In this paper we discuss a work in progress to create a socio-technical system design framework for cyber security training exercises (STSD-CSTE) to support the development of cyber security training in the Norwegian Cyber Range (NCR). The process to create the framework started by first performing a socio-technical systems root cause analysis of an Advanced Persistent Threat (APT) incident called “Operation Socialist”. Operation Socialist was the code name given by the British signals and communications agency Government Communications Headquarters (GCHQ) to an operation in which they successfully breached the infrastructure of the Belgian telecommunications company Belgacom (now Proximus Group) between 2010 and 2013. To extract relevant information from the case four socio-technical systems models were tested. The four models integrated into one framework were the Cassano-Piche Structural Hierarchy model, the “Security by Consensus” model, the Kowalski's SocioTechnical systems dynamic model and the Withword's 8 criterial model. After this framework has been reviewed by the socio-technical research community we plan to test the framework with exercises in the Norwegian Cyber Range environment. NCR will be an arena where testing, training, and exercise will be used to expose individuals, public and private organizations and government agencies to simulate socio-technical cyber security events and situations in a realistic but safe environment.
and scenarios based on actual cyber incidents. In our work, we are attempting to combining socio-technical theory with didactic theory and crisis management training practices to cyber education and training.
The paper is structured as follows: After the introduction and background in section 1 and 2, in section 3 our research approach is discussed, together with our framework for building scenarios and exercises in cyber readiness based on real life incidents. In section 4, we review relevant literature. Then, in section 5 we present the case and one example of how we used socio-technical models to analyze the case, and in section 6 we exemplify the outcome of this application. In section 7 we end this paper by outline our prospects for further research.
Several threat-actors are focusing on telecom services and infrastructure. According
to Norwegian National Security Authority (NSM) in 2017 the NorCERT alarm on
critical national infrastructure were triggered more than 22.000 times and more than 5.200
Norwegian entities were subject to advanced cyber-attacks
Detecting anomalies that occur only within individual variables is often trivial, while
detecting correlation anomalies is much harder and is practically important in fault
analysis of complicated dynamic systems
To understand and manage cyber security situations, we suggest using
socio-technical models to prepare for training and education based on real-life incidents. A
sociotechnical system (STS) is the synergistic combination of humans, machines,
environments, work activities and organizational structures and processes that comprise a given
enterprise
In this paper, we approach the cyber security challenges using what can be referred
to as a naive inductivist approach. The naïve inductivist approach starts by first
observing a phenomenon and then generalizing the phenomenon which leads to theories that
can be falsified or validated
DSRIS requires three general activities: (1) construction of an artifact where
construction is informed either by practice-based insight or theory, (2) the gathering of data
on the functional performance of the artifact (i.e., evaluation), and (3) reflection on the
construction process and on the implications the gathered data (from activity (2)) have
for the artifact informing insight(s) or theory(s)
How to work on these steps was presented in a thesis written by Karokola
To propose an artifact in an inductive approach we started up by analyzing an actual cyber-incident to present the problem (first step in the 2nd column). For the next step in this work in progress paper we suggest a model based to deal with the problem in crisis management education in which different kind of exercises are needed to target different aspect in a socio-technical security system (second step in the 2nd column). The goal of the paper is to propose a tentative design (first step in the 4th column), in which we want to test when preparing for cyber exercises at the Norwegian Cyber Range. 3.1
The actual incident we chose for our first attempt to design a framework was the APT-attack “Operation Socialist” making international headlines in September 2013. Operation Socialist was the code name given by the British signals and communications agency Government Communications Headquarters (GCHQ) to an operation in which they successfully breached the infrastructure of the Belgian telecommunications company Belgacom (now Proximus Group) between 2010 and 2013.
We did a root cause analysis on this incident using four different socio-technical models. Those models were chosen based on the different approaches they have, to see if any or all of them could be relevant for making scenarios for exercises.
