3j4e –jigsaw, jumpstart, juncture forexercises ... · play of basic adoption of prepared scenario...

26
3J4E – JIGSAW, JUMPSTART, JUNCTURE for Exercises Three ways to enhance your cyber exercise experience Stefan Ritter FIRST Conference Berlin / 2015/06/15 2015/06/15 National IT-Situation Center and CERT-Bund 1

Upload: nguyenthuan

Post on 17-Aug-2019

213 views

Category:

Documents


0 download

TRANSCRIPT

3J4

E –

JIG

SA

W, J

UM

PS

TA

RT

, JU

NC

TU

RE

fo

rE

xer

cise

s

Th

ree

way

sto

enh

ance

yo

ur

cyb

erex

erci

seex

per

ien

ce

Ste

fan

Rit

ter

FIR

ST

Co

nfe

ren

ce B

erli

n /

20

15

/06

/15

20

15

/06/1

5N

atio

na

l IT-S

itua

tion

Ce

nte

r a

nd

CE

RT-B

un

d1

Na

tio

na

l IT

-Sit

ua

tio

n-C

ente

r

20

15

/06/1

5N

atio

na

l IT-S

itua

tion

Ce

nte

r a

nd

CE

RT-B

un

d2

Na

tio

na

l IT

-Cri

sis-

Rea

ctio

n-C

ente

r

20

15

/06/1

5N

atio

na

l IT-S

itua

tion

Ce

nte

r a

nd

CE

RT-B

un

d3

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

d C

ER

T-B

un

d4

3J4

E -

Mo

du

les

JIG

SA

W

JU

MP

STA

RT

JU

NC

-T

UR

E

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d5

3J4

E -

Mo

du

les

JIG

SA

W

JU

MP

STA

RT

JU

NC

-T

UR

E

Lar

ge

scal

e IT

-Cri

sis

Man

agem

ent

Exe

rcis

es

�LU

EK

EX

�7

0 B

SI-

pla

yers

(3

00

0,

5+

7

DE

sta

tes,

80

in

stitu

tio

ns)

�C

yber

Euro

pe

�2

0 B

SI-

pla

yers

(2

5 n

atio

ns)

�C

yber

Sto

rm I

V

�4

0 B

SI-

pla

yers

56

h

(14

na

tio

ns)

�N

AT

O C

C (

~2

9 n

atio

ns)

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d6

Preparation

Pa

rtic

ipa

tio

n M

atr

ix

Basic

Med

ium

Hig

h

Unid

irectional

Com

munic

ation

Multid

irectional

Com

munic

ation

Multid

imensio

nal

Com

munic

ation

1 P

ers

on

2 –

5 P

ers

ons

5 o

r m

ore

pers

ons

Poin

t of

Conta

ct

with

reply

Contr

ibute

to

pla

nnin

g

confe

rences

Hig

h c

ontr

ibution in

top level exerc

ise

pla

nnin

g

Basic

adoption o

f pre

pare

d s

cenario

ele

ments

Influence s

cenario

Advanced a

doption

of

pre

pare

d s

cenario

ele

ments

Ow

n local ele

ments

Make s

cenario

decis

ions

Develo

p c

om

ple

te

sto

rylin

eC

reate

ow

n

obje

ctives

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d7

Playing

Pa

rtic

ipa

tio

n M

atr

ix

Basic

Med

ium

Hig

h

Unid

irectional

Com

munic

ation

Multid

irectional

Com

munic

ation

Multid

imensio

nal

Com

munic

ation

1 P

ers

on

2 –

5 P

ers

ons

5 o

r m

ore

pers

ons

Take p

art

in

confc

alls

Contr

ibute

in

confc

alls

with o

wn

ideas

Pla

y w

ith n

ational

crisis

managem

ent

team

Pla

y of

basic

adoption o

f pre

pare

d

scenario e

lem

ents

Basic

incid

ent

handlin

gLeadin

g r

ole

in I

T

Crisis

-Managem

ent

Incid

ent

Facili

tato

r

Receiv

e info

rmation

Share

info

rmation

Deta

iled t

echnic

al

and s

ituational

report

s

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d8

Mu

ltil

evel

Jig

saw

Sce

nar

io

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d9

AN

D /

OR

Ke

y-an

d-L

ock

Sce

nar

io E

lem

en

ts

Sce

nar

io D

esig

n

Support

ing B

asic

Scenario

sto

rylin

es/t

racks

+ consolid

ation

=

solu

tion

?? ?? ?

?!!

!?

?

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d1

0

Sce

nar

io W

ork

flo

w(s

)

Obje

ctives

>E

xpecte

d P

laye

rA

ctions

>S

tory

line

>M

SE

L>

Pla

y

Sta

ndard

Work

flow

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d1

1

Sce

nar

io W

ork

flo

w(s

)

Obje

ctives

>E

xpecte

d P

laye

rA

ctions

>S

tory

line

>M

SE

L>

Pla

y

Obje

ctives

+P

art

icip

ati

on

C

om

mit

men

t

>C

luste

red

Expecte

d

Pla

yerA

ctions

>C

luste

red

Sto

rylin

e>

Jig

saw

MS

EL

>C

luste

red

Pla

y

Sta

ndard

Work

flow

Modifie

d c

luste

red W

ork

flow

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d1

2

Exe

rcis

ing

is s

tory

tel

lin

g...

�B

aselin

e

�D

ram

atu

rgy

�C

hara

cte

rs

�H

igh a

nd L

ow

Action

�T

urn

ing P

oin

ts

US

E I

T!

