Cyber Awareness Exercises: Virtual vs On-site Participation & the Hybrid Approach

Abstract

This paper examines the advantages and disadvantages of executing cyber awareness exercises in two different formats: Virtual vs On-site participation. Two EU Agencies, EUSPA and ENISA have organized in the previous years Cyber Awareness exercises; a very important tool to enhance and test the organization's ability to put up resistance and respond to different cyber threats. The objective of this paper is to compare the outcomes of these awareness exercises, executed on-site through physical attendance prior to 2019 and virtually, in a remote setup in 2020, due to the restrictions posed by the pandemic of COVID-19. ENISA in collaboration with EUSPA have accumulated raw and diverse data from the evaluation reports of the cyber events mentioned above. The comparison of these data will focus on the most important success factors of a cyber awareness exercise such as: participation, cooperation (social interaction/teambuilding), effectiveness, fun, tools and identify how the location of the participants affects them. The aim of this work is to highlight through statistical analysis the benefits of a hybrid approach to the exercise’s setup, once combining elements of both virtual and on-site. Depending on the different kind of exercises, such a hybrid setup, will provide more flexibility to an exercise organizer and help maximize effectiveness, while adapting to the fluctuating working regimes of the near future; namely Teleworking. Furthermore, a modular exercise design will be proposed in order to adapt to the location limitations without impacting negatively the rate of the rest of factors analyzed.