The responsible of the technical operations are often considered to be within the
organization. However, most organizations today are complex and cannot perform all
technical tasks by themselves. By entering into contracts and service level agreement
of various sort, the companies have other people and organizations to run their technical
operations and are therefore bounded by agreements and thereby regulations. Withford
& Zaic describe four different system levels to analyze requirements for technical
operation with WOSP (Web of System Performance)
The four quadrants used in the proposed framework are modeled after the naive
socio-technical system dynamic mental model proposed by Kowalski
The Security by Consensus model (SBC), is a model that attempt to capture the static
and dynamic characteristics of ICT systems security
In the Norwegian Cyber Range project, we also plan to run full-scale exercises in
Norway. Cassano-Piche et. al. Socio-technical systems analysis of the BSE Epidemic
in the UK using the Rasmussen framework helped vertically integrate a socio-technical
root cause analysis of Mad Cow Diseases across multiple levels and hierarchies of
socio-technical system in the United Kingdom as a whole
Suggested modelling four quadrants used in the proposed framework are modeled
after the naive socio-technical system dynamic mental model proposed d by Kowalski
First, we tried to see where scenarios for exercises could fit our socio-technical
model. There are several types of exercises, and in this paper, we have used the
exercise-definitions outlined by the Norwegian Directorate for Civil Protection (DSB):
discussion exercises, functional exercises, simulation exercises and full-scaled exercises.
A discussion exercise is executed under different kind of names, for example,
tabletop, dilemma-exercises or seminar-exercises
For each kind of exercise, we need relevant scenarios. A scenario is a summary of the plot of a play, including information about its characters, scenes, or a predicted sequence of events (The free dictionary, by Farlex). The common way of making scenarios is to find out who is participating in the exercise and make the scenario relevant for the participants. For example, in 2017, a group from NTNU, CCIS, The Norwegian Cyber Defence and the Norwegian Civil Defence made a table-top cyber exercise for the Oppland County Office management group and for the county readiness council. We made the scenario based on the participants and their responsibility. The scenario was based on what can happen in the society more than what has happened, and it was all made up by ideas. As a reflection after the exercise we asked ourselves if there are relevant theories to approach these kinds of scenarios in a better way, and we could not find any relevant theories on this specific matter.
Large companies have a similar approach for creating scenarios to run exercises. Telenor is running annual full-scale cyber exercises including participants and observers from the Norwegian Armed Forces, The Norwegian Police, The Norwegian National Security Authority and other invited participants. The scenarios are meant to reflect true-to-life cyber incidents the organization faces and put the participants to the test. Experiences and lessons learned build operational, tactical and strategic competence and improve the participant’s organizations in facing and managing cyber security incidents. Telenor has similar idea-based approach for making scenarios for exercises.
By considering either Structure, Methods, Machines or Ethical/Legal i.e. culture in the scenario for exercise build, we can determine where different exercises would be useful. Moreover, by having performed a root cause analysis and thus determined the underlying “real”, that is major and sine qua non - reasons for the cyber-attack, building an appropriate scenario based on this could prove more accurate, give higher learning quality/effect and more cost effective.
To exemplify this approach, we have discussed the NATO exercise Trident juncture executed in and hosted by Norway in 2018. The main scenario was made for the fullscale exercise within a 3-week timeline. The strategic part of the exercise was kept outside the full-scale exercise and started instead at the end of the full-scale exercise timeline. The scenario for the strategic part of the exercise was in this case based only on structure and methods. The scenario for the NATO exercise would in this case be placed both in an overall context in the model, but the strategic part of the exercise would be placed in the upper right part of the model.
When planning for the annual exercise at the Oppland county readiness council in
2017, the exercise's theme was a cyber-attack against municipalities ICT-systems
When testing systems such as fire alarm systems, it requires a certain methodology and actual use of machines. Fire-alarm exercises is typical functional exercises and you will be placed in the lower right corner in our model. Other known exercises that is based on methodology and machines is cyber mega games, better described as simulation games.
When analyzing the outlined DSB’s definitions of exercises, we found that there is
not any definition on cultural and machine exercises (lower left corner of our model).
