The Concept of Cyber Defence Exercises (CDX): Planning, Execution, Evaluation

Abstract

This paper discusses the concept of cyber defence exercises (CDX) that are very important tool when it comes to enhancing the safety awareness of cyberspace, testing an organization's ability to put up resistance and respond to different cyber events to establish the secure environment, gathering empirical data related to security, and looking at the practical training of experts on this subject. The exercises can give ideas to the decision makers about the precautions in the cybersecurity area and to the officials, institutions, organizations, and staff who are responsible on the cyber tools, techniques, and procedures that can be developed for this field. In the cyber defense exercises, the scenarios that are simulated closest to reality which provides very important contributions by bringing together the necessity of making the best decisions and management capabilities under the cyber crisis by handling stress and coordinated movement as a team. The objective of this paper is to address the issue from a scientific point of view by setting out the stages of planning, implementation, and evaluation of these exercises, taking into account and comparing international firefighting exercises. Another aim of the work is to be able to reveal the necessary processes that are required for all kind of cyber exercises, regardless of the type, although the processes involved vary according to the target mass of the planned exercise.Index Terms-Cyber defense, security exercises, cyber resilience, cyber threat, cyber security, cyber-attack mitigation, cyber crisis management. I. RELATED WORKCDX have been identified as an efficient mechanism to practice IT security awareness training [1,2] but are also an ultimate tool to reveal and define the different security needs of every organization [3]. It provides an excellent opportunity and ultimate learning experience [4,5] for the students to improve their skills in protecting and defending information systems are assessed in the context of realistic, true-to-life scenario [6]. On the other side, as discussed by Vigna [7] and Mink [8], the offensive security training is also an effective way to learn information security. The previous works in this area examined the structure [9] and how to use of cyber defence competitions, overall effectiveness of live-attack exercises in teaching information security [10], curriculum and course format at CDX in which teams design, implement, manage and defend a network of computers [11][12][13][14][15]. Other literature has examined the benefit of conducting cyber defense competitions at the K-12 level [16,17]. The architecture of a cyber defense competition [18] and different tools and techniques used and how they fit into an active learning approach and how it focuses on the operational aspect of managing and protecting an existing network infrastructure were described by Green et al [19].

Cyber Ranges and TestBeds for Education, Training, and Research

“…In question 3, we have another categorization of a cyber range, which is the domain that the systems operate. Another area that is flourishing is the conduct of cybersecurity exercises [62][63][64]. As expected, the results of the domain cybersecurity competition are very high, Figure 3, about 80%, as well as in SCADA, reach 60%.…”

Game‐based learning: A review of tabletop exercises for cybersecurity incident response training

“…This is because real‐life CSIR activities are handled by CSIRTs made up of staff with diverse backgrounds and multiple skills, who must collaborate and share information to handle the incident. The findings further determined that TTX training offered opportunities for trainees to reflect on progress through self‐analysis, and encouraged participants to learn from, and react to the strategies and actions of others like adversaries during an attack and defense training scenario 46,73 …”

“…The findings further determined that TTX training offered opportunities for trainees to reflect on progress through self-analysis, and encouraged participants to learn from, and react to the strategies and actions of others like adversaries during an attack and defense training scenario. 46,73 The study established that despite their strengths, TTX SGs training has some shortcomings. It deciphered that some training activities were based on assumptions, relying on artifacts during training instead of actual incident handling equipment.…”

Trends and challenges for balanced scoring in cybersecurity exercises: A case study on the example of Locked Shields

“…Recent research presents various scoring systems at a high level, typically described as motivational, linked to learning objectives, and assisting in monitoring performance, progress, and feedback (Patriciu and Furtuna, 2009;Čeleda et al, 2015;Çalişkan et al, 2017;Maennel et al, 2017;Vykopal et al, 2017Vykopal et al, , 2018Seker and Ozbenli, 2018;Ernits et al, 2020;Mäses et al, 2021). Due to CSX complexity, a single score or measurement cannot capture every ability learned, and different learning objectives call for different scoring approaches (Andreolini et al, 2020).…”