W900KK20R0011_Attach_16_NCRC_Sample_Range_Event_Schedule.docx

Unclassified // For Official Use Only

National Cyber Range Complex Sample NCRC Range Event Schedule Version 1.0

January 21, 2020

DISTRIBUTION STATEMENT F

DISTRIBUTION ONLY AS DIRECTED BY THE DIRECTOR, NATIONAL CYBER RANGE COMPLEX (NCRC). REQUESTS FOR THIS DOCUMENT MUST BE SUBMITTED TO THE OFFICE OF THE DIRECTOR, NATIONAL CYBER RANGE COMPLEX (NCRC).

EXPORT CONTROLLED

Unclassified // For Official Use Only

THIS DOCUMENT CONTAINS TECHNICAL DATA WHOSE EXPORT IS RESTRICTED BY THE ARMS EXPORT CONTROL ACT (TITLE 22, U.S.C., SEC 2751, ET SEQ.) OR THE EXPORT ADMINISTRATION ACT OF 1979 (TITLE 50, U.S.C., APP 2401 ET SEQ.) AS AMENDED. VIOLATIONS OF THESE EXPORT LAWS ARE SUBJECT TO SEVERE CRIMINAL PENALTIES. DISSEMINATE IN ACCORDANCE WITH PROVISIONS OF DOD DIRECTIVE 5230.25 Unclassified // For Official Use Only Use or disclosure of information contained on this page is subject to the restrictions on the title page of this document.

1. Introduction The intent of this document is to provide potential EPOS Offerors with an overview of a representative sample notional NCRC event schedule that can be used as a backdrop for estimating the numbers of personnel, types of skills, job families and levels of effort (LOE) required to successfully execute events on the NCRC.

The document presents a notional but representative sample schedule of one (1) year of events covering the expected base year of EPOS execution. The events used to develop this sample notional schedule are representative of past NCRC events in terms of number or events, types of events and concurrency of events.

1.1 Document Organization

The document is divided into the following sections:

· Section 1 provides basic introductory material

· Section 2 presents the sample notional NCRC event schedule

· Section 3 provides a more detailed description of each event to include an overview of the event, a description of the composition of the event environment and additional detailed information about the specific software that will be used for the event.

Note – This schedule and the events are representative of past NCRC events; however, the events described in the schedule are fictitious. Given the fictitious nature of the events included in this sample schedule, the Government will not comment on or provide any additional information about the specific lists of components, capabilities, hardware and software provided herein.

1.2 Characterization of Test and Training Events

The following sections provide a generalized characterization of NCRC events. Each event includes planning, design/configuration, execution and post-execution sets of activities.

1.2.1 Small Cyber Security Test Event

· Planning: Localized evaluation of a somewhat simplistic software/application. Minimal timeframe (1 month) required to work with the User to understand requirements and requirements are straightforward. May be the first in a series of events with the first instance focused on a relatively simple aspect in order to establish a baseline.

· Design/Configuration: Minimal development. Minimal setup of the range infrastructure. Limited variation platform configurations.

· Execution: Straightforward plan for Cyber Security Evaluation Team (CSET) assessment. CSET assessment may be conducted within a week but could take two weeks. CSET focused on gaining an initial understanding of security posture.

1.2.2 Medium Cyber Security Test Event

· Planning: System may include several components and/or Hardware in the Loop (HWIL). Several planning sessions (1-2 months) required to understand the system under test. May be a follow-on event to a successive series where the assessment is graduating in complexity.

· Design/Configuration: Limited development. Limited coordination required with User SMEs to assist with integration and setup. Straightforward range infrastructure setup.

· Execution: CSET assessment conducted over a two-week timeframe. CSET may need to meet with system SMEs to better understand how to structure the test. If this is a follow-on to a prior event, the CSET may include focus on evaluating improvement of security posture from the prior test.

1.2.3 Large Cyber Security Test Event

· Planning: Complex system of systems and/or integration of Hardware-in-the-Loop (HWIL). A few months of planning sessions (2-3) required to understand the systems under test. Possibly requiring an offsite Technical Exchange Meeting (TEM) with Subject Matter Experts (SMEs) and mission operators. Complex system of systems and/or integration of HWIL. May be follow-on of prior events with increasing complexity to address system of systems perspective

· Design/Configuration: Complex setup of range infrastructure which could include reverse engineering required by range engineers to effectively accommodate virtual and physical aspects. Setup can include multiple variations of platform configurations and instrumentation requirements. Review of technical documentation. Coordination with SMEs required to support installation and configuration of complex mission software/components.

· Execution: CSET assessment conducted over a two to three-week timeframe. CSET plan is detailed and worked in conjunction with SMEs.

1.2.4 Small Cyber Security Training Event

· Planning: Simplistic environment buildout leveraging re-use from other baseline environments: red, gray, blue; simple traffic generation and web content. Minimal timeframe required to work with the User to understand environment details. May be focused on individual team certification and training.

· Design/Configuration: Straightforward environment setup, leveraging prior capabilities previously developed. No new development or limited development of capabilities.

· Execution: Straightforward event execution timeframe, on-line for a week or two. Limited engagement by engineering team required while the event is executing.

1.2.5 Medium Cyber Security Training Event

· Planning: Moderately complicated environment. Several detailed meetings with the User to identify requirements, understand Master Scenario Event Lists (MSELs), and the scenario. Discussion to understand customization needed to support training objectives and scenario development. May be focused on multiple team training and readiness.

