W900KK20R0011_Attach_29_NCRC_EPOS_Closed_Environment_Challenges_Scenario.docx

National Cyber Range Complex Event Planning, Operations, and Support

(NCRC EPOS)

Sample Closed Environment Challenges Scenario I. Event Overview The US Navy Situational Awareness Sharing System (N-SASS)[footnoteRef:1] program office has approached the Test Resource Management Center (TRMC) team to request support for an upcoming architecture cyber resiliency assessment event in support of an upcoming milestone decision. The event will focus on demonstrating that that the proposed architecture will perform as predicted by Contractor modeling and simulation (M&S) results. The program office wishes to assess the following areas: [1: Note: N-SSAS is a fictitious system.]

· Will the proposed N-SASS security mechanisms properly interact with an open source developed anonymity network like TOR [footnoteRef:2]using a Peer-2-Peer (P2P) file sharing protocol like BitTorrent? [2: TOR: The Onion Router - https://en.wikipedia.org/wiki/Tor_(anonymity_network)]

· Perform an in-depth cooperative vulnerability assessment of N-SASS developed anonymity networks access control (ANAC) add-on software (SW).

N-SASS will supply the program developed ANAC add-on SW as well as cybersecurity evaluation personnel to conduct the cooperative vulnerability assessment.

II. N-SASS Description The N-SASS system utilizes a hybrid systems architecture using a multi-site active/active manager system to account for nodes on the network reporting N-SASS data. The N-SASS manager system consists of two systems including an Apache Webserver running on a Red Hat Enteprise Linux (RHEL) 7 Operating System (OS) and a mysql server running on a RHEL 7 OS. The system installation consists of multiple managers (minimum 2) and will maintain synchronized databases. The hosts communicate using the P2P bittorrent like protocol and utilize a blockchain technology to maintain records between nodes. The nodes consist of a network appliance with the ability to record events on the network and agents which run on supported operating systems.

The agents store and transmit things such as process lists, network connections, file integrity hashes, web browser URL requests, e-mail header data, and domain name requests/responses. The agent can be installed on Windows, Linux, Unix, Android, Apple IOS, and also integrates with various Software Defined Network (SDN) controllers. Utilizing the manager a user can request records for any N-SASS host for which they are authorized to view.

The N-SASS system attempts to automate the detection of cyber-security events and additionally automates the execution of orchestrated cyber incident playbooks. The N-SASS system also has the ability to isolate and automatically restore systems that have become compromised. The N-SASS system has nodes that are installed on afloat platforms which have disconnected, intermittent, low-bandwidth networks.

The test environment needs to replicate that in addition to the shore based components. The system also ingests feeds of indicators of compromise using Structured Threat Information eXpression (STIX) 2.0 formatted data with some trusted cyber intelligence partners. The system connects to an external big data analysis system and uses Apacha kafka to send a message stream containing network event data to allow for depiction and analysis of the current cyber situation.

III. Event Scenario Requirements Discussions with the N-SASS Lead Developmental Tester has identified the following critical event environment requirements:

· The event environment design must include a live running instance of an open source TOR network (without a central server) that accurately represents how TOR networks are used across the Internet.

· The network presented is to be based on current security standards and controls common to using open source developed anonymity and P2P networks and protocols.

· There must be at least three (3) end-user enclaves connected over a representative U.S. Department of Defense Information Network (DODIN) networking infrastructure that is connected to the Internet. There is no requirement to replicate either Joint Regional Security Stack (JRSS) or a DoD Internet Access Point (IAP) as part of the environment. A simple security enclave infrastructure with boundary protections and monitoring is acceptable for this event.

· Each DODIN user enclave must have a minimum of 50 users representing different Services with varying but appropriately configured client workstations and representative network infrastructure services.

· The environment must have a diversity of peer enabled devices such as phones, fax, mobile client-side systems representing current Microsoft, Apple IOS, Android and Linux operating systems.

· The event environment must be fully self-contained and will be hosted and operated in a secure closed environment with no outside connections.

· The network design, systems communications, hardware-in-the-loop and virtual machines should present an approach to architecture and functionality that accommodates secure environments without loss of peer to peer sharing of torrent systems.

· The network should demonstrate torrent functional capabilities for both fixed and mobile devices demonstrating wired, WiFi-direct and ad-hoc connections.

· N-SASS end users need to be able to access the system from both DoD and commercial networks so the event environment needs to include some representation of gray networks and end-user connections from non-DODIN connection points.

· The architecture should include an appropriate instrumentation design for tracking data packets from source to destination.

· The NCRC team has been asked to propose a set of data collection requirements and associated collection and analysis plan.

· The NCRC team has been asked to propose a set of cooperative vulnerability assessment activities to gather information related to the security of the N-SASS developed ANAC add-on SW IV. Test Event Planning Based on the information in Sections I and II, address the following items:

1. Describe the analysis methodology and approach that will be applied to scope, plan, design and execute the event environment.

2. Develop an Event Support Plan using Attachment 30 (Event Support Plan template). The plan should include:

· Specification of the event objectives

· Development of a network topology suitable for design of the event environment.

· Details of how the event environment will be designed

· Details of the proposed event environment network topology

· Details of how the event environment will be configured The Event Support Plan should provide a Blue Team Operations Plan detailing:

· How the event will be executed

· What activities will be used by the Blue Team for the cooperative vulnerability assessment

· How the security mechanisms with the event environment anonymity implementation will be assessed

3. Describe the activities that will be executed at the conclusion of the event execution.

4. Describe how the capabilities developed for the environment will be managed following completion of the event.

Sample Closed Environment Challenges Scenario Page 1 of 21