VIRGINIA BEACH, Va. – National Guard Soldiers and Airmen and members of the Virginia Defense Force partnered with military and civilian cyber operators Aug. 2-17 at the State Military Reservation in Virginia Beach, Virginia, during Cyber Fortress 25.
They conducted training and a senior leader tabletop exercise, and established enclaves in a “force-on-force” scenario to simulate the process they would follow to respond to and mitigate a cyberattack on an electricity cooperative.
The joint, interagency, intergovernmental multinational exercise focused on electric cooperatives and provided an opportunity to test Virginia’s cyber response plan, better prepare for future collective responses and build resiliency, explained Col. David Garner, the Information Operations Support Center, or IOSC, commander and exercise director.
In addition, representatives from several foreign militaries participated in the exercise, including a number from Finland, which is the Virginia National Guard’s partner in the Department of War National Guard Bureau’s State Partnership Program.
The Fort Belvoir-based 91st Cyber Brigade and IOSC hosted the exercise, which included a re-certification of two cyber protection teams and one battalion headquarters as part of their federal mission.
“The annual Cyber Fortress exercise is critical training event used to test the Commonwealth’s ability to respond to a cyber attack,” Garner said. “The relationships and trust built at Cyber Fortress will be put to the test in a real-world event and helps refine the commonwealth’s cyber critical incident response plans and provides an environment where we are continuously improving processes and readiness. The Virginia National Guard will be ready if called upon.”
Garner said the first week of Cyber Fortress was designed to deliver high-quality training in the areas of cyber defense of operational technology, specifically the technology used to interact with physical devices, such as Industrial Control System Supervisory Control and Data Acquisition systems. The Soldiers and civilian partners also received training in cyber threat intelligence, malware analysis and electrical systems.
“This training was attended by a mixed audience of military, federal government, state government, students and members of the electric co-ops,” Garner said.
Other key events from the first week were the capabilities briefs, a tabletop exercise and a Distinguished Visitors Day.
The Virginia Department of Emergency Management, or VDEM; the Virginia Army National Guard; the United States Army Reserve; and the Cybersecurity and Infrastructure Security Agency, or CISA, were among the many agencies delivering briefs on their agency’s mission and the capabilities they would bring in response to a cyber attack.
VDEM led the tabletop exercise, taking all participants through a scenario in which multiple electric co-ops were undergoing coordinated and complex multi-domain cyber and unmanned aerial system attacks.
“Although that scenario was highly unlikely to actually occur, the scenario did foster cross talk among all of the audience to work out how we would respond if something like this were to happen,” Garner said.
The Distinguished Visitors, or DV, Day audience included executive-level leaders from the VDEM; CISA; Army Research Labs; U.S. Army Combat Capabilities Development Command or DEVCOM; Army Futures Command; foreign military partners including Finland, Sweden, Latvia; the electric co-operatives; and the leadership of the Virginia National Guard.
“DV Day was designed to create an environment where these executives receive briefs, see the technology and talk to the service members about the exercise,” Garner said. “One of the most important aspects of DV Day was the ability to network with other agencies and build relationships that can be called upon if an emergency event happens in the commonwealth.”
The second week of Cyber Fortress 25 was the force-on-force cyber exercise designed to simulate and test cyber incident response to a cyber attack on an electric co-op.
The exercise’s “Red Team” acted as the opposing force and employed tactics, techniques, and procedures used by a well-known nation-state-sponsored advanced persistent threat actor that targets critical infrastructure.
The “Blue Teams” were divided into eight enclaves, each charged with the mission of defending a virtual network designed to represent what a typical electric co-op’s information technology and operational technology networks would look like.
The “White Cell” designed the exercise scenario, built the virtual network cyber range, provided exercise control and acted as the higher headquarters.
At the end of the day, the Red and Blue Teams gathered to conduct a “Purple Team” after-action review during which they discussed the day’s activities.
At the end of the exercise, a final Purple Team brief was conducted, during which the attackers outlined everything they had done in the environment, and the defenders assessed whether they had been successful in their hunt, clearing, hardening and assessing techniques.