· Design/Configuration: Robust red, blue and gray space with realistic internet services and customized traffic generation to enable a representative target environment. High fidelity, realistic, and dynamic content. Combination of re-use of existing capabilities and new development. Integration of User tools. Can include Hardware in the loop.

· Execution: Support for event environment reconnaissance activities established on the range, pre-event execution and support during event execution based on dynamic requirements that may evolve during the course of the exercise. Event execution can be between one to two weeks.

1.2.6 Large Cyber Security Training Event

· Planning: Highly fidelity, realistic, complex training environment. Detailed meetings and official planning conferences to coordinate requirements for the training audience. May involve collaboration with other range providers to identify integration / touch points. Most often focused on support to large COCOM training exercises. Can include multi-national partners.

· Design/Configuration: High-fidelity, operationally realistic environments that mimic real-world behavior and performance. Large environment with significant number of diverse enclaves. Representative military and critical infrastructure target sets, representative ISPs, simulated satellite links, integration of wireless assets, integration of multiple hardware in the loop devices/components. Significant development of new and/or tailored capabilities. Integration of User VMs and tools. Development of threat scenarios. Multi-level workflows representative of real-world performance.

· Execution: Environment ready approximately a month in advance of event execution to support user account management, reconnaissance, and other preparations. Event Execution for about two weeks. On-site support at primary exercise location to assist Users. Assess opportunity to address ad-hoc, dynamic, on-demand requirements as they emerge. Support for a significant number of multiple participants remotely connected.

1.3 General Notes and Information

· The time allocated each activity in the event descriptions, e.g. range configuration, network familiarization, reconnaissance (RECCE), event execution and post-event activities includes the time necessary to produce the related event products. Post-Event analysis time is intended to cover the development and delivery of all associated post-event CDRLs.

· The SW listed with each event description is the “core” event environment SW that is deployed by the NCRC automated tool suite. It does not include the additional SW that would be required to provide event specific capabilities like website content, content management systems, video and audio streaming, collaboration, functional databases, interactive websites, etc.

· Assume that 85% of the software listed for each event will be installed using the NCRC Automated Tool Suite. The other 15% will have to be installed manually. Unless otherwise noted, the hardware and software that is listed with each event description can be assumed to be part of the NCRC inventory; therefore, proposals do not need to include costs for that HW/SW.

1.4 Extending the Schedule

The sample schedule currently contains one (1) year worth of events for the expected EPOS Base Year. For evaluation purposes, the sample schedule for Option Year 1 will be the same events as the Base Year with each event being run twice and spread across the entire 12 months.

2. Sample NCRC EPOS Base Year Notional Event Schedule Legend

In the notional range schedule below, each event is numbered and indicated by a separate color. Weeks including federal holidays are indicated with a red fill.

This notional schedule is for FY21 with an assumption of contract award by the beginning of FY21. No events are indicated on the schedule for the first 90 days (October through December) . During this 90-day period, contractors will be ramping up, receiving NCRC EPOS initial training and meeting other personnel training and security requirements in the contract/task order in preparation to commence work. Events are shown on the schedule to start in January of the base year and run through September.

3. Sample Event Descriptions

Test Event 21-1

Description: Test Event 21-1 is a medium sized test event that involves a cybersecurity assessment of a new version of an already fielded Service capability. The goal is to increase the user’s understanding of impacts of new products on the cybersecurity posture and operational employment of the new capability version. The event will include a cooperative vulnerability assessment and traditional penetration testing activities.

· The event environment will consist of a single enclave and VLAN with AD, DNS, SQL, Exchange and SharePoint instances along with the User provided SUT (system under test) SW

The event environment will have 7 ESXi hypervisors and 19 VMs. This event will not require any traffic generation.

External Connections: N/A

Event Classification: Secret

Faraday Cage: N/A

Event Timeline: Test Event 21-1 will include 4 weeks of planning, 3 weeks of range configuration, 2 weeks of event execution and 1 week of post-event activities.

Software Overview

Software Application Name

CentOS 5.3 x64

Meinberg NTP Client

SSL Certs

Windows 2008 R2 SP1

Windows 2012 R2 Server x64

Windows 7 Enterprise SP1 x64

Yum Repo

wget for Windows

SUT (User Provided SW)

Training Event 21-1

Description: Training Event 21-1 will be a “Capture the Flag” style of training event where Cyber Protection Teams (CPTs) are able to hone their skills and TTPs in both competitive and non-competitive conditions. This event will have a naval flavor for which the NCRC will provide an event environment replicating 3 different kinds of ships each with 3 different “flags” that teams must find in order to disable each ship. Each participating team will be given access to an identical environment for a set time period during which they must capture as many ‘flags’ as possible.

· The event environment will consist of a simplified Internet enclave with minimal services including a single Root DNS server and NTP services. A set of Blue enclaves will be provided for each type of ship that sit behind a DMZ as well as a small DODIN enclave with common network infrastructure services.

· Traffic generation (TG) will be provided via Mantra and include web and E-mail.

The event environment will have 2 ESXi hypervisors, 250 VMs and 200 nodes set up for Traffic Generation using Mantra.

Faraday Cage: N/A

Event Timeline: Training Event 21-1 will include 2 months of planning, 4 weeks of range configuration, 2 weeks of event execution, 1 week of post-event activities and 2 weeks of post-event analysis.

