From: InfoSec News (alertsinfosecnews.org)
Date: Thu Apr 10 2008 - 02:40:10 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

http://www.informationweek.com/news/security/government/showArticle.jhtml?articleID=207100754

By Thomas Claburn
InformationWeek
April 9, 2008

Among the goals for Cyber Storm II, a government-sponsored computer
security exercise that occurred last month, was testing information
sharing capabilities across organizations during a crisis.

By the accounts of panelists at the RSA Conference in San Francisco who
participated in the exercise, the simulated cyber crisis was hugely
valuable; they just couldn't share very much information about what went
on.

Detailed information about Cyber Storm II will be made available later
this summer in an after-action report, said Greg Garcia, assistant
secretary for cybersecurity with the Department of Homeland Security.

It thus came as no surprise when U.S. CERT's deputy director Randy
Vickers acknowledged that the exercise showed there were still some
shortfalls in information sharing during the simulated crisis.

Other panelists included Michigan CIO Dan Lohrmann, New Zealand's
managing director of critical infrastructure protection Paul
McKittrick,Microsoft (NSDQ: MSFT) senior security specialist Paul
Nicholas, and Dow senior information systems manager Christine Adams.

After listening to the panelists talk for forty-five minutes in very
general terms about what their organizations hoped to accomplish and in
similarly vague terms about various "learnings" that emerged, questions
were solicited from the audience.

One pony-tailed RSA attendee, presumably a security pro, expressed
dissatisfaction with the lack of specific information disclosed about
Cyber Storm II and asked bluntly, "Was there a red team and did they
win?"

According to the color traditions observed by the military and security
professionals, the red team typically represents an attacking enemy and
the blue team typically represents the defenders or home country.

"We don't have a firm answer about winning or losing," said panel
moderator Jordana Siegel, acting deputy director at Department of
Homeland Security. She however did allow that the exercise had taught
everyone a lot.

Generally speaking, the U.S. government has not been shy when it comes
to proclaiming its successes.

But if the blue team got trounced, that should not be an entirely
unexpected result given that in real world version Cyber Storm II -- now
playing on the Internet and coming soon to a network near you -- the red
team scores victories daily, against government agencies, businesses,
organizations, and individuals.

Vickers insisted that the red team-blue team dynamic didn't quite fit
Cyber Storm II. That may be Cyber Storm III. But Cyber Storm II in March
was more about getting ready to be tested. It was more about networking,
which is to say building interpersonal relationships across
organizations among those who may one day face a real cyber crisis.

Citing the words used by Homeland Security Secretary Michael Chertoff at
his RSA keynote speech on Tuesday, Garcia said, "It takes a network to
defeat a network, and that network is the adversary."

Whatever else it did, Cyber Storm II strengthened the foundations of the
blue team's network, the public-private partnership that oversees
critical cyber infrastructure.

And as Microsoft's Nicholas observed, public-private partnership "is
easy to say but it's hard to do."

___________________________________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]