The Cyber Storm exercises are sponsored by the Department of Homeland Security and held every two years. They simulate large-scale cyberattacks on the US government and the nation’s critical infrastructure, such as energy grids and nuclear power plants, to test the response of government and industry cybersecurity personnel.
The Cyber Storm III exercise, being held this week, includes participants from seven federal agencies, 11 states, 60 private companies, and 12 international partners. This compares with the same number of federal agencies, nine states, 40 private companies, and four international partners in Cyber Storm II.
Thid year's exercise will test out the recently developed National Cyber Incident Response Plan, a government blueprint for cybersecurity incident response, as well as the new National Cybersecurity and Communications Integration Center set up in Arlington, Va., in October 2009.
“The Cyber Storm III exercise scenario reflects the increased sophistication of our adversaries, who have moved beyond more familiar Web page defacements and Denial of Service (DOS) attacks in favor of advanced, targeted attacks that use the Internet’s fundamental elements against itself – with the goal of compromising trusted transactions and relationships. The scenario will incorporate known, credible technical capabilities of adversaries and the exploitation of real cyber infrastructure vulnerabilities, resulting in a range of potential consequences – including loss of life and the crippling of critical government and private sector functions,” according to a DHS fact sheet.
Industries represented at Cyber Storm III include banking and finance, chemical, communications, dams, defense, information technology, nuclear, transportation, and water supply. Foreign countries participating are Australia, Canada, France, Germany, Hungary, Japan, Italy, the Netherlands, New Zealand, Sweden, Switzerland, and the UK.