Software Overview

Adobe Acrobat Reader 9.3

Microsoft DNS Server Surrogate Software

Apache 2.2.15 HTTP Server Linux

Microsoft Exchange Server 2010 SP2 Enterprise

Apt Repo

Microsoft Windows Internet Information Server 2000

Bind 9.8.1 for Linux

MySQL 5.1

CentOS (multiple versions)

NTP Server

DHCP Server

Office 2010

Firewall

PHP 5.4

Pidgin

Elastic Search

SSH Server

Firefox 35.0.1

Samba

Domain Controller Surrogate Software

Ubuntu 12.04 x64

Kali 2017.1

VyOS 1.1.6 x64

Kibana

Windows 2008 Enterprise SP1 x64

Logstash

Windows 2008 R2 SP1

MS SQL Server 2012 Enterprise SP1 x64

Windows 7 Professional SP1 x64

Mantra

Yum Repo

Meinberg NTP Client

ejabberd XMPP Server

Microsoft .NET Framework 3.5 SP1

wget for Windows

Microsoft DHCP Server Surrogate Software

Test Event 21-2.1

Description: Test Event 21-2.1 is the first in a series of large-scale test events that will independently test and evaluate commercial Industrial Control System (ICS) technologies and products and how they might be applied and integrated in analogous DoD systems. The event will include a cooperative vulnerability assessment and traditional penetration testing activities.

· The event environment will consist of a small Internet enclave and an internal enclave behind a DMZ with sub-enclaves for 2 control enclaves and a building enclave that acts as the SUT. The User will provide the commercial products that are to be tested and the vendors will provide technical assistance as needed for their products.

The event environment will have no hypervisors and 54 nodes set up for Traffic Generation using Mantra.

External Connections: N/A

Event Classification: Secret

Faraday Cage: N/A

Event Timeline: Test Event 21-2.1 will include 5 weeks of planning, 3 weeks of range configuration, 2 weeks of event execution, 1 week of post-event activities and 4 weeks of post-event analysis.

Software Overview

Adobe Acrobat Reader 9.3

Microsoft DNS Server Surrogate

Adobe Flash Player 11.5

Microsoft Exchange Server 2010 SP2 Enterprise

Apache 2.2.15 HTTP Server Linux

Microsoft Office 2007 Professional SP2

Apt Repo

PHP Default for Linux

Firewall

SSH Server

Windows Fileshare

Syslog Client

Elastic Search

Syslog Server

Domain Controller Surrogate

Ubuntu 12.04 x64

Kali 2.0 x64

Vyatta 6.6 x64

Kali Linux Full

Windows 2000 Server SP4 x86

Kibana

Windows 2003 Enterprise SP2 x86

Logstash

Windows 2008 R2 SP1

MS SQL Server 2012 Enterprise SP1 x64

Windows 2012 R2 Server x64

Mantra

Windows 7 Enterprise SP1 x64

Meinberg NTP Client

Windows XP Professional SP2 x64

Microsoft DHCP Server Surrogate

wget for Windows

Test Event 21-3

Description: Test Event 21-3 is a complex large-scale event with a primary goal of assessing the security posture of a specific portion of a small sized Unmanned Ground Vehicle (UGV) that provides land-based tactical reconnaissance, surveillance, and target acquisition (RSTA) data collection. The NCRC will be deploying a detailed representation of the C2 portion of the UGV’s supporting real-world networking infrastructure using information and VMs supplied by the User. The OGV will be operated and stimulated from within the NCRC faraday cage. Both the UGV and associated C2 applications will be provided by the User.

· The event environment will consist of the UGV, UGV C2 application enclave, RF communications and stimulation HW/SW, the UGV C2 application as well as supporting SW and instrumentation. This event will include traditional penetration testing activities using User supplied tools and data to be performed by NCRC personnel working with User SMEs.

The event environment will have 2 ESXi hypervisors and 35 VMs with no Traffic Generation.

External Connections: N/A

Event Classification: TS/SCI

Faraday Cage: Required

Event Timeline: Test Event 21-3 will include 6 weeks of planning, 2 weeks of range configuration, 2 weeks of event execution, 1 week of post-event activities and 4 weeks of post-event analysis.

Software Overview

Adobe Acrobat Reader 9.3

Microsoft Windows Internet Information Server 2000

Adobe Flash Player 11.5

MySQL 5.1

Bind 9.8.1 for Linux

PHP 5.4

CentOS 6.5 x64

SSH Server

Firewall

SSL Certs

Firefox 35.0.1

VyOS 1.1.6 x64

Domain Controller Surrogate Software

Vyatta 6.6 x64

Mantra

Windows 2008 R2 SP1

Meinberg NTP Client

Windows 2012 R2 Server Update x64

Microsoft DHCP Server Surrogate Software

Windows 7 Professional SP1 x64

Microsoft DNS Server Surrogate Software

Yum Repo

Microsoft Exchange Server 2010 SP2 Enterprise

wget for Windows

Microsoft Office 2007 Professional Edition w/SP2 Bundled

Test Event 21-4

Description: Test Event 21-4 is the latest medium sized event in a series of events that the NCRC has hosted for a Program Office responsible for developing autonomous vehicle wireless control systems for use in non-deployed garrison environments. This event will continue the work done during previous events to refine the baseline configurations of User provided GOTS security applications prior to them being deployed. Specifically, this event will focus on non-RF portions of the system and assess and conduct a performance and security capabilities analysis of one component of a larger system.

