A game of nations — How nation-states prepare for cyber threats with Locked Shields

A nation-state is a sovereign state inhabited by a group of people who share a sense of national identity and usually embody a common culture, language, and history. This commonality contributes to a sense of belonging and identification with the state, so the state represents the interests and aspirations of a nation. This definition is not strict, though, since many nations consist of diverse ethnic, cultural, and linguistic groups within their borders, yet are still considered nation-states for aspects that unify them.

A commonly exhibited trait by nation-states is the desire to assert dominance or achieve strategic objectives. This is attempted through acts such as aggression, cyber attacks, espionage, and disinformation, among others. A nation-state that commits such acts is referred to as a hostile nation. 

Hostile nation-states are a high risk due to their ability to effectively employ technology and tools against the most difficult targets. These targets include, for example, classified networks and critical infrastructure (CI) like electricity grids, transport systems, and gas control valves. Hostile actions can target government institutions, private organizations, or even individuals.

Nation-state cyber threats are methodically planned and executed cyber attacks that are usually carried out by state-sponsored actors on behalf of their government. These threats often involve the use of sophisticated techniques and advanced capabilities and are backed by significant resources and expertise. 

These nation-state cyber threats typically involve Advanced Persistent Threat (APT) groups that operate over a long period, with a focus on stealth, persistence, and intelligence gathering. The attacks are advanced due to their use of sophisticated intrusion capability as well as malware. This also includes the development of custom malware and tools when needed. 

The persistence aspect focuses on a committed execution of attempted attacks over a long period of time with the aim of being successful in breaking into the target. The attacks are usually progressive and of a variety, often stealthy in nature. Threats are the proactive discovery and exploitation of the target's technical and non-technical vulnerabilities.

The actors behind nation-state threats are usually state sponsored agencies or organizations whose aim is to gather intelligence and information of national interest. This interest is usually focused on critical infrastructure of other nations and organizations of interest. Nation-state actors have advanced capability in cyberwarfare for the purposes of espionage, among others. 

There are two ways a nation can employ nation-state threat actors. Firstly, a nation may  engage its own intelligence agencies and specialized cyber experts. Or, some nations work with organizations that specialize in cyber crime. It is also common to have a nation use nation-state actors in both categories. In either case, there is a lot of espionage associated with nation-state actors. These actors can attack other nations or other outside organizations, including private companies and non-governmental organizations. 

The goal of nation-state actors is to use their technology skills to:

• Steal sensitive information
• Disrupt critical infrastructure
• Gain an advantage over state adversaries 
• Facilitate hacking
• Sabotage
• Commit theft 
• Spread misinformation

Achieving these goals tends to be seen as an enhancement of a nation-state’s counterintelligence strategy.

So, what is Locked Shields? It is one of the world's largest and most realistic cybersecurity exercises, aimed at testing the defense capabilities of member nations in a simulated cyber attack. Elastic participates by supporting some of the member nations that take part in Locked Shields. Locked Shields is an annual exercise hosted by the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE), designed to test and improve the preparedness of member nations and partner states against large-scale cyber attacks.

The Locked Shields exercise focuses on two fictitious nations, Crimsonia and Berylia. These have been used as part of the exercise scenarios since inception of the exercise.

Berylia is typically depicted as the victim of aggressive actions from Crimsonia. Berylia is defended by the blue teams. The Locked Shields exercise challenges teams from various member nations to defend the network and systems of Berylia while continuing the operation of assorted services. The teams must handle and respond to a wide variety of cyber threats while maintaining the confidentiality, integrity, and availability of the systems.

Crimsonia, on the other hand, represents the attacking side. In these scenarios, Crimsonia often depicts a sophisticated cyber threat actor. It uses a range of tactics, techniques, and procedures (TTPs) aimed at disrupting, degrading, or destroying Berylia's critical infrastructure and information systems. This could include attacks on networks, data breaches, distributed denial of service (DDoS) attacks, and other types of cyber espionage and warfare.

In addition to stakeholder management, member nations have to understand the various critical infrastructure for the fictional island state Berylia. As the mantra goes, “you can’t protect what you do not understand.” The member nations have to inventory all assets: endpoints, network segments, applications, and users. The next step is to identify the assets that have critical data on them for each CI. Asset management is a critical foundational component of any cybersecurity program. 

The state of Berylia has CI encompassing military and civilian IT systems. This includes networks, communication facilities, water purification systems, the electric power grid, and even a central bank. 

Member nations using Elastic take inventory in a similar way to how the internal Elastic InfoSec team does asset management. The Elastic InfoSec team sees asset management as one of the building blocks of a proactive, end-to-end security strategy. The figure below is a summary of this approach. You can read this blog for more details.

Elastic Security protects organizations and their data from attack. The solution can thwart complex attacks with advanced analytics, blocking threats such as malware and ransomware on critical systems. Elastic Security enables the advancement of security operations maturity to stop threats at scale. It is simple and easy to get started with Elastic Security.