Raising awareness of the organization's employees comes down to cyber exercise. They can target both an individual employee and specialists in general. This is implemented mainly in four stages of organization of the cyber exercises. In the first stage, the purpose, scenarios, evaluating system of results for their execution are defined, and scenario-modeling environment is established. It is tested for compliance with the purpose of cyber exercises within the second stage. In the third stage, cybersecurity scenarios are being developed. The results of the execution are evaluated in the fourth stage. This is due to the relevance of the analysis of approaches to the organization of cyber exercises. In solving this problem, it was established that there was no uniform interpretation of this concept. First, such ambiguity of interpretations is associated with the direction of cyber exercises. Therefore, approaches to their organization are focused on obtaining theoretical knowledge, practical skills, and cybersecurity skills. Primarily, an incident detection and prevention approach is common. Another common approach is assessment of cybersecurity through penetration testing. The application of these approaches can be generalized and organized as a game.
An important element of promoting and maintaining cybersecurity in an organization
is knowledge and awareness of existing threats types and real attacks on critical
infrastructure. [
There are four stages in the organization of cyber exercises [
Now there is no unified interpretation of the “cyber exercises”, concept for example:
“cyber training”, “cyber range”. Sometimes “cyberlearning” term is used, particularly,
when organizing remote cyber exercises. It is focused primarily on obtaining theoretical
knowledge. Unlike “cyberlearning”, a characteristic feature of “cyber training” and
“cyber range” is the focus on obtaining of practical cybersecurity skills [
Such terms as “cybersecurity exercises”, “cyber defense exercises” are often used
as interchangeable, and describe cyber exercises as processes for preparing, evaluating,
practicing, and improving the effectiveness of the organization to ensure cybersecurity
[
In military terms “drills” and “exercises” sometimes refer to similar activities,
especially when it comes to training sessions [
A typical approach to organizing cyber exercises is characterized by the acquisition
of skills and abilities to respond to cybersecurity incidents. First, they focus on both
their detection and prevention of manifestation in future activities [
The specificity of each of the known approaches to organizing cyber exercises is
determined by their purpose and focus, and depends on the training level (qualifications) of
the organization’s specialists. Among them, an approach that focuses on responding to
cyber incidents and reducing the consequences of their manifestations stands out.
Therefore, cyber exercises are carried out to practice protection methods that can be
used in responding to cybersecurity incidents. Defense Oriented Approach for cyber
exercises is one of the most promising approaches to cybersecurity [
Raising the awareness of the organization’s employees is achieved through various
forms of cyber exercise, in particular, progressive, specialized and individual. This
allows participants to test their knowledge, ability, and cybersecurity skills. Among the
common forms of cyber-training, the following ones stand out [
2. Simulation exercises – these are practical training sessions in which cyber incidents are simulated. For example: Cyber Coalition, Cyber Europe exercises conducted by ENISA. Practical activities allow participants to see the effects of cyberattacks in a controlled environment.
3. Full scale Exercises – these are challenging exercises that are designed to
provide practical skills in real time. For example: Locked Shields and Baltic Shields
exercises. This type of simulation is realistic, it allows you to check cybersecurity plans,
security policies [
The Defense Oriented Approach is more about system administration and digital
forensics. Participants of cyber exercise who seek to defend themselves against cyber
incidents and their consequences should be aware that defense activities are a
continuous process that can be represented by a sequence of such actions [
2. Security status monitoring – Plays a critical role in determining how effectively security policy requirements are met. This is achieved by using, for example, intrusion detection and prevention systems. They can be considered as an effective solution for monitoring unwanted traffic.
3. Testing of security measures is seen as the only way to convince the implemented means to maintain the security policy. The purpose of security measures testing is to identify all possible loopholes and weaknesses of the software system, which might result in a loss of important information.
4. Improving security assurance – achieved by considering vulnerability reports and security advisories that help keep abreast of new potential attacks. Monitoring, testing, and identifying vulnerabilities is critical to refining and tuning security policies.
