The Design of Cyber-Physical Exercises (CPXS)

This paper explores the objectives, tactics, and strategies for identifying, planning, conducting, and evaluating an international cyber-physical exercise (CPX). The goal of a CPX is to improve defense capabilities for defending national critical infrastructure via global coordination. Lessons about CPX have been derived from a series of annual cyber-physical defense exercises conducted since 2015, referred to as Critical Infrastructure Security Showdowns (CISS). The cyber range of a CISS consists of a realistic and operational enterprise network coupled to water treatment and distribution plants in the form of physical testbeds and digital twins. These systems simulate and integrate information technology (IT) and operational technology (OT) scenarios that are ubiquitous in modern-day critical infrastructure controlled by industrial control systems (ICS). Participants from the red, blue, green, and white teams are assigned specific roles to attack, defend, visualize, and manage the plant, respectively. Each of these roles is evaluated via a specific set of metrics by a panel of judges and automated systems. The scoring criteria incentivize the red teams to design and launch novel attacks to contribute to and improve the cybersecurity community’s knowledge base regarding offense and defense. The lessons distilled from these positive-sum games are analyzed and shared in the form of post-event reports.From 2015 to 2021, CISS has constantly evolved to mimic contemporary cyber-physical security scenarios in the real world. These evolutions have forced the CISS organizing team to adapt and design novel infrastructure to support the changing needs of the event and its stakeholders, from tooling, logistics, and network infrastructure to scoring criteria and cross-disciplinary collaboration.The cited reports on techniques, tactics, and procedures will be valuable to stakeholders from the military, industry, government, and academia.