Risk
4/9/2008
06:20 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

RSA: Cyber Storm II Builds Network To Defend Against Cyber Crisis

The latest government-sponsored simulated computer security crisis shows there are still some shortfalls in information sharing.

Among the goals for Cyber Storm II, a government-sponsored computer security exercise that occurred last month, was testing information sharing capabilities across organizations during a crisis.

By the accounts of panelists at the RSA Conference in San Francisco who participated in the exercise, the simulated cyber crisis was hugely valuable; they just couldn't share very much information about what went on.

Detailed information about Cyber Storm II will be made available later this summer in an after-action report, said Greg Garcia, assistant secretary for cybersecurity with the Department of Homeland Security.

It thus came as no surprise when U.S. CERT's deputy director Randy Vickers acknowledged that the exercise showed there were still some shortfalls in information sharing during the simulated crisis.

Other panelists included Michigan CIO Dan Lohrmann, New Zealand's managing director of critical infrastructure protection Paul McKittrick, Microsoft senior security specialist Paul Nicholas, and Dow senior information systems manager Christine Adams.

After listening to the panelists talk for forty-five minutes in very general terms about what their organizations hoped to accomplish and in similarly vague terms about various "learnings" that emerged, questions were solicited from the audience.

One pony-tailed RSA attendee, presumably a security pro, expressed dissatisfaction with the lack of specific information disclosed about Cyber Storm II and asked bluntly, "Was there a red team and did they win?"

According to the color traditions observed by the military and security professionals, the red team typically represents an attacking enemy and the blue team typically represents the defenders or home country.

"We don't have a firm answer about winning or losing," said panel moderator Jordana Siegel, acting deputy director at Department of Homeland Security. She however did allow that the exercise had taught everyone a lot.

Generally speaking, the U.S. government has not been shy when it comes to proclaiming its successes.

But if the blue team got trounced, that should not be an entirely unexpected result given that in real world version Cyber Storm II -- now playing on the Internet and coming soon to a network near you -- the red team scores victories daily, against government agencies, businesses, organizations, and individuals.

Vickers insisted that the red team-blue team dynamic didn't quite fit Cyber Storm II. That may be Cyber Storm III. But Cyber Storm II in March was more about getting ready to be tested. It was more about networking, which is to say building interpersonal relationships across organizations among those who may one day face a real cyber crisis.

Citing the words used by Homeland Security Secretary Michael Chertoff at his RSA keynote speech on Tuesday, Garcia said, "It takes a network to defeat a network, and that network is the adversary."

Whatever else it did, Cyber Storm II strengthened the foundations of the blue team's network, the public-private partnership that oversees critical cyber infrastructure.

And as Microsoft's Nicholas observed, public-private partnership "is easy to say but it's hard to do."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-4403
Published: 2015-04-24
Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a product via a delete_product_confirm action to product.php or (2) disable a product via a setflag action to categories.ph...

CVE-2012-2930
Published: 2015-04-24
Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an adduser action to admin/index.php or (2) conduct static PHP code injection attacks in .htusers...

CVE-2012-2932
Published: 2015-04-24
Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the (1) selitems[] parameter in a copy, (2) chmod, or (3) arch action to admin/index.php or (4) searchitem parameter in a search action to admin/...

CVE-2012-5451
Published: 2015-04-24
Multiple stack-based buffer overflows in HttpUtils.dll in TVMOBiLi before 2.1.0.3974 allow remote attackers to cause a denial of service (tvMobiliService service crash) via a long string in a (1) GET or (2) HEAD request to TCP port 30888.

CVE-2015-0297
Published: 2015-04-24
Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methos via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.