Details of Cyber Storm War Games Released 96
I Don't Believe in Imaginary Property writes "Apparently, the participants in the U.S. 'Cyber Storm' war games are familiar with the Kobayashi Maru, because some of them tried to cheat by hacking the games themselves. They also prepare for some very interesting scenarios. Among other things, the organizers are worried about having too many people on the 'No Fly' list show up at an airport, finding 'mystery liquids' in the subway, and having bloggers reveal the classified location of railcars with hazardous materials. The Department of Homeland Security has already analyzed the results of the games, and plans to hold 'Cyber Storm 2' in March."
Re:Good Gravy (Score:5, Insightful)
No. Recognizing fictional references is an example of "cultural literacy". When the reference is a popular TV show, it's more like "basic cultural literacy".
In Real Life... (Score:2, Insightful)
Someone has to know where the trains are (Score:3, Insightful)
Seems to me that the two cases would have equal consequences and equal risk levels, and that no other individual could possibly modify those values significantly, reducing the security through obscurity to someone's job security through obscurity. Tell me, why should I care about this person's job more than I care about any potential risk to my wellbeing?
Frightning... (Score:5, Insightful)
Reading that article really opens eyes as to the real inside of our government. The founding fathesr have got to be spinning at 30-40 thousand RPM in their graves by now.
Why does did sound like the plot to war games 2? (Score:3, Insightful)
http://en.wikipedia.org/wiki/WarGames_2:_The_Dead_Code [wikipedia.org]
the movie has a system that sounds alot like the one talked about hear.
Re:This crap always amazes me (Score:5, Insightful)
So, to summarize your post:
WTF?
You obviously missed the whole point, which was really to work on the cooperation and communication. They weren't testing specific countermeasures, but stressing the people and the organizations involved to see what happens. Even if it weren't, being more prepared or knowledgeable about some threats is better than being knowledgeable than no threats.
No Fly Nonsense has been Squared. (Score:-1, Insightful)
There are not to many people in the airport, there are too many people on no fly lists. Technically, one person is too many because proscriptions violate your right to due process of law as outlined in the bill of rights. There are 750,000 people slandered as fellons by these lists, so many that it's possible that too many of them could come to the airport one day and overwhelm the TSA agents there. I'm not sure what the real problem is, because people on the no fly lists are never arrested [schneier.com].
To recap, there are so many people on a secret, illegal list of terrorists who are so dangerous that they can't fly AND they are let go immediately AND there are not enough guards for them. Only someone working for Homeland Defense could worried about the details of such an idiotic task.
Re:Hacking the game is cheating? (Score:4, Insightful)
Re:Hacking the game is cheating? (Score:4, Insightful)
Re:Hacking the game is cheating? (Score:3, Insightful)
Which is a little odd, since I only expressed a view of an exercise.
An exercise that makes you reconsider the rules of the game is very important in the real world, where you have to expect the unexpected.
Which is all well and good, but there is plenty of other types of exercises that are equally as useful. Besides, in your example it sounds like they were using perfectly legitimate tactics that were deemed outside the scope of some fairly specific exercise, whereas here, TFA makes it seem like they were just screwing with the monitoring systems for poops and giggles. Even taking into account all the vagaries of the real world, that is not productive.
Re:Frightning... (Score:5, Insightful)
In the real world, almost anything could be a threat. Your child could knock a salad fork off the table, and it could land tines-up wedged into a crack in the floor, and you could then slip from your chair trying to pick it up, and put your eye out. By means of an implausible scenario, the fork has become a threat. But you don't address such a threat by outlawing salad forks, or all dining implements, or feeding your children only spoon food. Instead you analyze the risk of having salad forks on your dining room table, and realize it's silly to worry about such ridiculous scenarios.
For a variant, consider placing steak knives on the table. Now, if your child were to knock one off it becomes somewhat more serious. Perhaps you mitigate the risk by sensibly not placing sharp knives within reach of your child; but you don't outlaw knives from the kitchen nor do you stop eating steak. You simply keep them out of your child's reach.
Now move to a slightly more sinister threat or risk, that of a free press or possibly an extremist group publishing the location of every chlorine tanker in America. Could that be a threat to our security? Of course, it might even herald the initial coordination of a nationwide attack. But just like the above stories, you don't outlaw bloggers or their right to publish (nor can you.) Instead you look at potentially dangerous objects or information, you analyze the potential risks, and you find a way to mitigate them. Step 0 might sensibly be "don't publicly publish lists of hazardous tankers" except to those persons with a need to know. Step 1 might be to keep any such lists as small as possible -- the Seattle fire department doesn't need to have the schedule for the Atlanta chlorine train. Step 2 might be to publish a generic set of instructions, "How to safeguard chemical tankers". Step 3 might be a communications plan to the rail lines informing them of a security breach. And so on.
Almost anything can be a threat. What defines an appropriate reaction is recognition of the risks, planning and mitigation strategies. Over the top reactions like saying "OMG they're trying to silence the press and Jefferson is rolling in his grave" are completely missing the point. Nowhere in TFA are they even suggesting they suppress the blogs; they're just recognizing a potential threat, and figuring out what plans (if any) they need to make.
Re:How To Play?? (Score:2, Insightful)
The key element of these war games is to test response capabilities. Testing existing exploits would be pointless. An exploit could come out tomorrow that allows someone to control every Cisco router on the planet. Would that cause problems? You bet. At that point entities which have a tested and rehearsed security response plan will fare better then does who don't. Also organizations which have handled security incidents before will also fare better.
Re:War cannot be 'cheated'. (Score:2, Insightful)
The point of wargames is to prepare for possible situations, and train people how to react to them. If you fail to anticipate a situation, you have a weakness that can be exploited.
Michael Chertoff, in Wired:
Wired:
"Any time you get a group of (information technology) experts together, there's always a desire, 'Let's show them what we can do,'" said George Foresman, a former senior Homeland Security official. "Whether its intent was embarrassment or a prank, we had to temper the enthusiasm of the players."
The exercise was a big deal for all concerned.
The $3 million, invitation-only war game simulated what the U.S. describes as plausible attacks over five days in February 2006 against the technology industry, transportation lines and energy utilities by anti-globalization hackers. The government is organizing a multimillion-dollar "Cyber Storm 2," to take place in early March.