Submitted by: Bengt Gregory-Brown (CS)²AI Co-Founder
Original Source: https://thehill.com/policy/cybersecurity/512119-federal-agency-announces-completion-of-simulated-cyberattack-on-critical
BY MAGGIE MILLER 08/14/20
The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) announced Friday the successful completion of a biannual simulated cyberattack aimed at preparing the U.S. and its partners to defend against a real attack on critical systems.
The three-day exercise, known as “Cyber Storm,” involved 2,000 participants from the fields of private industry, the federal government and international groups, and was described by CISA as the most extensive cybersecurity exercise in the United States.
CISA Assistant Director for Infrastructure Security Brian Harrell told reporters Friday following the end of the simulation that it was important to simulate a debilitating attack to increase coordination between all the potential groups, all of whom worked together remotely from their homes or places of work during the exercise.
“We’re more connected than ever, which means our nation’s critical infrastructure faces increased risks from cyber-attacks,” Harrell said in a statement. “No one company or government agency can be expected to go it alone, which is why exercises like Cyber Storm bring everyone together to discuss and exercise how we would respond collectively to a cyber-attack. Each Cyber Storm our coordination and capabilities get better, and this year was no different.”
He told reporters that the simulation — which mimics potential attacks on critical systems but does not actually attack or disrupt these systems — involved an “all out attack on different sectors” that was modeled on the capabilities of real-world adversaries.
“Now is the time to exercise under blue sky conditions, you don’t want to exchange business cards during a hurricane,” Harrell told reporters. “The Cyber Storm exercise elements represented actual and potential risks and attacks were made to be as realistic as possible.”
While election security has been a key issue of concern in recent weeks, Harrell said this was not a sector tested by the simulation, though CISA did host a tabletop exercise among election officials and private sector election groups last month to serve as a test for Election Day plans.
Harrell said he felt this year’s Cyber Storm exercise had shown the progress made in protecting critical infrastructure from attack.
“Did we move the needle when it comes to cyber response, and I think this time around ... we are seeing some marketable improvement across the critical infrastructure space,” Harrell told reporters.
CISA plans to soon release a report that will go more in-depth on the findings of the exercise, Harrell noted.
The Cyber Storm exercise last took place in April 2018, and involved half the amount of participants who were involved in this year’s simulation.
Concerns around cybersecurity of critical infrastructure have ramped up during the COVID-19 pandemic, as individuals have moved online for everything from business to socializing.
CISA and the National Security Agency (NSA) warned in July that foreign hackers were attempting to target U.S. critical infrastructure, specifically the internet-connected operational technology (OT) assets, used throughout U.S. defense systems.