However, there are examples of real-life incidents which has been used in teaching
strategic and ethical exercises, such as the Therax-25 case
Our scenario for exercise perception is shown in figure 2.
Today we witness rapid developments of APT tools and systems. Future scenarios
include attack vectors orchestrating sets of APT tools in mixed interaction with
networks of military units and civilian infrastructures. Carlsson & Gustavsson state that
we must prepare ourselves to cope with these threats through awareness and education
Most organizations are not prepared to handle the vast implications of these crises.
A challenge in crises is to transfer the accumulated knowledge flowing from concrete
experiences, well-documented by crisis management researchers, to learning models in
which organizational actors will be actively engaged. One of the avenues to better
integrate this learning can be found in organizational development approaches
Since the start of the 1980s, the field of crisis management has been characterized
by two main trends: planning in crisis management and the analysis of organizational
contingencies during a crisis
In our ongoing research, we use an actual APT-attack to extract the consequences from the attack and figure out what we can learn from such attacks, and how to implement lessons learned in exercises enable also other organizations learn from it.
Scenarios are tools for improving the decision-making process on a background of
possible future environments. The scenarios should not be treated as predictions
capable of influencing the future nor science fiction stories prepared merely to titillate the
imagination
5.1
Belgacom operates a substantial number of data links internationally and it serves
millions of people across Europe as well as officials from top institutions including the
European Commission, the European Parliament, the European Council and the NATO
HQ Europe. When Belgacom’s internal security team began to suspect that their system
was infected with a virus, they hired in outside experts, and after a while the Belgian
military intelligence to handle the situation
The operation's existence were revealed in documents leaked by the former National
Security Agency contractor Edward Snowden in 2013. The malware disguised as
legitimate Microsoft software, where identified as the source of the problems. The leakage
stated that it was the Government Communications Headquarters (GCHQ) who had
infiltrated Belgacom’s systems. GCHQ is the British intelligence and security
organization responsible for providing signals intelligence (SIGINT) and information
assurance to the government and armed forces of the United Kingdom. According to the
leaked documents, from Snowden, GCHQ had probed Belgacom's infrastructure for
years. Additionally, the documents suggested that Operation Socialist had been
recognized by the head of the GCHQ's Network Analysis Centre as a success. Snowden
subsequently described Operation Socialist as the "first documented example to show one
EU member state executing a cyber-attack on another…"
According to the leakage, GCHQ had been able to get access to vital data within the mentioned organizations. This led to both political and organizational difficulties for multiple stakeholders.
GCHQ had allegedly used Quantum Inserts technology to target Belgacom and
GPRS roaming exchange (GRX) providers like the Comfone, Syniverse, and Starhome.
Quantum Insert is the process of injecting TCP sessions into a TPC stream and sending
the victim in the wrong direction towards a malicious website that infects their
computers with malware at lightning pace
Technically Quantum Inserts are categorized as “man-on-the-side attacks” which is
a subcategory to “waterhole attacks”. As such APT-attacks are very difficult to
discover, the exact time of when the stealth implants were in place is uncertain, but the
investigators suggested an approximately startup in 2010. The Intercept summered up
the story timewise in 2018
One of the models we used for analyzing the case was the BSE Structural Hierarchy
model based on Rasmussen structural hierarchy model
We analyzed what impact the incident had on the different layers and moreover used the flowchart to show how decisions were made and had impact on other layers both in Belgacom and in other societal organizations.
The socio-technical models appear useful in understanding and defining training scenarios as it gives us a good indication on both social and technical challenges from real life cases.
The SBC Model appears to be a good model for making scenarios for table top exercise regarding the Belgacom incident, since it helps to indicate were the organization is vulnerable from a strategic level within the organization. By using the SBC model, we can make exercise that show the relationship between different both technical and social functions within (in this case) Belgacom, and a scenario could be made to support this.
