Becoming Invisible Hands of National Live-Fire Attack-Defense Cyber Exercise

This paper provides an extensive discussion of the design process for a new format of national live-fire exercise, called Cyber Conflict Exercise (CCE). CCE targets a real-time battlefield drill between red teams (RTs) who try to penetrate a multi-level organization network and blue teams (BTs) who try to defend against them. This is also a competition-based exercise between red teams and between blue teams. Exercise management teams (WTs, white team) want to be invisible hands to provide a dynamic and interesting battlefield experience to both RTs and BTs with balanced set-up. This paper discusses the challenges that need to be addressed in developing and operating CCE where WTs have little control over RTs or BTs. The devised technical and operational solutions to tackle these challenges are discussed.