SANS STX Cyber Range

Key Takeaways

but we came and visited Muscatatuck we were overwhelmed and this is a national treasure with all kinds of great infrastructures and facilities but it didn't have any cyber missions so they brought my team in here to help build out and define the first cyber missions that they run here at Muscatatuck this is what we would call a red team event in in the red team event there is a defensive force that is looking to identify characterize and learn about the tools techniques and practices of the TTP s of attackers in this particular exercise or embodying a nation-state attacker trying to replicate what real people would see in defending their organization's networks the the first scenario we built is reconnaissance plus the prison facility so the idea there is adversaries that are modeling an actual advanced persistent threat so the actual apt being modeled here has hacked into a small town and has laterally moved into the prison facilities where they're agitating they're getting into the camera system all of the doors and in fact the gates on the cells are controlled via SCADA systems and the adversaries have not only hacked in there they're starting to open up the gates the red team is trying to maintain their access and then at near the end of the event unlock all the prison doors to let the prisoners out of the system to try to conduct the exercise blue is trying their best to prevent that from happening we've defined a couple of additional missions we've got a mission on the water treatment plant where the bad guys hack in and try to contaminate the water we've also defined a mission associated with the subway terminal where the attackers have hacked into that environment they're changing the signage as part of a psychological operation as well as they packed into the ventilation system and they're injecting some sort of gas into the subway environment there's all sorts of different opportunities for us to be able to integrate these kinds of physical attacks where bad guys are trying to get kinetic access to real-world controls from a cyber angle so this time we're focusing primarily on the jail but there's a lot of other opportunities here for us to be able to continue developing new exercises with new kinetic impact I love visiting Muscatatuck because it shows the art of the possible there are so many different kinds of infrastructures here and and there's such opportunity for building out those infrastructures for cyber missions and these are the exact kinds of infrastructures that you'll see where our military has to engage both domestically and overseas we need people who are very capable of operating from a cyber perspective in environments just like this so it is an ideal training platform [Music]