For Kowalski’s socio-technical model we choose organizational and national level,
but we think that for writing scenarios, we could have chosen both local government
and other third-parties. We figured this model would be excellent for making scenarios
for discussion exercises and table-top exercises. This model gives the
instructors/trainers possibility to both focus and train the company and a third party. The idea of the
model is though in a continual state of surface flux, it is also striving to reach a state of
equilibrium or homeostasis
The BSE-model with the flow-chart shows how well aligned the different events are between different levels in this hierarchy, and we also see a scenario involving all these levels. This model shows that all levels are connected and gives us the reason to believe that this model can be used for making scenarios for full-scaled exercises, but also be toned down and used for all other types of exercises.
When we analyzed the Withword 8 criteria-model we found that this is related to organizational level in first, and as the WOSP are made to follow up on strategic decisions, this model can be used for discussions exercises. This assumes Information Security as part of the WOSP’s.
Below is a table outline the four different models and the type of exercise the actual incident can be applied.
In figure 5 we map the different socio-technical models together with the scenarios for exercises mapped in figure 2, to attempt to visualize and compare. We may conclude that by changing the models in one or another direction, they will be more suitable for the different kind of exercises. For example, the Kowalski model can float across the diagram based on the situation in the organization, and by that approach decide what exercise to consider.
We are proposing to name this comparing model a socio-technical system design framework for cyber security training exercises (STSD-CSTE).
Social-technical models enables us to introduce more holistic and near-to-life elements needed to be factored in designing scenarios. We need to verify and validate the findings we already have made, and to enhance and improve the STSD-CSTE model proposed. To validate the framework, we plan to test it when setting up exercises in the NCR environment. NCR will be an arena where testing, training, and exercise are tools to expose people, businesses, and units to realistic events and situations in a realistic but safe environment. The arena ensures efficient transfer of knowledge and building of real-world competence, that links together the strategic, operational, tactical and technical levels of decision making, by simulating the impacts of cyber security events on the levels of society, digital value chains and cyber infrastructure without harming the entities involved and their critical infrastructure.
In this paper we describe a root-cause analysis by using only four socio-technical models. In future work we will do a systematic-literature review of socio-technical modeling in general and select the models that best meets when designing exercise and scenario in the Norwegian Cyber Range.
To ensure the best possible effect in the cyber-range arena in Norway, current existing information systems tools used in the community will be, for example, ISCMS (information security crises management systems) systems, and facilitate accurate comprehension of scenarios fitted the different systems. Additionally, there will be need of preparedness learning based on real life incidents.
When analyzing the outlined DSB’s definitions of exercises, we found that there is no clear definition on cultural and machine exercises (lower left corner of our model). However, as mentioned there are examples of real-life incidents which has been used in teaching strategic and ethical exercises. We consider this as an area of which can be developed better in combining exercise-definitions and scenarios and have a work in progress in this matter.
As illustrated in figure 6, the more complex and capabilities involved in the training exercise, the more effort and resources must be put into planning.
Figure 6 also illustrates another adjacent topic; cost. A full-scale exercise requires far more resources than simple discussion meetings or tabletop exercises. By using a more granular (STSD-CTF) model, time and cost can be saved by facilitating management to help them identifying and choose appropriate test scenarios for the participating organization. By structured use of the (STSD-CTF) model scenario repository can be constructed. Scenario repository can be used to both re-use and exchange scenario and exercise. This may reduce costs of cyber security training and help to fill the existing competence gap for cyber security personnel in two ways: Directly to provide customized training exercise at low cost and secondly by allowing none security specialists to participate in organizational learning exercises. Moreover, consequently distribute the knowledge to handle the cyber security problem across the organization.
Being a working in progress paper it is difficult to have clear conclusions yet. However as indicate in figure 1 there are 5 distinct steps in the design science research process, problem analysis step, solutions suggestion step, development step, evaluations step and conclusion. This paper has outlined a work in progress in step 1 and step 2. In the next step we will develop scenario exercises and refine the evaluation criteria to measure the effectiveness of these exercise to help deal with the problem of fill the gap between the demand and supply of cyber security specialist and cyber security trained users.