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d1

3

Co

sts

/ E

ffo

rts

Sta

ndard

-Exerc

ise

MC

EF

-Exerc

ise

0

0,2

0,4

0,6

0,81

1,2

Hig

h A

ctive

Pla

yer

Mediu

m P

layer

Basic

Part

icip

ant

→ C

osts

for

Hig

h A

ctive P

laye

rs d

on't

rise s

ignific

antly.

The o

thers

can p

art

icip

ate

fro

m them

.

Jig

sa

w

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d1

4

3J4

E -

Mo

du

les

JIG

SA

W

JU

MP

STA

RT

JU

NC

-T

UR

E

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d1

5

JUM

PS

TA

RT

: Ba

sics

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d1

6

Pre

-EX

PO

ST

-EX

(N

OT

PLA

YE

D!)

P

re-E

XE

X-P

lay

ST

AR

TE

XE

ND

EX

Crisi

s M

anagem

ent In

itC

risi

s M

anagem

ent

Wra

p U

pD

ete

ctio

nR

eport

ing / A

lert

ing

Wra

p U

pR

esp

onse

Pre

-Crisi

s

•O

bserv

e•

Orient

•D

ecid

e•

Act

JUM

PS

TA

RT

: As

Is

Pre

-EX

Crisis

Man

ag

em

ent

Wra

p U

p

Pre

-EX

EX

-Pla

yP

OS

T-E

X (

NO

T P

LA

YE

D!)

Dete

ction

Repo

rtin

g / A

lert

ing

Wra

p U

pR

esponse

Pre

-Crisis

EN

DE

XS

TA

RT

EX

Inte

rna

tiona

l P

lay

Nation

al P

lay

Crisis Management Intensity

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d1

7

JUM

PS

TA

RT

: En

ha

nce

men

t

Pre

-EX

EX

-Pla

yP

OS

T-E

X

De

tection

Wra

p U

pR

espon

se

Re

port

ing

/ A

lert

ing

JU

MP

ST

AR

TE

ND

EX

Pre

-Crisis

Inte

ratio

nal P

lay

Nationa

l P

lay

Crisis Management Intensity

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d1

8

JUM

PS

TA

RT

: Tim

elin

e C

om

pre

ssio

n

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d1

9

3J4

E -

Mo

du

les

JIG

SA

W

JU

MP

STA

RT

JU

NC

-T

UR

E

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d2

0

JUN

CT

UR

E: A

s Is

„Wh

ysh

ou

ldI

pa

rtic

ipa

te?

„Wh

atis

my

be

ne

fit?

„To

ote

ch

nic

al“

„My

focu

sis

po

litic

al“

„To

om

uch

de

tails

„No

t m

ym

an

ag

em

en

tle

ve

l“

„So

rry,

I d

on

‘tu

nd

ers

tan

d“

„I f

ee

lm

isu

nd

ers

too

d“

„Yo

ud

on

‘tu

nd

ers

tan

dm

y

str

ate

gy“

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d

JUN

CT

UR

E: E

nh

an

cem

ent

Fo

cu

s o

n:

�S

tra

teg

ic le

ve

l

info

rma

tio

nn

ee

ds

�D

ecis

ion

Su

pp

ort

�D

ecis

ion

Ma

kin

g

�A

gg

reg

ate

dE

ve

nts

�S

ing

ula

r E

ve

nts

�(p

hys

ica

l)

CO

NS

EQ

UE

NC

ES

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d2

2

JUN

CT

UR

E: H

ow

To

(Sin

gu

lari

ty)

Management Level

Hig

hly

div

ers

ed

sin

gle

eve

nt

info

rma

tio

n.

an

d info

rma

tio

n o

n S

ingu

larity

Eve

nt

Slig

htly m

od

ifie

d in

form

ation o

n

Sin

gula

rity

Even

t

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d2

3

JUN

CT

UR

E: H

ow

To

(Ag

gre

ga

tio

n)

Management Level

Hig

hly

div

ers

ed s

ingle

event

info

rmation.

Com

pre

ssed a

nd h

ighly

aggre

ga

ted

situational in

form

ation

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d2

4

3J4

E: C

on

clu

sio

n

�3J4E

is a

n inspiration

�expecta

tion m

anagem

ent

of

pla

yers

�jig

saw

sto

ry-t

elli

ng

�ke

y +

lo

ck s

ce

na

rio

�pla

y diffe

rent

part

s o

f in

cid

ent

tim

elin

e

�in

volv

e m

anagem

ent

adequate

ly

�firs

t experiences s

uccessfu

l

�d

o n

ot th

ink t

oo

co

mp

lica

ted

�tr

y it!

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d2

5

Ko

nta

kt

Bu

nd

esam

t fü

r S

ich

erh

eit

in d

er

Info

rmat

ion

stec

hn

ik (

BS

I)

Nat

ion

al I

T-S

itu

atio

n C

entr

ean

dC

ER

T-

Bu

nd

Go

des

ber

ger

-All

ee 1

85

-1

89

53

17

5 B

on

n

Tel

: +

49

(0)2

28

99

-95

82

-51

10

Fax

: +4

9 (0

)22

89

9-1

0-9

58

2-5

11

0

lag

ezen

tru

m@

bsi

.bu

nd

.de

ww

w.b

si.b

un

d.d

ew

ww

.bsi

-fu

er-b

uer

ger

.de

20

15

/06

/15

Nat

ion

al I

T-S

itu

atio

n C

ente

r an

dC

ER

T-B

un

d2

6