Why Does One Need Cyber Exercise and How to Live with It

European States are getting yet even more scared of daemons in the cyber space, especially after numerous servers having been hacked and large-scale cyber attacks performed. Recently Great Britain announced a dramatic increase in the country budget to strengthen cyber security. Will a country manage to raise its cyber protection so high that the computer engineers could sleep peacefully?

Hardly any. In light of recent events it makes more sense now and regional and international initiatives on critical infrastructure protection are starting to play a bigger role. One of such initiatives finished at the end of October 2016 and became the most ambitious event of a kind - Cyber Europe 2016. This Pan-European exercise takes place every other year with the support of EU Agency for Network and Information Security (ENISA). In fact, it is the agency that is a key player in the EU single cyber market formation. ENISA together with International Telecommunication Union holds annual regional events on cyber security issues. What makes this event special among other similar initiatives in cyber security area is the duration of the exercise itself - it lasted for 6 months in 2016, from April till October. Cyber Europe is mainly focused on checking the critical infrastructure components, imitating average-scale nationwide crises that can cause a regional problem.

This year the organizers structured the event in a different way - for six months the participants of the exercise were working in harshest crisis of a European scale conditions: facing cyber attacks in several European states, managing root server failures, making recovery scenarios and immediate restoration after attacks. The aim of the exercise was to bring together as many participants responsible for correcting the operation of critical infrastructure as possible (and this year there were over 700 professionals and experts dealing with cyber security from all EU states as well as from Switzerland and Norway) and to bring them under stressful situations. It must be said that the scope of the exercise was impressive, the details not being disclosed (for obvious reasons).

Such events are becoming more and more crucial. Every year since 2010 NATO has been organizing Locked Shields training sessions in order to raise the defensive sustainment of the Alliance member-states. These sessions usually last for not more than five days, they are held only within the Alliance and include tasks on coping with threats that can inflict direct damage on defensive abilities of the member-states. Furthermore, NATO implements a number of diverse training programs (on economics, law, etc.) in cyber security center in Tallinn.

Trainings and simulations of heavy attacks on critical infrastructure facilities are becoming one of the essential components of national security and defense doctrines in different countries (for now mostly in the Western hemisphere). Unfortunately, it is becoming more obvious that even the most complex and fancy technology is not enough in terms of national security. It must be a bottom to top process, but cyber attacks are such a blurred and unclear element of the modern world that national measures have to be integrated with regional and international initiatives.

One doesn’t have to be an Einstein of the 21st century to attack critical infrastructure facilities of the US, for instance (let’s say, two central power distribution stations on the West and East coasts respectively), it is not a difficult task. The performance of the task would require some patience, a good team, and desire. With electricity being the backbone of any modern society, the attack will not go unnoticed, especially in the US. One doesn’t need a bomb or a tsunami to destroy a working power station, it is only a matter of infecting the control center computer coordinating the supply transformer with malware. Most of the power equipment of the kind was installed at the end of 1980’s in the US and is not highly protected from cyber attacks. The supply transformer being broken, ordering, shipment, and installation of new system (the USA usually orders the component parts) might take two to four years, let alone the cost of the unique item.

The conceivable damage from such power failure, both economic and human, at home and abroad, runs into billions of dollars. While the information and detailed instructions on how to create and use such malware and what the possible outcomes are publicly available. This is precisely why such regional initiative as Cyber Europe are so important.

In the meanwhile, make sure you change your device passwords regularly.