· The event environment will consist of a small Internet enclave and an internal enclave behind a DMZ with a sub-enclave to host the SUT.

The event environment will have 2 ESXi hypervisors and 25 nodes for Traffic Generation using Mantra.

External Connections: N/A

Event Classification: Secret

Faraday Cage: N/A

Event Timeline: Test Event 21-4 will include 3 weeks of planning, 3 weeks of range configuration, 2 weeks of event execution, 1 week of post-event activities and 2 weeks of post-event analysis.

Software Overview

Apache 2.2.15 HTTP Server Linux

Logstash

Apt Repo

Mantra

CentOS 7.0 x64

Meinberg NTP Client

Chrome 43.0.2357.65

PHP Default for Linux

Firewall

SSH Server

Elastic Search

Ubuntu 12.04 x64

FTP Server

VyOS 1.1.6 x64

Firefox 35.0.1

Windows 7 Professional SP1 x64

Gnome Desktop

Wireshark 2.0.3 for Windows

Kali 2.0 x64

Yum Repo

Kibana

wget for Windows

Test Event 21-5

Description: Test Event 21-5 will be the latest in a series of events that the NCRC has hosted for a Program Office responsible for developing enterprise security solutions for use in deployed environments. This event will continue the work done during previous events to refine the baseline configurations of User provided commercial security applications prior to them being deployed. Specifically, this event will assess and conduct a performance and security capabilities analysis of one component of a larger system.

· The event environment will consist of a simplified Internet enclave with minimal services including a single Root DNS server and NTP services, one at the Brigade Combat Team (BCT) level enclave that sits behind a DMZ as well as a small DODIN enclave with common services.

· Traffic generation (TG) will be provided via Mantra and include web and E-mail.

The event environment will have 4 ESXi hypervisors, 65 VMs and 40 nodes set up for Traffic Generation using Mantra.

External Connections: N/A

Event Classification: TS/SCI

Faraday Cage: N/A

Event Timeline: Training Event 21-5 will include 5 weeks of planning, 3 weeks of range configuration, 2 weeks of event execution, 1 week of post-event activities and 5 weeks of post-event analysis.

Software Overview

AVG Free

Mantra

Adobe Acrobat Reader 9.3

Meinberg NTP Client

Adobe Flash Player 10.2 Windows

Microsoft DNS Server Surrogate Software

Apache 2.2.15 HTTP Server Linux

Microsoft Exchange Server 2010 SP2 Enterprise

Apt Repo

Microsoft Windows Internet Information Server 2000

Bind 9.8.1 for Linux

NTP Server

CentOS 5.9 x64

Office 2010

DHCP Server

PHP 5.4

Firewall

Pidgin

Network Address Translation

Putty 0.63

Windows Fileshare

RedHat 5.4 x64

Dovecot

SSH Server

Elastic Search

Ubuntu 12.04 x64

F Virtual Window Manager

Vyatta 6.6 x64

Fedora 16 x86 64

Webmin 1.760

GNUPlot

Windows 2008 R2 SP1

Gnome Desktop

Windows 7 Professional SP1 x64

InspIRCd

Windows XP Operating System w/SP3

Domain Controller Surrogate Software

Yum Repo

KDE Desktop

ejabberd XMPP Server

Kibana

vsftpd 2.2.2

Logstash

wget for Windows

Training Event 21-2

Description: Training Event 21-2 is a large-scale bi-lateral training event intended to foster collaboration while conducting force-on-force exercise training with significant OPFOR play from robust Red enclaves. It will involve three defensive teams, two different offensive teams and a white cell. For this event, the NCRC has been asked to create an event environment that accurately represents the user’s requirements. The even must include a robust Gray environment with realistic internet-level services and elements and real-world threat-representative Blue and Red environments. OPFOR will require robust and detailed Red enclaves to operate from. The event environment for Training Event 21-2 consists of several enclaves as follows:

· Backbone Internet Services to include operational instances of all 13 Root DNS servers, domain registration services, NTP and various repos and capabilities, e.g. OS and Yum

· The environment will have 3 Regional Internet Grey, 4 Blue and 5 Red enclaves all with sub-enclaves that include different combinations and varieties of Windows and Linux client & server OS and SP configurations, DNS, AD, IIS, Apache, Exchange/Outlook, FTP, SQL databases, live websites, file and video streaming services, etc. Include user provided Hardware-in-the-loop (HWIL) capabilities. Physical routers and firewalls configured IAW “best practices” were added to increase realism and meet specific user requirements.

· The user will provide several images that will have to be imported and configured by the NCRC team after which multiple instances will have to be deployed into the event environment. The User has requested specific versions and configurations of some OSs and applications in order to introduce a controlled and known set of vulnerabilities into the exercise.

· Traffic generation (TG) will be provided via Mantra and include web, E-mail, fileshare (SMB), and database manipulation modules.

The event environment will have 58 ESXi hypervisors, 985 VMs and 625 nodes set up for Traffic Generation using Mantra

Faraday Cage: N/A

Event Timeline: Training Event 21-2 will include 2 months of planning that includes an Initial Planning Conference (IPC), Mid-Planning Conference (MPC) and Final Planning Conference (FPC) of 1-2 days per conference, 4 weeks of range configuration, 2 weeks of event participant network familiarization, 1 week of RECCE, 1 week of event execution and 1 week of post-event activities.

