W900KK20R0011_Attach_27_NCRC_EPOS_Cyber_T+E_Event_Scenario.docx

National Cyber Range Complex Event Planning, Operations, and Maintenance

(NCRC EPOS)

Sample Test Event Scenario I. Event Overview A Program Office lead developmental tester contacts the Test Resource Management Center (TRMC) and requests assistance with the planning, analysis, and implementation of a cybersecurity Test & Evaluation (T&E) event. System Name: Healthcare Deductible Servicemember Support (HDSS) System.

HDSS is a system under development by the Servicemembers Administration (SA) – Center for Financial Support (CFS) to assist at-risk servicemembers with deductible and out-of-pocket healthcare costs.

An independent, not-for-profit, military servicemember association (MSA) performed a survey and found that high out-of-pocket healthcare expenses resulted in significant financial hardships for servicemembers. They are working with SA – CFS to provide grant funding for qualified servicemembers facing catastrophic injuries (deployment or work related) or life-threating illnesses.

HDSS is to seamlessly integrate with current DoD healthcare and payroll systems to provide an easy-to-use, one-stop shop, Internet-accessible support system for servicemembers facing a healthcare crisis. Based upon information pulled from these systems, grant determinations are automatically made and reimbursements for all out-of-pocket healthcare costs are sent directly to the servicemember’s banking account. Additionally, servicemembers can apply for grants when the automatic system does not identify their case for funding.

II. Event Objectives The Program Office team would like to implement cybersecurity testing to justify an authorization to operate (ATO) decision from the SA Authorization Official (AO).

During the initial planning meeting, the mission of the HDSS is highlighted and the following information exchanges are described:

· HDSS has an interface to the Internet so servicemembers can apply, check their application status, identify if they have been automatically nominated for out-of-pocket healthcare cost, and verify the amount of funding received from the grant.

· The system interfaces to DoD healthcare databases and payroll systems to pull information on their injuries and financial qualifications.

· Reimbursements are automatically made to servicemembers’ bank accounts and/or credit card accounts.

· MSA has also requested a direct interface to HDSS to transfer funds and collect statistics on the use of the program as input to reports to their board of directors and marketing material to the public.

The initial operational capability (IOC) is planned for 2020; thus, the Program Office has approximately two years to develop an Assessment and Authorization (A&A) package, which will need to include an overall test strategy. The Program Office, acting as the event sponsor, has provided the following architecture diagram:

The event sponsor reveals that there are Data-Diodes in the architecture to prevent any external access to the database. These are commercial products.

III. Test Event Planning Based on the aforementioned information, address the following items:

1. Describe the analysis methodology and approach that will be applied to scope, plan, design and execute the cybersecurity test event.

2. Develop an Event Support Plan using Attachment 30 (Event Support Plan template) that includes, but is not limited to:

· Specification of the event objectives,

· A detailed network topology suitable for design of the event environment,

· Range instrumentation details relevant to the event objectives.

3. The Event Support Plan shall include test cases and techniques the cybersecurity evaluation team (Penetration testers) will apply to evaluate the resiliency of the system.

4. Describe the information security aspects (e.g. policies, procedures, etc.) that will need to be addressed during the event planning and execution lifecycle.

5. Describe the post-event activities that will be executed at the conclusion of the event execution.

6. Describe any customized content capabilities (e.g. traffic generation, web sites, TTP’s etc.) required to conduct this event in a closed-loop, cyber range environment.

7. Describe how the capabilities developed for the event will be managed following completion of the event.

Sample Test Event Scenario Page 1 of 21 image1.png