Exercise Locked Shields 2016 Highlights Priorities in Cyber Defence

Locked Shields 2016, the world’s largest international cyber defence exercise, put cyber defenders under intense pressure to reveal their strengths and weaknesses.

The active phase of the real-time network defence exercise, hosted by the NATO Cooperative Cyber Defence Centre of Excellence, ended today. It focused on training cyber security experts who protect information technology systems on a daily basis. The winning team of Locked Shields 2016 will be announced tomorrow. 

“Locked Shields is a stress test based on a fictional scenario and on large virtualised networks.  My job was to push the teams to their limits and challenge them with a wide variety of attacks,” said Mehis Hakkaja, CEO of Clarified Security and head of the red team.  “This pressure in an exercise environment is necessary for teams to test their skills and defensive tactics while maintaining situational awareness. As usual, the teams that were able to setup good monitoring techniques were able to lead the way.” 

“This exercise emphasises that technology experts cannot operate in isolation. Therefore the teams had to constantly consider legal ramifications and the media’s response to their actions,” said Dr. Heather Harrison Dinniss, senior lecturer in International Law at the Swedish Defence University and head of the legal team at Locked Shields. “International law clearly applies to cyber space and states are very aware of it. As in previous years, we have seen a wide variety of responses to legal issues. These exercises are good training environments, not only for the technical teams, but also for the legal advisors, in order that they are prepared should they have to face these issues in real life”

Locked Shields 2016 is the biggest and most advanced international live-fire cyber defence exercise in the world. Over 550 people and a total of 26 nations are involved in Locked Shields 2016. 20 Blue Teams representing 19 nations and NATO Computer Incident Response Capability (NCIRC) were tasked to maintain the networks and services of a fictional country, Berylia under intense pressure. This includes handling and reporting incidents, solving forensic challenges as well as responding to legal, media and scenario injects.

While the organizers of the exercise gathered in Tallinn, Estonia, the participating Blue Teams had online access to the exercise networks and typically worked from their home countries.  The virtualized Blue Team networks were custom-built and included a variety of services and platforms. For example, the Blue Teams had to maintain a number of servers, online services and an industrial control system. Realistic technologies, networks and attack methods formed the backbone of Locked Shields 2016 to stay abreast with market developments.

Locked Shields 2016 was organised in cooperation with the Estonian Defence Forces, the Finnish Defence Forces, the Swedish Defence College, the British Army, the United States European Command, Tallinn University of Technology and numerous other partners.

The NATO Cooperative Cyber Defence Centre of Excellence (NATO CCD COE) is a NATO-accredited knowledge hub, think-tank and training facility. The international military organisation focuses on interdisciplinary applied research and development, as well as consultations, trainings and exercises in the field of cyber security. The Centre’s mission is to enhance capability, cooperation and information-sharing between NATO, Allies and partners in cyber defence.

Membership of the Centre is open to all Allies. Currently, the Czech Republic, Estonia, France, Germany, Greece, Hungary, Italy, Latvia, Lithuania, the Netherlands, Poland, Slovakia, Spain, Turkey, the United Kingdom and the United States have signed on as Sponsoring Nations of the Centre. Austria and Finland have become Contributing Participants – the status available for non-NATO nations.

Photos from the exercise are available to use for free: http://pildid.mil.ee/K-berkaitse-ppus-Locked-Shields-2016-Cyber-Defence-Exercise-Locked-Shields-2016 (photo credit: Hans-Toomas Saarest, Estonian Defence Forces).