Software Overview

Adobe Acrobat 11.0

Microsoft Exchange Server 2013 SP1 Enterprise

Adobe Acrobat Reader 9.3 English Windows Software

Microsoft Office 2007 Professional Edition w/SP2 Bundled

Adobe Flash Player 10.2 Windows Software

Microsoft Windows Internet Information Server 2000

Adobe Shockwave Player 12.2

MySQL 5.6

Apache 2.2.15 HTTP Server Linux

Office 2003

Apt Repo

Office 2010

Bind 9.8.1 for Linux

Office 2013

CentOS (multiple versions)

PHP 5.4

Chrome 43.0.2357.65

Firewall

Putty 0.63

Network Address Translation

SSH Server

Windows Fileshare

SSL Certs

Domain Registrar Client

Samba

Elastic Search

Security Onion 14.04 x64

FTP Server

Silverlight 5.0

Firefox 35.0.1

Squid

Firefox Default for Linux

SquirrelMail

Gnome Desktop

Syslog Server

Domain Controller Surrogate Software

Thunderbird 38.0.1

Secondary Domain Controller

Ubuntu (multiple versions)

Internet Explorer 8.0.6001.18702

Unreal IRCd

Java SE 8 Update 60 JRE

VyOS 1.1.6 x64

Kali 2.0 x64

Windows 10 Professional SP0

Kali Linux Full

Windows 2008 Enterprise SP1 x64

Kibana

Windows 2012 R2 Server Update x64

Logstash

Windows 3.1 Installer

Mantra

Windows 7 Professional SP1 x64

Meinberg NTP Client

Windows 8.1 Professional x64

Microsoft .NET Framework 3.5 SP1

Windows XP Operating System with SP3

Microsoft .NET Framework 4.5.2

Windows XP Professional SP2 x64

Microsoft DHCP Server Surrogate Software

Wireshark Surrogate Software

Microsoft DNS Server Surrogate Software

Yum Repo

Microsoft Exchange Server 2010 SP2 Enterprise wget for Windows

Test Event 21-6

Description: Test Event 21-6 is a very complex large-scale event with a primary goal of assessing the security posture of a specific portion of the User’s network infrastructure. The NCRC will be deploying a very detailed representation of a portion of the User’s real-world networking infrastructure using information and VMs supplied by the User. This event will include traditional penetration testing activities using User supplied tools and data to be performed by NCRC personnel working with User SMEs.

· The event environment will consist of a simplified Internet enclave with minimal services including a single Root DNS server and NTP services. There will be a small NIPR representation including HBSS with 2 levels of DMZs that lead to the User provided VMs which are the SUT.

The event environment will have 1 ESXi hypervisor, 65 VMs and 40 nodes set up for Traffic Generation using Mantra.

External Connections: N/A

Event Classification: TS/SCI

Faraday Cage: N/A

Event Timeline: Test Event 21-6 will include 6 weeks of planning, 3 weeks of range configuration, 2 weeks of event execution, 1 week of post-event activities and 5 weeks of post-event analysis.

Software Overview

Adobe Acrobat Reader 9.3

Microsoft Windows Internet Information Server 2000

Adobe Flash Player 11.5

MySQL 5.1

Bind 9.8.1 for Linux

PHP 5.4

CentOS 6.5 x64

SSH Server

Firewall

SSL Certs

Firefox 35.0.1

VyOS 1.1.6 x64

Domain Controller Surrogate Software

Vyatta 6.6 x64

Mantra

Windows 2008 R2 SP1

Meinberg NTP Client

Windows 2012 R2 Server Update x64

Microsoft DHCP Server Surrogate Software

Windows 7 Professional SP1 x64

Microsoft DNS Server Surrogate Software

Yum Repo

Microsoft Exchange Server 2010 SP2 Enterprise

wget for Windows

Microsoft Office 2007 Professional Edition w/SP2 Bundled

Test Event 21-7

Description: The primary focus of this complex large-scale test event will be to identify any potential cybersecurity impacts associated integrating a specialized RF sensor into an existing C2 application that had been tested in a previous event. The specialized RF sensor will be operated and stimulated from within the NCRC faraday cage. Both the sensor and C2 application will be provided by the User. This event will include traditional penetration testing activities using User supplied tools and data to be performed by NCRC personnel working with User SMEs.

· The event environment will consist of the RF sensor, RF communications and stimulation HW/SW, the sensor C2 application as well as supporting SW and instrumentation. There is no Traffic Generation requirement for this event.

The event environment will have 4 ESXi hypervisors and 10 VMs.

External Connections: N/A

Event Classification: TS/SCI

Faraday Cage: Required

Event Timeline: Training Event 21-7 will include 5 weeks of planning, 3 weeks of range configuration, 2 weeks of event execution, 1 week of post-event activities and 5 weeks of post-event analysis.

Software Overview

Apache 2.2.15 HTTP Server Linux

SSH Server

Apt Repo

Ubuntu 12.04 x64

Elastic Search

VSFTPD 3.0.2

Gnome Desktop

Windows 2008 R2 SP1

KDE Desktop

Yum Repo

Kibana

wget for Windows

Logstash

Apache 2.2.15 HTTP Server Linux

Mantra

Apt Repo

Meinberg NTP Client

Elastic Search

PHP Default for Linux

Gnome Desktop

RedHat 6.5 x64

KDE Desktop

Test Event 21-8

Description: Test Event 21-8 is the latest small-sized event in a series of events that the NCRC has hosted for a Program Office responsible for developing enterprise security solutions for the deployed ground environment. This event will continue the work done during previous events to refine security setting of a solution set prior to be it being formally tested in a Service live-fire event. The PMO intends to provide generated by this event to the Service Operational Test Agency (OTA) as part of the formal testing process.

