Опыт проведения киберучений с использованием разработанного сценария

Abstract

The threat of cyber attacks has become a serious problem for organizations, the solution of which also lies in the plane of modeling scenarios of possible attacks using digital twin technologies. A cyber polygon based on the AMPIRE software suite is used to study the impact of cyber threats. The attacker's scenario includes the use of various tactics and vulnerabilities, such as active scanning, provisioning, vulnerabilities in public applications, malicious links and files, and compromising domain user accounts. The vector of the malicious attack is related to the tactics, techniques and procedures of the Mitre ATT&CK matrix. Vulnerabilities include the wpDiscuz plugin, Zerologon, and the consequences of using Wordpress Shell and gaining unauthorized access. The ongoing intercollegiate cyber exercises have revealed strengths and weaknesses that need to be taken into account when conducting the following events. Scenario testing with the participation of universities showed the effectiveness of the complex in assessing the time required to close vulnerabilities and eliminate consequences. Implementation of different scenarios with specialized functionality at the cyber polygon makes it possible to form practical skills to prevent attacks on computer networks, and also allows you to analyze the situation, interact with other participating specialists.