Such actions are considered as the basis for the presentation “Security Wheel” (see,
for example [
In the Defense Oriented Approach, there are at least three ways to organize exercises
for cyber exercises participants [
1. Obtaining requirements and services that must be provided and / or developing their own measures, means to meet them.
2. Obtaining the default settings for certain systems, programs, or services that must be provided and configured to meet security requirements.
3. Access to the installed and configured systems, programs, services whose security must be ensured. In this approach, the attacker can be seen as an instructor or an external party.
An example of using Defense Oriented Approach is Blue Teaming exercise. It is designed to train the team, which must ensure the security of pre-configured and secure infrastructure. Red Team real or automated (in the form of scenarios), prepares a training scenario in accordance with the set goal.
Obtaining theoretical knowledge and skills of cyber defense (cyber defence exercises, CDX) are among examples of cyber exercises. The main focus is on cybersecurity defense tasks. In particular, conducting forensic investigations and practicing security configuration skills, such as networking.
The Cyber Europe exercises focus on simulating manifestations of large-scale security incidents that could lead to a cyber crisis. The training offers opportunities for digital forensic analysis (e.g. of incidents or malware), as well as solving complex business continuity situations and overcoming cybercrises. 2.2
Computer systems can be compromised in various ways, and countering complex and
persistent attacks consists of understanding the sequence of possible malicious actions
and thinking of the attacker. Exercises within the Offense Oriented Approach, namely
Red Teaming, support the development of security measures and tools given the
complexity of attacks. That is why this approach to organizing cyber exercises is focused
on practicing proactive cyber security mechanisms. Such exercises usually simulate the
protection of critical infrastructure from cyber security incidents [
Most of the exercises in this approach to organizing cyber exercises involve
operating servers and performing penetration tests on target systems. Starting with target
system recognition, vulnerability detection and assessment, cyber security participants
check security violations, try to use them to achieve the goal of conducting a scenario
to access the target system [
Participants in cyber exercises should master the offensive model of behavior to
ensure cybersecurity. It helps to better understand how to defend against cybersecurity
incidents. At the same time, there is a need for a deep understanding of how to conduct
attacks in order to know how to mitigate them and minimize possible losses. Therefore,
the Offense Oriented Approach encourages participants to view the exercises as
attackers (intruders). They will have to conduct attacks to accomplish various tasks.
Simulating real attacks is reduced to performing a sequence of steps, namely (see, e.g. [
2. Weaponization (takes into account the received information during reconnaissance, creation of malicious software).
3. Delivery (detection of vulnerabilities for the threats implementation). 4. Exploitation (realization of threats due to identified vulnerabilities). 5. Privilege escalation (exploiting a bug, to gain elevated access to resources). 6. Lateral movement (when an attacker moves from a compromised device to others on this network).
7. Command and control. 8. Exfiltrate and complete (data extraction, placement backdoors).
In Offense Oriented Approach, a system that is preconfigured for known vulnerabilities can be affected. At the same time, most of them do not necessarily have to be guided by someone during the attack.
Using Red Teaming as a cybersecurity training exercise can be an effective way to gain the decision-making skills and abilities needed to detect and counter cybersecurity incidents. Red Teaming exercises may involve the use of a set of available methods and tools, or may develop a response to unforeseen situations. Offense Oriented Approach to organize cyber exercise is extremely useful for testing infrastructure and systems, identifying security vulnerabilities, and configuration errors when learning to counter cyberattacks. During cyber exercises, it is important to understand the possible consequences. The closest thing to cyberattack training is the format of so-called “ethical hacking”, which may also be called pentesting and Red Teaming.
Examples of the “offensive” type international cyber exercises are Locked Shields, Cyber Coalition, Baltic Cyber Shield. These cyber trainings are focused on improving technical skills for response, cyber investigations, proactive response to cyber incidents in order to protect critical infrastructure. 2.3
The approach chosen for cyber exercises should depend on their intended purpose. As a rule, they are designed to provide theoretical knowledge and practical skills to security administrators. This is realized through the use of the Defense Oriented Approach. Whereas penetration testing exercises are based on Offense Oriented Approach. However, a mixed approach, namely the War Game Approach, is advisable for a comprehensive cyber exercise.
