The NCI Agency's Team (Cyber Security and Education & Training Service Lines and the Legal Office) provided an important contribution to the success of the biggest Cyber Defence exercise NATO has ever held. The Cyber Coalition 2017 (CC17) exercise was conducted 28-30 November, with more than 900 participants from 29 nations and the EU. The aim of the exercise was to train collaboration and information sharing between NATO, nations and partners in response to cyber threats. The Exercise Objectives were set by NATO's Military Committee. The planning, preparation and execution of CC17 were orchestrated by Exercise Director LTC (OF4) Andres Kuusk from Allied Command Transformation (ACT).
This was the 10th edition of Cyber Coalition. The Agency has been involved in the exercises from the beginning, both as part of the Core Planning Team organising the exercise and as part of the Training Audience. "The NCI Agency has consistently provided strong and welcome support from the very outset, at Cyber Coalition 2008", said ACT's Exercise director LTC Kuusk, "The Agency's drive, determination and performance have continued to excel, becoming a critical success factor for all our events. The NCI Agency team is the corporate memory of Cyber Coalition".
During the execution of CC17, the Exercise Control (EXCON) organisation was located in Tartu (Estonia), while the Training Audiences were located at their own home bases in more than 60 locations throughout Europe and North America. The agency's Training Audience consisted of a team from the NCI Agency Cyber Security Centre (NCSC) at SHAPE, LEGAD support and a NATO Rapid Response Team (RRT) deployed to MARCOM, augmented with a RRT from Denmark. Alan Sewell, the leader for the RRT Storyline, commented: "Our objectives were to provide a realistic opportunity for a validation of the RRT's ability to deploy effectively and tackle technical challenges with a Mission Assurance focus, to trial working as a joint RRT for the first time, and to create military cyber-issues that would provide challenges for ACO's Task Force Cyber. The Storyline team was highly successful in these objectives".
Friso Meijer (Agency Cyber Security Service Line) acted as the EXCON for NCSC and coordinated the Agency's support to the exercise. He declared: "The number of simulated cyber incidents happening concurrently at multiple NATO sites and at the participating Nations put a lot of pressure on NCSC. I am very proud of how the NCSC training audience handled this in collaboration with the other exercise participants".
The exercise used an unclassified network environment - hosted on the NATO Cyber-Range - to simulate coordinated cyber-attacks against NATO, NATO Nations and partners, including the EU. As the exercise technical lead, Nick Virvilis (Agency Cyber Security Service Line) – who also coordinated all storylines simulated on the cyber range for the last years – explained: "The cyber range allows us to create a realistic environment in which nations can be trained on multiple technical aspects including incident handling, malware analysis, network and computer forensics. The cyber range storylines promote collaboration and information exchange between players, at the very technical levels up to the operational strategic level".
Representatives of the Cyber Defence Committee, ACO, ACT and NATO Coooperative Cyber Defence Center of Excellence took part in an EXCON site tour and attended a dinner, where NCI Agency staff members were awarded by RADM Çelebi (ACT ACOS C2DS) on behalf of SACT for their excellent support to NATO's flagship cyber exercise.
LTC Kuusk concluded: "It has been a real pleasure to work with the NCI Agency's talented and dedicated professionals whose expertise underpins the technical, analytical, and many managerial aspects of this highly regarded series of exercises. Together with NCI Agency we have managed to continuously improve the content and quality of the exercise and I am looking forward to continued close cooperation with our Agency team continuing in the years ahead."