Countermeasures Management in Cyber Defense Exercises

Current challenges in all kinds of computer systems add to the importance of adequately managing blue team tactics, techniques and procedures. Microsoft (MS) Windows operating systems together with the Active Directory domain environment are a crucial part of cyber-defense strategies of military or civil infrastructures. This fact is supported by cyber defense exercises, where these topics are covered in several scenarios. The main aim of this paper is to analyze the MS Windows cyber defense scenarios environment and the respective activities of the blue teams. Based on the analysis, this paper proposes an innovative solution for managing blue team tactics to detect misconfigurations and vulnerabilities in MS Windows. A ready-to-use automated tool provides a way for automated audit of security measures in the MS Windows operating system.