbook. The MITRE Corporation (2014). https://www.mitre.org/sites/default/files/publications/pr_14-3929-cyber-exercise-playbook.pdf. Accessed 23 Apr 2018
  14. 14.
    Kokkonen, T., Hämäläinen, T., Silokunnas, M., Siltanen, J., Zolotukhin, M., Neijonen, M.: Analysis of approaches to internet traffic generation for cyber security research and exercise. In: Balandin, S., Andreev, S., Koucheryavy, Y. (eds.) ruSMART 2015. LNCS, vol. 9247, pp. 254–267. Springer, Cham (2015).  https://doi.org/10.1007/978-3-319-23126-6_23CrossRefGoogle Scholar
  15. 15.
    Lenders, V., Tanner, A., Blarer, A.: Gaining an edge in cyberspace with advanced situational awareness. IEEE Secur. Priv. 13(2), 65–74 (2015).  https://doi.org/10.1109/MSP.2015.30CrossRefGoogle Scholar
  16. 16.
    Lötjönen, J.: Requirement specification for cyber security situational awareness, Defender’s approach in cyber security exercises. Master’s thesis, JAMK University of Applied Sciences, December 2017Google Scholar
  17. 17.
    van der Meulen, R.: Build adaptive security architecture into your organization, June 2017. https://www.gartner.com/smarterwithgartner/build-adaptive-security-architecture-into-your-organization/. Accessed 23 Apr 2018
  18. 18.
    Ministry of Defence Finland: The authorities of the state administration are trained in cyber-skills in Jyväskylä - Valtionhallinnon viranomaiset harjoittelevat kyberosaamista Jyväskylässä 8.-11.5.2017, official bulletin 3th of May 2017, May 2017. https://www.defmin.fi/ajankohtaista/tiedotteet/valtionhallinnon_viranomaiset_harjoittelevat_kyberosaamista_jyvaskylassa_8.-11.5.2017.8418.news. Accessed 23 Apr 2018
  19. 19.
    Oracle Corporation: Java programming language. http://www.oracle.com/technetwork/java/index.html. Accessed 23 Apr 2018
  20. 20.
    Pajunen, D.: Cyber security is ensured with genuine exercises, September 2017. https://www.fingridlehti.fi/en/cyber-security-ensured-genuine-exercises/. Accessed 23 Apr 2018
  21. 21.
    Révay, M., Líška, M.: Ooda loop in command control systems. In: 2017 Communication and Information Technologies (KIT), pp. 1–4, October 2017.  https://doi.org/10.23919/KIT.2017.8109463
  22. 22.
    Secretariat of the Security Committee: Finland’s Cyber security Strategy, Government Resolution 24.1.2013, January 2013Google Scholar
  23. 23.
    The Security Committee: Security Strategy for Society, Government Resolution 2.11.2017, November 2017Google Scholar
  24. 24.
    Shannon, P., et al.: Cytoscape: a software environment for integrated models of biomolecular interaction networks. Genome Res. 13(11), 2498–2504 (2003).  https://doi.org/10.1101/gr.1239303CrossRefGoogle Scholar
  25. 25.
    Sommestad, T., Hallberg, J.: Cyber security exercises and competitions as a platform for cyber security experiments. In: Jøsang, A., Carlsson, B. (eds.) NordSec 2012. LNCS, vol. 7617, pp. 47–60. Springer, Heidelberg (2012).  https://doi.org/10.1007/978-3-642-34210-3_4CrossRefGoogle Scholar
  26. 26.
    Wilhelmson, N., Svensson, T.: Handbook for Planning, Running and Evaluating Information Technology and Cyber Security Exercises. The Swedish National Defence College, Center for Asymmetric Threats Studies (CATS) (2014)Google Scholar

Copyright information

© Springer Nature Switzerland AG 2018

Authors and Affiliations

  1. 1.Institute of Information TechnologyJAMK University of Applied SciencesJyväskyläFinland

Personalised recommendations