Cyber Primer

Integrating cyber operations
when planning against cyber attacks a wider, systems view is taken
of potential problems and their solutions. For example, there is little
value in protecting a critical computer controlling the fuel pump to
the ship’s engines if the logistics systems are attacked to provide false
fuel states. The entire system needs to be protected.
b. Security personnel. Operators of a computer system may not
be best placed to apply cyber security to that system. Key security
personnel (identified in advance) should be on a readiness rota.
They should maintain links to the appropriate security procedures
and teams (for example, CERTs and warning and reporting points
(WARPs)). It is not uncommon to need to contact manufacturers or
suppliers of a computer system when a cyber attack occurs. Contact
lists should be maintained and the process tested. Again, business
continuity plans must be maintained and practised.
c. Recovering from malware attacks. Malware is notorious for
remaining in a system even though it appears to have been removed.
Thorough cleansing is often a matter of opinion of the operators
rather than a proven fact. Maintaining and installing verifiably clean
backups, held off-site in a secure location, should be practised as part
of normal operations. Attacks, and suspected attacks, should always
be reported through the local chain of command.
4.17. Exercising the capability. Cyber needs to be exercised in the
mainstream along with other capabilities so that users can develop
understanding and resilience. Frequent, detailed and well-rehearsed
actions in response to cyber attack will be exercised within the Defence
Exercise Plan, managed by Joint Forces Command. Appropriate scenarios
and practises for each level of command will differ and may change rapidly
in line with the threat. Cyber response activity will need to be undertaken
at all levels of training (individual, collective and joint). There will also be
education as well as training aspects to this requirement. Cyber-related
scenarios and injects are already being incorporated into joint exercises such
as the UK’s Exercises JOINT HORIZON and JOINT VENTURE as well as those of
74
Cyber Primer (2nd Edition)