US testing its cyber-defences

The United States is launching its first test of a new plan for responding to an enemy cyber-blitz, including any attack aimed at vital services such as power, water and banks.

Thousands of cyber-security personnel from across the government and industry are to take part in the Department of Homeland Security's Cyber Storm III, a three- to four-day drill starting today.

The goals are to boost preparedness; examine incident response and enhance information-sharing among federal, state, international and private-sector partners.

"At its core, the exercise is about resiliency - testing the nation's ability to cope with the loss or damage to basic aspects of modern life," said a release made available at DHS's National Cybersecurity and Communications Integration Center in Arlington.

The simulation tests the newly developed National Cyber Incident Response Plan, a coordinated framework ordered by President Barack Obama.

The plan is designed to be flexible and adaptable enough to mesh responders' efforts across jurisdictional lines. Refinements may be made after the exercise, DHS officials said.

The test involves 11 states, 12 foreign countries 60 private companies.

Six cabinet-level departments are taking part beside Homeland Security: Defense, Commerce, Energy, Justice, Treasury and Transportation, as well as representatives from the intelligence and law-enforcement worlds.

Cyber Storm III takes place amid mounting signs that bits and bytes of malicious computer code could soon be as central to 21st-century conflict as bullets and bombs.

"There is a real probability that in the future, this country will get hit with a destructive attack and we need to be ready for it," US Army General Keith Alexander, the head of a new military cyber-warfare unit, told reporters last week, referring to computer-launched operations.

Cyber Storm III involves simulated harm only, not real impact on any network, said Brett Lambo, the exercise director.

In the drill, mock foes hijack web security infrastructure used by businesses, government and consumers to verify and authenticate online transactions.

In so doing, they upend Internet reliability and relationships before launching major attacks against the government, certain critical infrastructure, public sector enterprises and international counterparts.

Officials did not spell out the scenario's details to preserve the surprise of exercise play.

Among the industry sectors currently represented at the 24-hour watch and warning hub are information technology, communications, energy and banking and finance, said Sean McGurk, the DHS official who directs the hub inaugurated last October.

Other participants take part from the locations where they would normally respond to a cyber-attack. The foreign "players" are from Australia, Britain, Canada, France, Germany, Hungary, Japan, Italy, the Netherlands, New Zealand, Sweden and Switzerland.