· Training: The process of knowledge transfer. Training may take the form of formal or informal classes, newsletters, and online how-to repositories.

· Security awareness: Knowledge of security policies, threats, and handling of digital assets.

www.jblearning.com Page 1

Practical Connection - Building a Secure Network Part 1/netsec_ts_countermeasures(2).docx

Selecting Security Countermeasures

Corporation Techs’ current network consists of 30 workstations: 1 print server, 2 database servers, and an application server. The network is connected through a series of switches and is physically isolated from other networks. Corporation Techs is going to add a Web server and an Internet connection to the network. The Internet connection will provide Internet access to the workstations and allow customers to externally access the Web server. Additionally, Techs plans to add 10 laptops and would like to connect them to the network wirelessly. Techs’ network team has come to you with the following design, and asked you to review and identify any possible security threats.

Given the suggested network design for Corporation Techs, you must identify possible security threats and research and identify appropriate countermeasures.

www.jblearning.com Page 1

Practical Connection - Building a Secure Network Part 1/netsec_ts_cyberdefensereport(2).pdf

Baltic Cyber Shield Cyber Defense Exercise 2010

This handout is a reprint from an after-action report originally published by NATO Cooperative Cyber Defense Centre of Excellence (http://www.ccdcoe.org) in 2010. Source: http://www.ccdcoe.org/172.html URL Last Verified: 2013-07-31 Baltic Cyber Shield to train technical skills for countering cyber attacks Tallinn – 3 May, 2010. An International Cyber Defence Exercise on 10-11 May the Baltic Cyber Shield will give its participants a practical hands-on experience in defending computer networks. The event is jointly organised by the Cooperative Cyber Defence Centre of Excellence and several Swedish governmental institutions. The aim of the Baltic Cyber Shield is to increase understanding of the international cyber environment and to enhance international cooperation for handling technical incidents. During the exercise, six teams from Latvia, Lithuania, Sweden and NATO headquarters (NCIRC) will attempt to defend virtual computer networks against hostile attacks. „One of the main tasks for the teams is to defend an initially insecure company network. This network also includes components of SCADA systems that are used for monitoring and controlling critical information infrastructure,” Kaur Kasak, the exercise director from the CCDCOE explains. The event is jointly set up by the CCDCOE and the Swedish National Defence College (SNDC) with support from various Swedish institutions and the Estonian Cyber Defence League. Participating teams come from governmental agencies in Latvia, Lithuania, Sweden and NATO Computer Incident Response Capability Technical Centre (NCIRC-TC). The first similar exercise took place in 2008 as a joint event between Swedish and Estonian universities organized by the Swedish National Defence College and the Estonian Defence Forces. The organisers of the exercise would like to thank Clarified Networks for their support in organising the exercise.

For Public Use

Baltic Cyber Shield Cyber Defence Exercise 2010

After Action Report

Executive Summary

Baltic Cyber Shield (BCS) is an international technical cyber defence exercise (CDX). It was first time

executed in May 2010 although a proof of concept exercise conducted in 2008 preceded the event.

The exercise was organized in collaboration with several organisations coordinated by Cooperative

Cyber Defence Centre of Excellence (CCDCOE) and Swedish National Defence College (SNDC). Besides

CCDCOE and SNDC the main contributors were Swedish Defence Research Agency (FOI), Estonian

Cyber Defence League (ECDL), Swedish Civil Contingencies Agency (MSB), Swedish National Defence

Radio Establishment (FRA), NATO Communication and Information Systems Services Agency

Computer Incident Response Capability ‐ Technical Centre (NCSA NCIRC ‐ TC), and Clarified Networks.

During the exercise six Blue Teams, composed of public, private sector, and academic personnel had

to defend virtual computer networks against hostile Red Team attacks. The game scenario described

a volatile geopolitical environment in which a newly hired team of cyber security experts was asked

to defend the IT systems of a power generation company in the face of increasingly sophisticated

attacks by a group of hackers. The Blue Teams were competing with each other and their activities

were measured by automatic and manual scoring.

The exercise was perceived as a great success by all the participants, especially by the Blue Teams. An

overall objective of the exercise was to gather lessons identified for the future, something that was

fulfilled and is reflected in the following. The purpose of this report is to identify what the lessons

identified – later to be learned – were from planning and executing the Baltic Cyber Shield exercise.

For Public Use

Contents

1 Introduction ..................................................................................................................................... 3

2 Objectives ........................................................................................................................................ 4

3 Background ...................................................................................................................................... 5

4 Execution ......................................................................................................................................... 8

5 General Lessons Identified and Recommendations ...................................................................... 16

6 Conclusions .................................................................................................................................... 18

7 Acknowledgements ....................................................................................................................... 19

8 ACRONYMS .................................................................................................................................... 20

For Public Use

1 Introduction