Participated in cyber range exercise

This is Sashihara from the System Solutions Department.

The other day, on June 20th, I participated in a cyber range exercise held by Ni Cyber ​​Security Co., Ltd.

I personally learned a lot, so I will give a brief summary.

What is Cyber ​​Range?

Simply put

What should I do if I receive a cyber attack?

What should I do after receiving a cyber attack?

This is an exercise in which you can learn the contents in a practical manner.

 

Exercise content

We will respond to any incidents that occur during the exercise.

This includes determining priorities and response policies for the incident, and responding accordingly.

Basically, this is done in a team structure, but each person is divided into three roles.

The role is roughly as follows.

• alert analyst

Monitor incidents and see when, where, and what happened.

• incident responder

Actual response when an incident occurs.

• commander

Manage and report incidents and the movements of each employee.

 

My first job was as an incident responder, which is what I usually do.

The second time I worked as an alert analyst.

Thoughts on the exercise

It was still difficult because they launched a full-scale attack.

I can decide to some extent how to respond, but since there are a lot of them, I ended up attacking another server while I was checking.

I realized how important it is to share information, as I saw members looking at the same server, and some members getting stranded for a long time.

I learned a lot because attacks like this can actually occur during operations.

Please try participating if you have a chance!