· The event environment will consist of a simplified Internet enclave with minimal services including a single Root DNS server and NTP services, two Blue enclaves, one at the Battalion level and one at the Brigade Combat Team (BCT) level that sit behind a DMZ as well as a small DODIN enclave with common services.

· Traffic generation (TG) will be provided via Mantra and include web and email.

The event environment will have 1 ESXi hypervisor, 100 VMs and 75 nodes set up for Traffic Generation using Mantra.

External Connections: N/A

Event Classification: Secret

Faraday Cage: N/A

Event Timeline: Test Event 21-8 will include 2 weeks of planning, 3 weeks of range configuration, 2 weeks of event execution, 1 week of post-event activities and 2 weeks of post-event analysis.

Software Overview

Adobe Acrobat Reader 9.3

Microsoft Exchange Server 2010 SP2 Enterprise

Apache 2.2.15 HTTP Server Linux

Microsoft Windows Internet Information Server 2000

Apt Repo

MySQL 5.1

CentOS (multiple versions)

NTP Server

DHCP Server

Office 2010

Firewall

PHP 5.4

Elastic Search

Firefox 35.0.1

Ubuntu 12.04 x64

Domain Controller Surrogate Software

VyOS 1.1.6 x64

Kali 2017.1

Windows 2008 Enterprise SP1 x64

MS SQL Server 2012 Enterprise SP1 x64

Windows 2008 R2 SP1

Mantra

Windows 7 Professional SP1 x64

Meinberg NTP Client

Yum Repo

Microsoft .NET Framework 3.5 SP1

ejabberd XMPP Server

DHCP Server Surrogate Software

wget for Windows

Microsoft DNS Server Surrogate Software

Training Event 21-3

Description: Training Event 21-3 will be the second is a series of “Capture the Flag” style training events where Cyber Protection Teams (CPTs) are able to hone their skills and TTPs in both competitive and non-competitive conditions. This event will have an Army flavor for which the NCRC will provide an event environment replicating 3 different levels of tactical enclaves, i.e. Battalion, Brigade Combat Team (BCT) and Corps, each with 3 different “flags” that teams must find in order to render the unit not mission capable. Each participating team will be given access to an identical environment for a set time period during which they must capture as many ‘flags’ as possible.

· The event environment will consist of a simplified Internet enclave with minimal services including a single Root DNS server and NTP services. A set of Blue enclaves will be provided for each type of tactical enclave that sit behind a DMZ as well as a small DoDIN enclave with common services.

· Traffic generation (TG) will be provided via Mantra and include web and email.

The event environment will have 2 ESXi hypervisors, 250 VMs and 200 nodes set up for Traffic Generation using Mantra.

Faraday Cage: N/A

Event Timeline: Training Event 21-3 will include 6 weeks of planning, 2 weeks of range configuration, 2 weeks of event execution, 1 week of post-event activities and 2 weeks of post-event analysis.

Software Overview

Adobe Acrobat Reader 9.3

Microsoft DNS Server Surrogate Software

Apache 2.2.15 HTTP Server Linux

Microsoft Exchange Server 2010 SP2 Enterprise

Apt Repo

Microsoft Windows Internet Information Server 2000

Bind 9.8.1 for Linux

MySQL 5.1

CentOS (multiple versions)

NTP Server

DHCP Server

Office 2010

Firewall

PHP 5.4

Elastic Search

Pidgin

Firefox 35.0.1

SSH Server

Domain Controller Surrogate Software

Samba

Kali 2017.1

Ubuntu 12.04 x64

Kibana

VyOS 1.1.6 x64

Logstash

Windows 2008 Enterprise SP1 x64

MS SQL Server 2012 Enterprise SP1 x64

Windows 2008 R2 SP1

Mantra

Windows 7 Professional SP1 x64

Meinberg NTP Client

Yum Repo

Microsoft .NET Framework 3.5 SP1

ejabberd XMPP Server

DHCP Server Surrogate Software

wget for Windows

Test Event 21-9

Description: Test Event 21-9 is the initial small-sized event the NCRC will host for a Program Office responsible for developing methodologies and solutions for assessing the security posture of contractors supporting development of security solutions that are intended for deployment within DoD garrison environments. The intent is to develop solutions and methodologies that can be rapidly applied to improve the overall cybersecurity posture of the DIB. The event will include a cooperative vulnerability assessment and traditional penetration testing activities.

· The event environment will consist of a small Internet enclave and an internal enclave behind a DMZ with sub-enclaves for 2 generalized garrison enclaves and a single building enclave to house the SUT. The User will provide the SUT solutions that are to be tested as well as SME support as needed.

The event environment will have3 ESXi hypervisors and 50 nodes set up for Traffic Generation using Mantra.

External Connections: N/A

Event Classification: Unclassified

Faraday Cage: N/A

Event Timeline: Test Event 21-9 will include 3 weeks of planning, 3 weeks of range configuration, 2 weeks of event execution, 1 week of post-event activities and 2 weeks of post-event analysis.

