Simulated IT Attacks Reveal Response Flaws

The U.S. Department of Homeland Security issued the results of its Cyber Storm exercise on Sept. 13, highlighting areas where the government and private organizations must improve their responsiveness to emerging IT-related threats.

The agency release a 23-page report on the findings of the simulated IT attack, labeled by Homeland Security leaders as "the largest and most complex multinational, government-led cyber exercise to examine response, coordination and recovery mechanisms to a simulated cyber event."

The test found that major issues remain with the communication between public and private sector organizations in the face of attacks on IT infrastructure, and in those groups ability to piece together information to understand the scope of distributed threats. But the exercise does also contend that progress in improving those details is already being made.

The Cyber Storm test was launched to help gauge the information-sharing capabilities and IT attack readiness of government branches on the federal, state and local level. Also part of the study was those groups abilities to cooperate with foreign nations and private sector organizations in the event of a major attack or natural disaster.

Carried out over Feb. 6-10, 2006, by the National Cyber Security Division of the DoHS, the agency said Cyber Storm was meant to provide participants with a controlled environment in which they could simulate the coordination that would be necessary during a cyber-related incident of national significance, such as an attack on the infrastructure supporting the nations Internet operations or a natural disaster like Hurricane Katrina.

Funded by the federal government and mandated by Congress, the test included over 100 public and private organizations at over 60 locations in five countries that collaborated as they would in the case of such a crisis.

The exercise was meant to recreate the conditions an attack or disaster could have on operations related to the nations energy, IT, transportation and telecommunications sectors.

In a conference call with the media, Homeland Security leaders said the event was a success in arming the nation with real-world information regarding organizations ability to work together.

"In many ways, this exercise was designed to push the system to the maximum edge. That allows you to identify our greatest points of vulnerability, and were fundamentally working to update and take lessons from Cyber Storm and Katrina and look at how we can improve coordination," said Andy Purdy, acting director of the National Cyber Security Division at the U.S. Department of Homeland Security.

Hackers cash in on hijacked PCs. Click here to read more.

"We learned tangible lessons that were turning into progress every day; if results had been perfect wed know that the test wasnt designed properly. This is a maturing process."

Parties involved in the test staged primary cyber-attacks targeting the energy, transportation and IT/telecommunications sectors that were intended to disrupt certain elements of critical infrastructure.

The attacks were meant to touch off potentially "cascading effects" within other elements of the United States and participating countries economic, social and governmental structures.

Some of the attacks in the exercise were aimed specifically at disrupting government operations that would be used to respond to a cyber-threat in the name of undermining public confidence in those entities.

Next Page: Internal communication needs to get better.