The U.S. Department of Homeland Security issued the results of its Cyber Storm exercise on Sept. 13, highlighting areas where the government and private organizations must improve their responsiveness to emerging IT-related threats.
The agency release a 23-page report on the findings of the simulated IT attack, labeled by Homeland Security leaders as “the largest and most complex multinational, government-led cyber exercise to examine response, coordination and recovery mechanisms to a simulated cyber event.”
The test found that major issues remain with the communication between public and private sector organizations in the face of attacks on IT infrastructure, and in those groups ability to piece together information to understand the scope of distributed threats. But the exercise does also contend that progress in improving those details is already being made.
The Cyber Storm test was launched to help gauge the information-sharing capabilities and IT attack readiness of government branches on the federal, state and local level. Also part of the study was those groups abilities to cooperate with foreign nations and private sector organizations in the event of a major attack or natural disaster.
Carried out over Feb. 6-10, 2006, by the National Cyber Security Division of the DoHS, the agency said Cyber Storm was meant to provide participants with a controlled environment in which they could simulate the coordination that would be necessary during a cyber-related incident of national significance, such as an attack on the infrastructure supporting the nations Internet operations or a natural disaster like Hurricane Katrina.
Funded by the federal government and mandated by Congress, the test included over 100 public and private organizations at over 60 locations in five countries that collaborated as they would in the case of such a crisis.
The exercise was meant to recreate the conditions an attack or disaster could have on operations related to the nations energy, IT, transportation and telecommunications sectors.
In a conference call with the media, Homeland Security leaders said the event was a success in arming the nation with real-world information regarding organizations ability to work together.
“In many ways, this exercise was designed to push the system to the maximum edge. That allows you to identify our greatest points of vulnerability, and were fundamentally working to update and take lessons from Cyber Storm and Katrina and look at how we can improve coordination,” said Andy Purdy, acting director of the National Cyber Security Division at the U.S. Department of Homeland Security.
/zimages/3/28571.gifHackers cash in on hijacked PCs.Click hereto read more.
“We learned tangible lessons that were turning into progress every day; if results had been perfect wed know that the test wasnt designed properly. This is a maturing process.”
Parties involved in the test staged primary cyber-attacks targeting the energy, transportation and IT/telecommunications sectors that were intended to disrupt certain elements of critical infrastructure.
The attacks were meant to touch off potentially “cascading effects” within other elements of the United States and participating countries economic, social and governmental structures.
Some of the attacks in the exercise were aimed specifically at disrupting government operations that would be used to respond to a cyber-threat in the name of undermining public confidence in those entities.
Next Page: Internal communication needs to get better.
Internal Communication Needs to
get Better”>
“We dont want to get into an actual event and see that we have shortcomings. This is the time to look at those factors in advance,” said George W. Foresman, under secretary for preparedness at the DoHS.
Among the findings detailed in the report was the conclusion that correlation of multiple incidents across public and private IT infrastructures remains a “major challenge.”
While the cyber incident response community was generally effective in addressing single threats, and some distributed attacks, the DoHS said that most of the tests were treated as individual and discrete events, making it less likely for organizations to share data that could help point to widespread events.
Test leaders indicated that threat response coordination became more challenging as the volume of cyber-events increased.
The group said that interagency communication within the government was acceptable, but needs further refinement, specifically the manner in which different bodies, including the federal governments IIMG (Interagency Incident Management Group) and NCRCG (National Cyber Response Coordination Group), work together.
/zimages/3/28571.gifClick hereto read about hackers recently jailed for Zotob worm attack.
The report said that the contingency planning, risk assessment and definition of roles and responsibilities across the entire cyber-incident response community must solidify.
On the positive side, Cyber Storm found that the existing framework between international governments operated efficiently in terms of sharing information about domestic and international cyber-attacks.
The report made recommendations for improving performance in future tests, including more cyber-threat training and simulation programs, more services to inform the general public about attacks and new priority planning for dealing with threats as they arrive.
In a separate event, Vincent Weafer, senior director of security response at anti-virus market leader Symantec, was one of a panel of experts who testified before the U.S. House Commerce Subcommittee on Telecommunications and the Internet on Sept. 13 about efforts to protect the nations critical infrastructure, economy and consumers in the face of IT-related threats.
In an interview with eWEEK after his testimony, Weafer said that he was encouraged by the questions he received from legislators over his talk, which highlighted the need to protect individual organizations and businesses as part of protecting public confidence in IT and online infrastructure.
Weafer said that there is the possibility of critical infrastructure going down, but peoples confidence in doing business online is the bigger risk right now.
“Theyre worried about online transactions and this is affecting businesses like banks who cannot afford to go back to a brick-and-mortar model,” Weafer said.
“Its as much about protecting small companies and the effect that their loss of business has on the economy, and looking at short-term outbreaks where people understand that they can be affected by things like natural disasters … but what we heard today was encouraging,” he said.
/zimages/3/28571.gifCheck out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.