1 / 12

CyberCIEGE: An Interactive Tool for Information Assurance Training and Education

CyberCIEGE: An Interactive Tool for Information Assurance Training and Education. Presented to FISSEA 22-23 March 2005, North Bethesda, MD Dr. Cynthia Irvine Naval Postgraduate School. Naval Postgraduate School Cynthia Irvine Michael Thompson Albert Wong Matthew Rose Naomi Falby Students

pleasance-roche
Download Presentation

CyberCIEGE: An Interactive Tool for Information Assurance Training and Education

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. CyberCIEGE: An Interactive Tool for Information Assurance Training and Education Presented to FISSEA22-23 March 2005, North Bethesda, MD Dr. Cynthia IrvineNaval Postgraduate School

  2. Naval Postgraduate School Cynthia Irvine Michael Thompson Albert Wong Matthew Rose Naomi Falby Students Klaus Fielk Ken Johns Rob Lamore Justin Lamoire Marc Meyer Tait Leng Teo Rivermind Ken Allen Bill Chinn Scott Gallardo Brian Morgan Sponsors US Navy NETC ONR OSD CyberCIEGE Team

  3. CyberCIEGE Solution • Teaching tool that engages the imagination • Virtual world shows consequences of security choices • Student responsible for organization IT • Keep organization virtual users happy • Purchase hardware and software components • Design networks • Configure components • Manage IT staff • Ensure physical security • Require background checks for certain information access • Provide IA training • Ensure that security does not get in the way of productivity • Protect organization information assets from cyber threats • Greater asset value  greater attacker motivation

  4. Motivation • Information Assurance is implicit in everyone’s job • Personnel need to understand their important role in IA • Administrators must know security impact of choices • Managers must understand how IT infrastructure can support (or detract) from security policy enforcement • Certifiers must appreciate big-picture security • Problem: • Training and Awareness can be boring • Good security practice is not “automatic” • Should be like washing hands and using seat belts • Many security measures combine for overall security • Complexity is hard to convey and hard to internalize

  5. Elements of CyberCIEGE • Simulation Engine • All security policies & wide variety of security mechanisms • Graphics easily added • Scenario Definition Language • Describes how Simulation Engine runs • Rich semantics • Triggers for “plot twists” and to log student progress • Scenario Definition Tool • Supports scenario creation using a GUI • Encyclopedia • How to use the game, security facts, why you lost • Movies • Supplements encyclopedia

  6. Scenario Definition Tool

  7. CyberCIEGE Use • Student presented with objectives • Scenario includes • Physical setting • Virtual users, each with work goals • Also have happiness factors • Enterprise assets, each with two values • Value to enterprise • Value to attackers • Student must meet objective • Secure physical environment • Keep users happy and productive • Apply enough security to keep attackers away • But do not interfer with user productivity! • Complex scenarios may have phases • Logs record student success or failure

  8. CyberCIEGE Screen

  9. Example: DoD Directive 8570.1 • Create Scenario(s) to depict your organization • Can be run in stages • Emphasize security policy and procedures key for your organization • Logs show student progress and success • Scenarios for different user populations • Awareness for typical users • Training for key personnel • CyberCIEGE does not replace specific HW/SW training • Education, Training and Awareness • Supplement existing classes • Create new scenarios for classes • Example: Certifier Case Study Scenarios

  10. Meeting Mandates for IA ETA • Mandates for IA Education, Training & Awareness • More ETA requirements • Resources for achieving goals limited • How can you ensure that • All personnel have annual IA awareness training? • Personnel put training into daily practice? • Make system administrators &certifiers aware of complex issues? • Interdependencies • Impact on organizational productivity • CyberCIEGE is fun • Contains hooks for student assessment • Can be tailored to your organization

  11. CyberCIEGE Opportunities • Tailor CyberCIEGE for your organization • Example: Medical/Health • Create artwork for clinic or hospital • Develop scenarios for HIPPA and health-specific topics • Develop tools for automated student assessment • Develop tools for progressive scenarios • CyberCIEGE website for sharing • Advanced versions of CyberCIEGE • Wireless • Mobile ad hoc presents changing topology and devices • Multiplayer • Students attack others and defend their organization • Want something big? Combine forces! NPS and Rivermind Seeking Partners

  12. More Information • Available to US Government at no cost • Sim. Engine, Current Scenarios, SDT, Encyclopedia, Movies • Non-government availability • Contact Rivermind for a pre-release license • First Rivermind commercial release: April 2005 • CyberCIEGE Website http://cisr.nps.navy.mil/cyberciege.html • CyberCIEGE Email cyberciege@nps.edu • Naval Postgraduate School • Cynthia Irvine irvine@nps.edu • Rivermind, Inc • Ken Allen kallen@rivermind.com

More Related