Software Overview

Adobe Acrobat Reader 9.3

Microsoft DNS Server Surrogate

Adobe Flash Player 11.5

Microsoft Exchange Server 2010 SP2 Enterprise

Apache 2.2.15 HTTP Server Linux

Microsoft Office 2007 Professional SP2

Apt Repo

PHP Default for Linux

Firewall

SSH Server

Windows Fileshare

Syslog Client

Elastic Search

Syslog Server

Domain Controller Surrogate

Ubuntu 12.04 x64

Kali 2.0 x64

Vyatta 6.6 x64

Kali Linux Full

Windows 2000 Server SP4 x86

Kibana

Windows 2003 Enterprise SP2 x86

Logstash

Windows 2008 R2 SP1

MS SQL Server 2012 Enterprise SP1 x64

Windows 2012 R2 Server x64

Mantra

Windows 7 Enterprise SP1 x64

Meinberg NTP Client

Windows XP Professional SP2 x64

Microsoft DHCP Server Surrogate

wget for Windows

Test Event 21-10

Description: Test Event 21-10 will evaluate the effectiveness and suitability of a User developed and supplied capability prior to it being deployed in support of real-world operations. The capability must be tested within the context of the Government user requirements in a realistic environment. This event will include traditional penetration testing activities using User supplied tools and data to be performed by NCRC personnel working with User SMEs. The four components of the environment will be:

· A robust Internet Backbone enclave to include operational instances of all 13 Root DNS servers, domain registration services and NTP, 30 distinct Grey enclaves with regional distinctions that host numerous and different configurations of functional Content Management System (CMS) sites along with numerous non-CMS functional websites

· A Capability Enclave used to host the User provided SUT

· A dedicated Traffic Generation enclave using Mantra for web (HTTP and HTTPS) traffic that interacts with the CMS and other web services in the internet enclave.

The event environment will have 15 ESXi hypervisors, 750 VMs and 1 node set up to support Mantra Traffic Generation

External Connections: N/A

Event Classification: TS/SCI

Faraday Cage: N/A

Event Timeline: Test Event 21-10 will include 4 weeks of planning, 3 weeks of range configuration, 2 weeks of event execution, 1 week of post-event activities and 5 weeks of post-event analysis.

Software Overview

Apache 2.2.15 HTTP Server Linux

SSH Server

Apt Repo

Ubuntu 14.04 x86

Bind 9.8.1 for Linux

VyOS 1.1.6 x64

CentOS 7.0 x64

Vyatta 6.6 x64

Debian 7.8 x64

Website Module Drupal

Elastic Search

Website Module MyBB

Firefox 35.0.1

Website Module Phpbb

Gnome Desktop

Website Module SMF

Kibana

Website Module WordPress

Logstash

Website Module vBulletin

Mantra

Windows 7 Professional SP1 x64

MySQL Default

Windows 8.1 x64

Microsoft DNS Server Surrogate Software

Yum Repo

PHP Default for Linux

wget for Windows

Test Event 21-11

Description: Test Event 21-11 will be a large-scale test event focused on evaluating the suitability and usability of a newly developed capability for supporting data collection and analysis during testing and training events. The SUT is very complex and will require significant effort to instantiate on the range. The event environment for this test will be highly instrumented with non-interfering sensors and have significant data collection requirements. The SUT will be hosted by the NCRC and will be largely virtualized with a small number of physical hosts being required. The event environment will consist of the following enclaves:

· A small Internet backbone with an operational instance of a Root DNS server and an NTP service

· A number of Blue, Red and Grey enclaves with sub-enclaves that include different combinations and varieties of Windows and Linux client & server OS and SP configurations as well as Exchange/Outlook E-mail, File Sharing, Chat, websites, in-game Voice Over Internet Protocol (VOIP) telephony services will be provided using Cisco routing hardware

The event environment will have 10 ESXi hypervisors, 682 VMs and 344 nodes set up for Traffic Generation using Mantra.

External Connections: N/A

Event Classification: TS/SCI

Faraday Cage: N/A

Event Timeline: Test Event 21-11 will include 6 weeks of planning that includes 2 technical exchanges of 2-3 days each with the User, includes 3 weeks of range configuration, 2 weeks of event execution, 1 week of post-event activities and 6 weeks of post-event analysis.

Software Overview

Adobe Acrobat Reader 9.3 English Windows Software

Microsoft Windows Internet Information Server 2000

Adobe Flash Player 11.5

MySQL 5.6

Apache 2.2.15 HTTP Server Linux

MySQL Default

Apt Repo

NTP Server

Asterisk 11.5.1 for Linux

Office 2010

Bind 9.8.1 for Linux

PHP Default for Linux

CentOS (multiple versions)

Pidgin

Chrome 43.0.2357.65

SSH Server

Firewalls

SSL Certs

Windows Fileshare

Samba

DOS 6.22 Windows

Security Onion 14.04 x64

Dovecot

Squid

Elastic Search

SquirrelMail

Fedora 16 x86

Ubuntu 12.04 x64

Firefox 35.0.1

VyOS 1.1.6 x64

Gnome Desktop

Windows 10 Professional v1511 SP0

Domain Controller Surrogate Software

Windows 2003 Enterprise SP2 x86

Kali 2.0 x64

Windows 2008 R2 SP1

Kibana

Windows 2012 Server x86 64

Logstash

Windows 3.1 Installer

Mantra

Windows 7 Professional SP1 x64

Meinberg NTP Client

Windows 7 Professional SP1 x86

Microsoft DHCP Server Surrogate Software

Windows Vista Enterprise Operating System

Microsoft DNS Server Surrogate Software

Windows XP Professional SP2 x86

Microsoft Exchange Server 2010 SP2 Enterprise

Yum Repo

Microsoft Exchange Server 2013 SP1 Enterprise

ejabberd XMPP Server

Microsoft Office 2007 Professional Edition w/SP2 Bundled

wget for Windows

Test Event 21-2.2

Description: Test Event 21-2.2 is the second in a series of large-scale test events that will independently test and evaluate commercial Industrial Control System (ICS) technologies and products and how they might be applied and integrated in analogous DoD systems. The event will include a cooperative vulnerability assessment and traditional penetration testing activities.