The Mixed Approach combines the Defense Oriented Approach with the Offense Oriented Approach. Thus, its complexity is achieved when performing exercises with cyber defense. In this case, the participants of the cyber exercise are divided into two teams. The first plays the role of a defender (“victim”). The second reflects the role of attackers (intruders).
An example of cyber exercise that combines offensive and defensive approaches is
the CTF competition (Capture the flag) [
There are two main formats of CTF [
2. Attack-defense – training is reduced to the protection of, for example, the network, server, confidential information and maintaining the functionality of intended services at the same time as the implementation of attacks aimed at violating services is carried out by the enemy team.
Participants in cyber exercises are involved in scenarios, and the team of attackers uses real tools of operation and penetration to attack the virtual network. The defense team monitors the state of the network and network equipment and protects the network, they can also practice counterattacks against the red team. A group of people, known as the white team, create the training environment and control the cyber training. They establish a set of rules for interaction between the red and blue teams and sometimes act as instructors to give tips to exercise participants in cyber training.
The use of tools in organizing cyber exercise is mostly reduced to such options:
1. Simulation tools – tools that allow you to conduct practical training sessions, for
example [
2. Tabletop tools – toolboxes that are allowed to conduct cyber exercise based on
discussion, for example [
Both types of cyber exercise tools have their advantages and disadvantages. Fullscale modeling may involve the use of virtual network environments that allow exercise participants to monitor the manifestations of cybersecurity incidents. However, this requires a lot of resources and detailed planning. At the same time, tabletop tools should use a small period of time, taking into account the need for concentration. Because they are focused on discussions and therefore the sense of urgency and realism in modeling is lost.
If special skills are not required to prepare for the use of tabletop tools, then the use
of simulation tools is due to the presence of theoretical knowledge and skills in setting
them up. However, despite this, it is now common to simulate real-world situations
using appropriate hardware and software. Developing realistic and scalable scenarios
becomes important for effective cyber exercises. An example of such cyber exercise
tools is [
1. Hardware cyber range, although realistic, but large-scale, expensive and timeconsuming to set up. Due to its cost, the number of exercise participants who can be trained in any of the scenarios of cyber threats is limited. In addition, it limits the total number of cyber exercise participants over a set period of time. We should also mention the wired cyber range, which is characterized by the complexity of modeling wireless tactical networks with their inherent vulnerabilities.
2. Virtual cyber range is considered as a simulation environment that provides
realtime hardware and software for the implementation of cyber threats to the network
infrastructure [
The general cyber range model of a cyber exercise site is defined by the following
components [
1. Orchestration Layer – layer that uses input data from RLMS. It is designed to orchestrate cybersecurity tools. At the same time, it integrates the technology and service components of the cyber range.
2. Underlying Infrastructure – level of infrastructure, which determines the realism and accuracy of the cyber range. In addition, ways of generating traffic and modeling attacks are used.
3. Virtualization Layer – layer, which is defined as a firewall between the target and underlying infrastructures. Whereas the target infrastructure is considered relative to the feasibility of attacks.
4. Target Infrastructure – a simulated environment in which cyber exercise participants training. Based on the purpose of their organization, scenarios will be generated to create the target infrastructure at the orchestration level. A scenario may contain configuration-specific information, including IP address ranges, routing information, server stacks, and software.
The approaches to organizing cyber exercises are analyzed in Table 1, taking into account the peculiarities of their use and the relevant tools (see Table 1).
Formulation of the approach Defense Oriented
Approach Offense Oriented
Approach War Game Approach
Tools cards with the exercise scenario, quiz, virtual cyber
range virtual cyber range, online plat
form virtual cyber range, online platform
Thus, the organization of cyber exercises is accompanied by the use of various concepts. Each of them determines their specificity, taking into account the orientation of both the individual employee and the specialists as a whole. Such features determine the choice of approaches to the organization of cyber exercises. In particular, they can focus on individual cybersecurity tasks, for example, on incident response (“Cyber defense”), cybersecurity assessment (“Compensation Testing”), or reduction of the number of solutions to the game (“War game”).