Can You Help Us Design Our Cyber Exercise?
Six Frequently Asked Questions
by Roger Mason PhD
For many years, exercises and wargames have been an essential tool for decision makers and strategists. Exercises and wargames are employed by governments, military services, and corporations to explore and solve critical issues. No issue is more critical than coping with the challenges of the post-modern age of information operations. It is natural that decision makers are interested in employing exercises and wargames to explore cyber operations.
For the past two years, LECMgt has been studying and developing cyber exercise and wargame design. The following are frequently asked questions by organizations seeking our help with their cyber exercises.
Click each question below to see the answer:
How Should We Design Cyber Operations into Our Exercise?
There are three ways a cyber exercise can be designed: as a key function, a critical adjunct, and a possible option. A key function means the exercise is focused directly on cyberspace operations. A critical adjunct means that cyber operations are an important part of the simulated functions in the exercise. An example might be a critical incident where cyber operations across a large organization are under attack. A possible option is where cyber is employed is employed for various uses. An example might be employing cyber operations as a problem-solving tool.
How Do We Start the Design?
Five important questions need to be addressed when beginning a cyber exercise design: the objective, the scenario level, the audience, tech requirements, and doctrine. What is your objective for the exercise? Exercises can train, evaluate, and develop new solutions. The next question is at what level the exercise will be conducted. Is it at the tactical level with a small group of experts solving technical problems, or the operational level where individual groups across a large organization must cooperate to respond to a cyber crisis? The audience is whom the exercise is designed for. Is it designed to engage organizational problem solvers or train strategic decision makers?
The tech requirement is not whether you need Windows or PowerPoint the day of the exercise. It is the level of technology you will simulate in your exercise. It can also be a specific technology that will be employed during the exercise scenario. This may require subject matter experts on your design team. The final question is doctrine. Are there rules, procedures, or protocols the exercise team will be expected to employ during the exercise problem solving and decision making. Once these questions have been addressed the design process can begin.
Will You Work with Our Design Team?
The answer is yes. The level of assistance you require will determine our involvement with your team. A common approach is to designate a lead designer for your internal exercise team. We work directly with them developing solutions and evaluating the exercise design.
What Are the Challenges of Designing a Cyber Exercise?
The design challenges of a cyber exercise are the same as any other exercise. The first challenge is failing to define the objectives and establish the design guidelines. Without clear guidelines, the exercise cannot focus or provide any exploratory conclusions. The second problem is trying to include everything into a single exercise event. Trying to cover everything ensures very little will be accomplished.
Can You Work with Proprietary or Secret Information?
LECMgt has worked with a variety of clients with a wide spectrum of security and proprietary interest issues. We are familiar with these potential problems. We will focus on the overall design issues and the internal lead designer can bolt on the secret or proprietary information. This sensitive data will not be revealed to LECMgt. The challenge is not adding secret details but ensuring the exercise framework is sound. The client can preserve their security while receiving assistance with the exercise design.
How Can We Estimate the Costs?
LECMgt Cyber Design Packages
LECMgt offers three levels of assistance in cyber exercise design. Each success level provides more direct assistance. The basic design package involves the consultant assisting your lead exercise designer. The intermediate package provides more direct assistance and the advance package involves LECMgt providing the entire exercise.
Basic Design Assistance
The basic design assistance package is intended to aid an exercise design team’s lead designer. LECMgt will work with your exercise designer to develop your exercise framework including designing the scenario, developing objectives, preparing the scenario injects, and identifying the after-action evaluation topics. Basic design assistance also includes three LECMgt training presentations on cyber exercise design for the internal exercise designer.
Price $2,500 to $5,000 US.
Intermediate Design Assistance
This includes the basic design package with additional assistance preparing the scenario, writing the design injects, and designing the briefing materials.
Price $5,000 to $10,000 US.
Advanced Design Assistance
This package includes preparing all the parts of the exercise design and presenting them to the internal exercise team. This includes developing the objectives, writing the scenario, preparing the injects, and developing the briefing and after action materials. This is a turn key exercise design. The final cost will depend on the size of the exercise.
Price 10,000-?