GETIT3

TRANSCRIPT

The United States’ critical infrastructure—power, water, oil and natural gas, military systems, financial systems—have become the target of cyber and physical attacks as more critical infrastructure systems are integrated with the internet and other digital controls systems. The lesson learned in mitigating and defending against cyberattacks is that no entity can prevent or resolve cyberattacks on its own. Collaboration and information sharing are key for success and survival.

This is a group exercise, representing collaboration across all sectors to support and defend US critical infrastructure. In the working world, a team like this would include agencies, industrial partners, and private sector corporations. Each organization has different strengths and skills, different access to information, and different authorities to report to. When the sectors work together and share resources and skills, the result is that everyone benefits from the defense and protection of US IT infrastructure.

In your teams, you can model the same collaboration, leveraging each other’s expertise, sharing each other’s knowledge, and teaching each other. This will include providing contributions specific to your role in the scenario:

· Financial Services Representative, special task in Step 3

· Law Enforcement Representative, special task in Step 4

· Intelligence Agency Representative, special task in Step 5

· Homeland Security Representative, special task in Step 6

There are seven steps that will help you create your final deliverables.

The deliverables for this project are as follows:

1. Security Assessment Report (SAR): This report should be a 14- to 15-page double-spaced Word document with citations in APA format. The page count does not include figures, diagrams, tables, or citations.

2. After Action Report (AAR): This report should be a 10- to 15-page double-spaced Word document with citations in APA format. The page count does not include figures, diagrams, tables, or citations.

3. Presentation: This should be a five- to eight-slide PowerPoint presentation for executives, along with a narrated or in-class presentation, summarizing your SAR and AAR reports.

You are part of a collaborative team that was created to address cyber threats and exploitation of US financial systems’ critical infrastructure. Your team has been assembled by the White House cyber national security staff to provide situational awareness about a current network breach and cyberattack against several financial service institutions.

Your team consists of four roles:

· A representative from the financial services sector, who has discovered the network breach and the cyber attacks. These attacks include distributed denial-of-service attacks, DDOS, web defacements, sensitive data exfiltration, and other attack vectors typical of this nation-state actor.

· A representative from law enforcement, who has provided additional evidence of network attacks found using network defense tools.

· A representative from the intelligence agency, who has identified the nation-state actor from numerous public and government-provided threat intelligence reports. This representative will provide threat intelligence on the tools, techniques, and procedures of this nation-state actor.

· A representative from the Department of Homeland Security, who will provide the risk, response, and recovery actions taken as a result of this cyber threat.

Your team will have to provide education and security awareness to the financial services sector about the threats, vulnerabilities, risks, and

risk mitigation

and remediation procedures to be implemented to maintain a robust security posture.

Finally, your team will take the lessons learned from this cyber incident and share that knowledge with the rest of the cyber threat analysis community. At the end of the response to this cyber incident, your team will provide two deliverables.

Close

INTRODUCTION

The United States’ critical infrastructure—power, water, oil and natural gas, military systems, financial systems—have become the target of cyber and physical attacks as more critical infrastructure systems are integrated with the internet and other digital controls systems. The lesson learned in mitigating and defending against cyberattacks is that no entity can prevent or resolve cyberattacks on its own. Collaboration and information sharing are key for success and survival.
This is a group exercise, representing collaboration across all sectors to support and defend US critical infrastructure. In the working world, a team like this would include agencies, industrial partners, and private sector corporations. Each organization has different strengths and skills, different access to information, and different authorities to report to. When the sectors work together and share resources and skills, the result is that everyone benefits from the defense and protection of US IT infrastructure.
In your teams, you can model the same collaboration, leveraging each other’s expertise, sharing each other’s knowledge, and teaching each other. This will include providing contributions specific to your role in the scenario:
· Financial Services Representative, special task in Step 3
· Law Enforcement Representative, special task in Step 4
· Intelligence Agency Representative, special task in Step 5
· Homeland Security Representative, special task in Step 6
There are seven steps that will help you create your final deliverables. The deliverables for this project are as follows:
1. Security Assessment Report (SAR): This report should be a 14- to 15-page double-spaced Word document with citations in APA format. The page count does not include figures, diagrams, tables, or citations.
2. After Action Report (AAR): This report should be a 10- to 15-page double-spaced Word document with citations in APA format. The page count does not include figures, diagrams, tables, or citations.
3. Presentation: This should be a five- to eight-slide PowerPoint presentation for executives, along with a narrated or in-class presentation, summarizing your SAR and AAR reports.

