EXERCISE TYPOLOGY AND DESIGN CHAPTER 1 EXERCISE TYPOLOGY AND DESIGN EXERCISE TYPOLOGY Cyber security exercises can be divided into a number of types: table-top, technical, communication, simulation, war gaming, capture the flag, procedural or hybrid. These share some overlaps between each other. The geographical distribution of participants may pose another dividing criterion. We may distinguish national, bilateral, regional, international or even global exercises. Regardless of the type, all exercises enable participants to tackle important aspects of responding to security incidents, such as teamwork, information sharing and institutional/cross-border cooperation etc. While technical exercises are designed to practice primarily technical skills and capabilities, discussion-based exercises are often used for testing procedures, crisis management processes and institutional arrangements and agreements. Non-technical exercises are moreover helpful in creating new or reviewing old continuity plans and policies. They may also serve new staff and not fully cyber-knowledgeable leadership as orientation to the field. Exercises aimed at practicing decision-making processes and procedures can be conducted as non-technical/table-top exercises (TTX). There is no need to use virtual environments to expose senior leaders to cyber-related matters. All that is needed is a relevant scenario and injects tailored to the given audience. The scenario should engage decision-makers to take effective decisions and relay orders to lower echelons. Executives might not be ITknowledgeable, nor might they have to face cyber-related challenges on a daily basis. Accordingly, they may not be capable of adequately assessing a particular crisis. A TTX is one of the best tools to educate decisionmakers on the importance of cyber security and its relevance to national security. According to the tools you involve in the exercise, TTXs can be further divided as rudimentary (only paper and pen needed) or more advanced (more „sophisticated“ tools involved, e.g. digital platforms, applications for online editing and sharing documents, exercise news portal, audio-visual tools etc.). From the exercise objective perspective, both hold high value. Figure 1: Cyber exercise typology including a geographical aspect. Unlike TTXs, technical exercises planned and executed in cyber ranges allow for testing individual and collective technical skills while responding to cyber-attacks. Therefore, they are more suitable for experts with IT knowledge and experience in system administration and securing infrastructure. Such range-based exercises expose those IT professionals and administrators to the imperatives of configuring, setting up, 5/29