With the cyber domain playing host to increased hostilities, being ready for cyberattacks has rarely been more crucial. Andrew Tunnicliffe finds out how NATO’s Locked Shields exercise is helping cyber defence specialists prepare for threats to critical infrastructure.

Cyberattacks and the methods by which the public and private sectors deter and counter them have occupied the headlines with increasing frequency in today’s tech-ladened world. Often we hear of the failures of those entrusted with our personal data, the consequences of seemingly poor cybersecurity management, and the damage to reputation or – worse still – IT infrastructure of public bodies and private organisations alike when a cyberattack was at least partially successful. 

However, it’s fair to say that having robust cybersecurity measures in place is a game of cat and mouse. This is something not likely to change, at least for the foreseeable future. The ability to avert and respond to cyberattacks has become a critical government and business concern, with the global cybersecurity market estimated to be worth $96bn in 2018, an increase of 80% year-on-year according to Gartner. 

More often than not, cyber activity is the domain of criminal operators interested in making money, but today, more than ever, state-backed players and even governments have been much more active, with different objectives. Critical infrastructure – financial institutions, power networks, healthcare providers and so on – have all fallen victim. 

Russia, Iran and North Korea, among others, have been accused of unashamedly increasing their activity with growing sophistication – although all have and continue to deny the accusations. 

“Berylia experienced a deteriorating security situation, where a number of hostile events coincided with coordinated cyberattacks against a major civilian internet service provider and a military airbase.”

The evolving cyber threat from ‘enemy’ states and criminal organisations alike continues to occupy the thoughts of those who operate critical infrastructure, as much as those tasked with protecting it. NATO’s Locked Shields exercise, now in its eighth year, is one example of ongoing efforts to keep a cyber defence force ready and prepared to intervene if an attack occurs. 

The five-day, live-fire drill, led earlier this year by NATO’s Communications and Information (NCI) agency and NATO’s Cooperative Cyber Defence Centre of Excellence (CCDCOE), simulated an attack on the critical infrastructure of a fictional country, Berylia.

“Berylia experienced a deteriorating security situation, where a number of hostile events coincided with coordinated cyberattacks against a major civilian internet service provider and a military airbase,” explains the CCDCOE's Kadri Kütt. 

Involving as many as 4,000 virtualised systems and more than 2,500 attacks, the real-time defence exercise was designed to enable national cyber defenders to practice the protection of national IT systems and critical infrastructure under the intense pressure of a severe cyberattack. Participants included more than 1,000 cybersecurity experts from 30 countries, the drill was a red versus blue scenario. 

Twenty-two blue teams from CCDCOE member states and experts from NATO and the European Union (EU) made up rapid reaction teams deployed to assist in containing and countering a large-scale cyber incident and all its multiple implications. Red teams carried out the attacks intended to cause severe disruptions to the operation of the electric power grids, 4G public safety networks, military drone operations and other critical infrastructure components.

“To stay abreast of market developments, Locked Shields focuses on realistic and cutting-edge technologies, scenarios, networks and attack methods.” 

“This year the exercise involved critical infrastructure that our entire modern lifestyle depends upon: power supply, clean water and emergency communications,” says Kütt. “The exercise trains the teams in how to protect unfamiliar environments and to make the right decisions with incomplete information, as computer emergency specialists often have to do in real-life situations.” 

The exercise addressed areas noted for their particular difficulty, she adds, including protecting unfamiliar specialised systems, writing good situation reports under serious time pressure, detecting and mitigating attacks in large and complex IT environments and well-coordinated teamwork.

“In addition to maintaining complex IT systems, blue teams must be effective in reporting incidents, executing strategic decisions and solving forensic, legal and media challenges,” Kütt continues. “To stay abreast of market developments, Locked Shields focuses on realistic and cutting-edge technologies, scenarios, networks and attack methods.” 

As well as teams from across member states, NATO and the EU, the private sector played a key role. Among others, Threod Systems provided its drones expertise, Ericsson assisted with 4G public safety networks for law enforcement and emergency, and Siemens assisted with software. “The role of private sector partners is crucial. We cooperate with industry partners that bring specialised capabilities and technologies used all over the world,” says Kütt.

Considering the interdependencies in the cyber realm, nations have to take measures to protect vital services, critical information infrastructure and military systems, Kütt explains, adding that in the real world, the military cyber domain cannot be separated from the civilian sphere.

“In 2018 the exercise highlighted the growing need to enhance dialogue between technical experts and decision-makers,” she says. “CCDCOE integrated the technical and strategic game, enabling participating nations to practice the entire chain of command in the event of a severe cyber incident involving both civilian and military players.”

According to Kütt, the exercise 'highlighted the growing need to enhance dialogue between technical experts and decision-makers'. 

“Our cyber defenders will never be ready, they have to keep learning and practicing cooperation with like-minded nations on a regular basis.” 

Locked Shields 2018, the largest and most complex international live-fire cyber defence exercise in the world, was won by the NATO team, with France and the Czech Republic taking second and third place, respectively. But. although the exercise was a success, Kütt warns the job is never done. 

“The systems running our critical infrastructure and military technologies are in constant development, we have to test and drill our resilience and defence on a regular basis,” she says. “Our cyber defenders will never be ready, they have to keep learning and practicing cooperation with like-minded nations on a regular basis.” 

The cat and mouse continue to do battle.