STEP 2: ASSESS SUSPICIOUS ACTIVITY

Your team is assembled and you have a plan. It’s time to get to work. You have a suite of tools at your disposal from your work in the earlier projects. That work can be used to create a full common operating picture of the cyberthreats and vulnerabilities that are facing the US critical infrastructure. Begin by reading the following resources to brush up on your knowledge:

1.

network security

2.

mission-critical systems

3.

penetration testing

All team members must leverage network security skills by using port scans, network scanning tools, and analyzing Wireshark files to assess any suspicious network activity and network vulnerabilities.

STEP3: THE FINANCIAL SECTOR

To be completed by the Financial Services Representative: Provide a description of the impact that the threat would have on the financial services sector. These impact statements can include the loss of control of the systems, the loss of data integrity or confidentiality, exfiltration of data, or something else. Also provide impact assessments as a result of this security incident to the financial services sector. Ensure that the information is appropriately cited.

To be completed by all team members: Provide submissions from the Information Sharing Analysis Councils related to the financial sector. You can also propose fictitious submissions. Then, review the resource for 

industrial control systems

 and explain their level of importance to the financial services sector. Explain risks associated with the industrial control system. Ensure that the information is appropriately cited.

STEP 4: LAW ENFORCEMENT

To be completed by the Law Enforcement Representative: Provide a description of the impact that the threat would have on the law enforcement sector. These impact statements can include the loss of control of systems, the loss of data integrity or confidentiality, exfiltration of data, or something else. Also provide impact assessments as a result of this security incident to the law enforcement sector. Ensure that the information is appropriately cited.

STEP 5: THE INTELLIGENT COMMUNITY

To be completed by all team members: Provide an overview of the life cycle of a cyberthreat. Explain the different threat vectors that cyber actors use and provide a possible list of nation-state actors that have targeted the US financial services industry before.

Review this 

threat response and recovery

 resource and use what you learn to propose an analytical method in which you are able to detect the threat, identify the threat, and perform threat response and recovery. Identify the stage of the cyberthreat life cycle where you would observe different threat behaviors. Include ways to defend and protect against the threat. Provide this information in your SAR and AAR. Ensure that the information is appropriately cited.

To be completed by the Intelligence Community Representative: Provide intelligence on the nation-state actor and the actor’s cyber tools, techniques, and procedures. Use available threat reporting such as from FireEye, Mandiant, and other companies and government entities that provide intelligence reports. Also, include the social engineering methods used by the nation-state actor and their reasons for attacking US critical infrastructure. Include this information in your SAR and AAR. Ensure that the information is appropriately cited.

STEP 6: HOME LAND SECURITY

To be completed by the Homeland Security Representative: Use the US-CERT and similar resources to discuss the vulnerabilities and exploits that might have been used by the attackers. Ensure that the information is appropriately cited.

Explore the resources for 
risk mitigation and provide the risk, response, and risk mitigation steps that should be taken if an entity suffers the same type of attack.

To be completed by all team members: Provide a risk-threat matrix and a current state snapshot of the risk profile of the financial services sector. These reports will be part of an overall

risk assessment

, which will be included in your SAR and AAR. Ensure that the information is appropriately cited.

Review and refer to this 
risk assessment resource to aid you in developing this section of the report.

STEP 7: THE SAR AND AAR

All team members: After you compile your research and your own critical assessments and analysis, determine which information is appropriate for a Security Assessment Report (SAR) that will be submitted to the White House, and for an After Action Report (AAR) that will be submitted to the rest of the analyst community.

1. Prepare your SAR for the White House Cyber National Security staff, describing the threat, the motivations of the threat actor, the vulnerabilities that are possible for the threat actor to exploit, current and expected impact on US financial services critical infrastructure, the path forward to eliminate or reduce the risks, and the actions taken to defend and prevent against this threat in the future.

2. Prepare the AAR. This knowledge management report will be provided to the cyberthreat analyst community, which includes the intelligence community, the law enforcement community, the defense and civilian community, the private sector, and academia. The purpose of the AAR is to share the systems life cycle methodology, rationale, and critical thinking used to resolve this cyber incident.

The deliverables for this project are as follows:
1. Security Assessment Report (SAR): This report should be a 14- to 15-page double-spaced Word document with citations in APA format. The page count does not include figures, diagrams, tables, or citations.
2. After Action Report (AAR): This report should be a 10- to 15-page double-spaced Word document with citations in APA format. The page count does not include figures, diagrams, tables, or citations.

3. Presentation: This should be a five- to eight-slide PowerPoint presentation for executives, including narration or an in-class presentation with each team member summarizing a portion of your SAR and AAR reports.