· The event environment will consist of a small Internet enclave and an internal enclave behind a DMZ with sub-enclaves for 2 control enclaves and a building enclave that acts as the SUT. The User will provide the commercial products that are to be tested and the vendors will provide technical assistance as needed for their products.

The event environment will have no hypervisors and 54 nodes set up for Traffic Generation using Mantra.

External Connections: N/A

Event Classification: Secret

Faraday Cage: N/A

Event Timeline: Test Event 21-2.2 will include 3 weeks of planning, 3 weeks of range configuration, 2 weeks of event execution, 1 week of post-event activities and 2 weeks of post-event analysis.

Software Overview

Adobe Acrobat Reader 9.3

Microsoft DNS Server Surrogate

Adobe Flash Player 11.5

Microsoft Exchange Server 2010 SP2 Enterprise

Apache 2.2.15 HTTP Server Linux

Microsoft Office 2007 Professional SP2

Apt Repo

PHP Default for Linux

Firewall

SSH Server

Windows Fileshare

Syslog Client

Elastic Search

Syslog Server

Domain Controller Surrogate

Ubuntu 12.04 x64

Kali 2.0 x64

Vyatta 6.6 x64

Kali Linux Full

Windows 2000 Server SP4 x86

Kibana

Windows 2003 Enterprise SP2 x86

Logstash

Windows 2008 R2 SP1

MS SQL Server 2012 Enterprise SP1 x64

Windows 2012 R2 Server x64

Mantra

Windows 7 Enterprise SP1 x64

Meinberg NTP Client

Windows XP Professional SP2 x64

Microsoft DHCP Server Surrogate

wget for Windows

Training Event 21-4

Description: Training Event 21-4 will be a medium sized Command Post Exercise (CPX) level exercise centered on information dissemination operations that is being used to prepare for an upcoming Service level exercise. Exercise participants will be connected to the NCRC-provided environment remotely using the Joint Information Operations Range (JIOR). The event environment will include:

· A robust Internet Backbone enclave to include operational instances of all 13 Root DNS servers, domain registration services and NTP, 3 regionally distinct Grey enclaves that host numerous and different configurations of functional Content Management System (CMS) sites along with numerous non-CMS functional websites and 2 Blue enclaves from which the event participants will access the environment.

· Extensive traffic Generation using Mantra for web (HTTP and HTTPS) traffic that interacts with the CMS and other web services in the Internet enclave.

The event environment will have 15 ESXi hypervisors, 600 VMs and 45 nodes set up to support Mantra Traffic Generation

Faraday Cage: N/A

Event Timeline: Training Event 21-4 will include 5 weeks of planning, 3 weeks of range configuration, 1 week of event execution, 1 week of post-event activities and 3 weeks of post-event analysis.

Software Overview

Adobe Acrobat Reader 9.3

Pidgin

Apache 2.2.15 HTTP Server Linux

RedHat 6.4 x64

Apt Repo

SSH Server

Bind 9.8.1 for Linux

SSL Certs

CentOS 6.5 x64

Samba

Chrome 43.0.2357.65

Ubuntu 12.04 x64

Firewall

VSFTPD 3.0.2

Debian 7.8 x64

VyOS 1.1.6 x64

Domain Registrar Client

Website Module domain registrar

Elastic Search

Website Module drupal

Firefox 35.0.1

Website Module mybb

Gnome Desktop

Website Module ncr dynamic

Domain Controller Surrogate Software

Website Module phpbb

Kibana

Website Module vbulletin

Logstash

Website Module wordpress

Mantra

Website Module wordpress theme site

Meinberg NTP Client

Windows 2008 R2 Ent SP0 x64

Microsoft DHCP Server Surrogate Software

Windows 2008 R2 SP1

Microsoft DNS Server Surrogate Software

Windows 2012 R2 Server x64

Microsoft Exchange Server 2010 SP2 Enterprise

Windows 7 Professional SP1 x64

Microsoft Windows Internet Information Server 2000

Yum Repo

MySQL 5.1

ejabberd XMPP Server

NTP Server

socat

Office 2010

vsftpd 2.2.2

PHP 5.4

wget for Windows

PHP Default for Linux

Test Event 21-12

Description: Test Event 21-12 is a medium-scale test event that will evaluate and compare two proposed security solutions that are being considered for integration into an already fielded system. The User will be providing the SUTs as well as SME engineering support during the event execution. This event will include traditional penetration testing activities using User supplied tools and data to be performed by NCRC personnel working with User SMEs. The event will include a cooperative vulnerability assessment of each proposed solution.

· The event environment will consist of a small Internet enclave and an internal enclave behind a DMZ with a sub-enclave to host the SUT.

The event environment will have 2 ESXi hypervisors, 10 VMs and 25 nodes for Traffic Generation using Mantra.

External Connections: N/A

Event Classification: Secret

Faraday Cage: N/A

Event Timeline: Test Event 21-12 will include 3 weeks of…