RL Inspiration: Cyberstorm, Your Dept. of Homeland Sec. $$$ at work Options

[RunnerPaul]

So who wants to turn this in to a run?

U.S. Department of Homeland Security's Cyberstorm training exercise last Feburary

[Edit:Fixed broken tag]

This post has been edited by RunnerPaul: Aug 18 2006, 08:56 AM

[SL James]

I'm shocked, shocked at their choice of opfor.

What I'm more concerned with is how catastrophically the government failed. After all, let's not kid ourselves: They always fail these things. Miserably. Unless the rules are rigged, and usually after the fact.

[LilithTaveril]

Meh. This is like all of those war with China scenarios we end up losing. No real basis in reality. Just ignore it as the sensationalism it is and go on.

Oh, and for fun, count how many groups they have that hate each other or think the others are wackos working together in this scenario. It's like all of the groups of Iraq teaming up and attacking American forces. Or the ghoul nation, the Tirs, and Humanis teaming up to attack the UCAS.

[SL James]

Well, to be fair when I said concerned I meant "the only thing that would actually be of interest to me." I mean, really, if this happened IRL bad shit would happen, the government would fuck up the response (if they did at all), cover up their incompetence, spin their vigiliance, get some half-assed piece of useless legislation that only screws more people passed, and then distract the public with something else, probably having to do with how evil gays are.

It's so routine it's probably on the first page of every political management textbook: Do This! ^^^

[Grinder]

[Oracle]

At least when there is a common cause. For example the visit of the president of a certain country....

[Grinder]

The meetings of the G8-group is another one.

[Adarael]

James... When I read your posts, I seriously hear Michael Chiklis saying the words.

Also: yes. As James points out, what happened in the game is nothing like what would happen in reality.

[hyzmarca]

Notice that there were no actual attacks here. The attacks and their effects were pure GM (in this case government) fiat. Disrupting the power grid? Shutting down rail travel? I can see some hackers messing up automated ticket sales but any connecting such vital systems to the internet at all is painfully stupid. One should not be able to do these things without access to physical facilities.

Real life isn't like War Games. Matthew Broderick can't start a nuclear war with his dial-up modem.

[LilithTaveril]

Hyzmarca, agreed. If real life were like war games, we'd all be typing this in Chinese right now.

[Smokeskin]

Pretty much everything is connected to the internet these days. You want to be able to communicate and transmit data between different locations, so you hook them up to the internet. What else would you use? Also, pretty much every place has a need for internet access (for email etc.), and you don't get separate computers and networks for that. Chances are, your power plant worker controls a lot of the stuff from the same PC that he's checking mail on, and the servers that control the rest are on the same LAN.

In the real world, firewalls are almost impossible to penetrate, passwords can't be hacked, and encryption is effectively unbreakable. Or at least they're regarded as such. No business is going to spend the cost of making dedicated networks as alternatives to the internet just to be immune to hackers. It is not like having access to the internet lets every hacker have his way with your system.

[hyzmarca]

Centralized power distribution predates the internet by several decades. The power grid has its own properitary communication network. It has for some time. There is no need to connect it to the internet unless they want to sell the excess bandwith. Some do so, but Broadband over Power Lines is realitivly rare today and adapting these systems to interface with the internet is costly. For the most part, the power grid would be controled from properitary computers running properitary software

[RunnerPaul]

[Smokeskin]

Guess you're right about power companies already having it in place before the internet.

Mission critical stuff may well be kept segregated, but AFAICT from the scenario, they weren't hitting mission critical stuff. You probably can't make trains crash, but disrupting the service is much easier than that - ticketing functions, arrival info and lots of other stuff is certainly handled by internet-access machines. You might not be able to shut down power plants as such, but most likely a lot of stuff is handled over the internet - at the very least calendars, email, blueprints, work plans, etc. get handled by PCs connected to the net, effectively giving hackers the ability to knock out the workforce's ability to function (or even worse give them fake orders).

In a lot of places old systems are being hooked up the internet too. For example HVAC systems get hooked up to the net, and then through the utility provider's webpage you can monitor and control it. Hack one of those places (which control a lot of buildings) and you can upset a lot of people.

[Firewall]

Based on my experience in a large organisation who I will not name, a lot of security systems are networked with cameras wired up as web-cams. Anyone can access them, the feeds can be recorded and replaced by fiddling with a single line of ASP.NET code, to change the feed URL. The only systems not networked are a series of analogue cameras which only show a couple of angles outside the buildings. I think it is something like eight cameras covering five or six buildings and all external.

This organisation does contracts for the Ministry of Defence and one building contains a selection of chemicals which could be used to make chemical weapons, explosives and I think may even contain some low-grade biological threats. Of course, I just work in marketing. Well, technically...

And the local government had a number of systems go down for seven minutes last week. All the networked computers, telephone lines and any number of other things like camera-feeds. They had nothing to say about why and it has been suggested (by tech-support) that they still don't know what went wrong, nor do they seem to care.