Cyber Polygon 2024
highlights

The tasks for the scenario were chosen for a reason as they accurately reflect the most prevalent risks of the current threat landscape. Information systems are getting more complex while machine learning and artificial intelligence are increasingly integrated into our daily lives. New technologies are more vulnerable to attacks than conventional and familiar tools.

We are also witnessing trends toward deploying infrastructure in clouds and using containerization tools. In the training exercise, we emphasized the consequences for the IT infrastructure if these tools are not configured correctly.

In our scenario, we decided to combine actual incidents from BI.ZONE practice, encountered by SOC, DFIR, and CSIRT teams. The result was a complex but quite real targeted attack.

One of the key points of the scenario was an attack on the Kubernetes container orchestration system, which occupied both R&D segments: R&D Dev and R&D Prod. To investigate the attack, the teams had to:

• use Kubernetes audit and Tetragon logs
• analyze the disk memory dump from the attacked host
• access the telemetry in ELK to search for attacker activity
• examine files
• review the tactics and techniques used by the attackers
• study numerous logs and records
• search the Internet for details

Response skills and a sharp eye are crucial for cybersecurity specialists to quickly repel an ongoing attack. Our main vision in designing the training format was to let the participants experience real attacker tactics and techniques in a safe environment that would closely mimic real investigative operations.

In this regard, cyber range appeared to be the perfect format. It helped the teams practice remediation along the entire attack chain. The artifacts were used to underline their importance for understanding the attack vector and preparing further response actions.

Cyber range trainings are not just an effective way to immerse your security specialists in life-like attack situations, but a chance for top management to assess the resilience of their security teams and identify the weak points in their defenses.

The participants had to investigate a cyber incident at MerkuryLark, a fictional company that is developing an application powered by artificial intelligence.

The story goes that after a successful release of the product, the company enters into several multimillion-dollar contracts. However, their AI model soon begins to deteriorate. At the same time, a competitor company announces the development of a similar product at a lower price. MerkuryLark is near collapse.

The company management suspects that the internal infrastructure has been compromised and all developments stolen. While intellectual property specialists are reviewing the competitor’s solution, the company invites a team of cybersecurity experts to investigate the incident. Each participating team took on the role of those experts and carried out an investigation of a possible compromise.

According to the scenario, the teams retraced the attackers’ moves from one IT segment to another and gradually unraveled the whole chain of attack. At each stage, the teams had to use new artifacts from the provided archives and come up with non-standard solutions.

It all began with studying the telemetry. As the scenario progressed, participants had to search for answers on the Internet and social networks, as well as download and research specialized utilities. Other stages involved extracting data from a disk image, reviewing raw logs, reverse engineering and examining scripts left by the attackers.

This was made complicated as the infrastructure was partially deployed in containers, and the target company was running a machine learning model that the teams also had to research.

The segments making up the company infrastructure looked as follows:

The infrastructure had closely integrated services and applications running inside Kubernetes as follows:

• GitLab, Vault, and Harbor
• GitLab and AirFlow
• Kubernetes, Apache Airflow, and the S3 object storage (Simple Storage Service)

We also applied a workable learning pipeline for the ML model. The DMZ, Admin, and Internet segments were not operable for the scenario, but we implemented them to make the virtual infrastructure as close as possible to a real one.

The training began at 12:00 p.m. (UTC+3) on September 10. At that moment, we published the password to the archive with artifacts, which the participants could download in advance.

The teams almost immediately picked their own strategies. Some of them were not very successful, some, on the contrary, laid the foundation for success from the very beginning.

Some teams started by revealing all the hints at once, knowing that they would lose points for this. Others took breaks, expecting to return to the scenario with a clear mind and catch up with the others. As a result, the former would lack points and the latter would lack the time to advance forward.

The teams that had practiced solving scenarios beforehand and understood the mechanics of the platform started to take the lead. These teams would use the hints conservatively while trying to finish all the tasks and get the maximum number of points. Some teams distributed internal resources wisely: as some members unpacked and loaded artifacts into the toolkit, others tried to answer questions that did not require the use of artifacts.

The winning strategies in many ways overlapped with the strategies applied in real-life incident response. One of the response team’s primary tasks is to figure out what happened as quickly as possible: what the attacker has already done, what steps they can take, and how to prevent their further actions. Time and focus play the most important role in this process.