ISA – Integrated Scoring and Awareness for Cyber Ranges
The ISA – Integrated Scoring and Awareness solution helps to overcome one of the main challenges in conducting complex technical cyber security exercises, namely real-time, instant visualisation and comparison of exercise data. The solution offers an unmatched level of detail, sophistication and precision in cyber exercise data visualisation.
The scalability of ISA allows for a near unlimited number of exercise participants and IT services that shall be defended.
The solution is based on eight years of research and experience in conducting complex technical cyber security exercises, including NATO CCDCoE “Locked Shields“, “Crossed Swords“ and other national and international exercises.
Breakthrough in Data Visualisation for Cyber Exercises
ISA supports an unlimited number of teams, geographic locations or IT services that shall be defended. It also provides instant updates for team scoring, individual scoring and the overall exercise timeline. The integration of the technical game with strategic/executive decision-making exercises is intuitive and effects-based. This result is achieved by integrating regular exercise reporting activities with an automated data repository and monitoring agents that inform two main output systems: situational awareness and scoring.
Gamenet Visualisation and Situational Awareness
ISA visualises each individual Gamenet as segments in a detailed yet clear and easily understandable way. As the exercise progresses, the attacks and their effects are instantly displayed: This includes Gamenet segments and individual targets under attack, the status of segments and targets (effects). Constant live updates ensure that the progress of the exercise as well as the overall situation can be captured comprehensively. This benefits exercise management, executive briefings, integration of the exercise with operational and strategic level exercises, as well as reporting.
Single Range or Federated Solution
The number of Gamenets visualised is not limited: The solution can be deployed at a single range to visualise the situational picture of different teams or as a federated solution to compare and display results of various exercises at different locations. It can serve as a standard to display different exercises and even connect several ranges using the same visualisation tool and execute internationally arranged exercises.
Cyber Exercise Scoring and Evaluation
ISA makes it possible to fully integrate any given technical cyber security exercise as a logically managed process, where instant and detailed scoring is another crucial part alongside situational awareness. The scoring is displayed live as the exercise progresses, detailing the status of each team, team scores with score breakdown, exercise timeline, and individual scores. This contributes enormously to the overall training experience, enhances later analysis and research and generally improves the general observability of the exercise.
Cyber Exercise Scoring: Timeline
ISA provides a detailed timeline of the exercise. On timeline, all events of the exercise are displayed live and are visualised as they happen. Both the summary timeline, displaying the overall exercise events and activities, and individual team timelines are displayed. This setting effectively captures the progress of the exercise detailing at any given time the overall score, Red Team attacks, system availability, other positively scored activities (e.g. incident and situation reports) and negatively scored activities (e.g. restoring from back-up). The special scores allocated by the exercise management team are also shown on the timeline. This view not only effectively captures the dynamic and intensity of the exercise but also allows effective comparisons between various teams. Our approach has proved extremely effective during immediate feedback sessions to exercise participants. It is also indispensable in exercise reporting and after-action analysis.
Cyber Exercise Scoring: Team Scoring
Team scoring is at the heart of any exercise scoring as it determines the winners and losers. This is why exercise team scoring must be transparent, accurate and understandable to players, judges and observers. The instant visualisation of team scores contributes to the fairness of the game: when live scores are available to all teams during the exercise, they can check their performance, compare it to the other teams and adjust tactics. This increases gamification and ultimately provides more effective training experience. Our approach towards visualisation has also increased transparency and dramatically decreased after-game protests as scoring becomes understandable to all parties at any given moment during and after the exercise. We provide comprehensive comparative team scoring as well as individual team status by Gamenet segments. In addition to Team Status View, Team Awareness View is provided. This helps to visualise the differences between the current state of each team Gamenet (“Red Team view”) and their respective situational awareness as they have reported it.
Cyber Exercise Scoring: Individual Scoring
ISA is also capable of providing individual scoring, i.e. understanding how each team member contributed to the team’s overall score. The solution enables the instant visualisation of all individual players in all exercise teams or alternatively the visualisation of each individual team separately. Of course, individual scoring is also displayed live. This view helps to analyse the individual performance of exercise participants and, perhaps even more importantly, the team leader. One of the tasks of cyber exercises is to train the management of teams under considerable stress. By visualising the performance and workload of each individual player, it is possible to analyse and compare the differences in team management and allocation of workload – these are often key factors of success or failure in crisis management.
Cyber Range Visualization Suite
General View: Displaying all team scores, Gamenet status of all teams, individual scores of all players, exercise timeline
Live Gamenet: Displaying live Gamenet of exercise and situational picture. All individual Gamenets displayed and live attacks against network and Gamenet status updated instantly.
Team Status: The actual status of each Gamenet displayed by network segment immediately. Allows comparison with situational reporting by individual teams.
Team Timeline: Captures the exercise progress and dynamic for each individual team. Excellent view for immediate feedback and reporting.
Individual Scores: Performance by individual team members. Allows to compare differences in tactics and workload organisation by team leaders. Forms the basis for evaluating individual performance.