PNNL

Realistic small-scale models are delivering big impacts to cyber teams training to protect the nation’s critical infrastructure against cyberattacks. Pacific Northwest National Laboratory (PNNL) recently hosted a training exercise that immersed the U.S. Coast Guard 2013 Cyber Protection Team (CPT) in a lifelike simulation of a cyberattack on a U.S. port terminal.

The exercise featured PNNL’s maritime platform, designed to replicate real-world seaport operations at a small scale. The platform is one of five jointly developed and operated by PNNL and the Cybersecurity and Infrastructure Security Agency as part of the Control Environment Laboratory Resource.

“The realism of these platforms is unmatched. When the platform’s cranes suddenly stop and shipping containers move in unexpected ways, the trainees have to figure out what’s happening. They are looking at information systems and data just like operators would see at a live port,” said Bill Hofer, cybersecurity engineer at PNNL.

The Control Environment Laboratory Resource consists of researcher-built scale models of critical infrastructure, including a water treatment plant, a wastewater treatment plant, a freight rail yard, a hydroelectric dam, and the maritime shipping port that was used in this exercise. The maritime platform contains representative industrial control systems and equipment commonly found within a typical U.S. seaport, such as automated cranes, truck and train assemblies, manual controls, and shipping containers.

“Everything in the platform is fully operational and mimics real-world conditions, just on a smaller scale,” said Hofer.

The CPT exercise used the maritime platform to immerse CPT members in a simulation of a multistage cyberattack on a U.S. container terminal. The simulated attack featured a team of PNNL cyber experts acting as adversaries trying to disrupt port operations.

CPT members worked together to detect, contain, and respond to the simulated attack in real time, including identifying how attackers gained access to the terminal’s operating system and developing mitigation strategies.

“Exercises like this allow analysts to better understand and recognize cyberattack tactics in realistic scenarios and to practice using their tools to identify and mitigate the attack,” said Hofer.

To learn more, watch this video and check out the related MyCG article. The training was also featured in Homeland Security Today.