Multinational Experiment 7: Situation Awareness Technologies Used in Locked Shield 2012.

摘要

As in the real world, the lack of timely reports on network incidents has been a major obstacle in establishing situation awareness in cyber security exercises. The security teams are too busy handling the incidents to create detailed reports. However, the observations and actions made by local experts are crucial to well-informed high-level decisions. At the Locked Shield 2012 exercise, Clarified networks was responsible for providing SA solutions and building the Finnish situation room. AbuseSA, a collaborative system, which combines instant messaging, wikis and real-time visualizations to provide actionable situation awareness, was implemented. To encourage security teams to report incidents, a CDX extension to AbuseSA, which allows users to quickly report incident using instant messaging, was introduced. The overall execution consisted of providing the technical solution and helping the exercise organizers to implement the supporting workflows. The results of the exercise were positive with all teams using the functionality to report incidents.