Training USAF Cyber Defenders Where They Fight

USAF Cyber Mission Defense Teams (MDTs) do not have a way to test and evaluate their personnel's ability to identify, investigate, and initiate response to representative adversary activity on their production networks. Often, when they encounter adversary activity on their networks it is the first time and they have not practiced or its a distracting false positive . Since these situations can not be controlled, squadrons with MDTs do not have a way to safely generate representative adversary traffic, observe technical and personnel behavior, annotate the results, provide debriefs and feedback, and show results over time. Cyber COAST proposes two prototype solutions to fulfill requirements identified in Phase I. For Prototype I, Cyber COAST will tailor its "Battle Stations" application that integrates with the Verodin Security Instrumentation Platform, FireEye Threat Intelligence, and the Elastic stack to provide this functionality within the production environment the MDT is protecting. Results can be used to provide repeatable evaluations and standardize MDT training across units, weapons systems, and Major Commands. Prototype II will tailor current Classroom as a Service offering to the cyber infrastructure training needs. This solution will visualize current instructional processes creating a flexible delivery solution for instructors and students.