engleski

Review of National and International Cybersecurity Exercises Conducted in 2019

Various organisations try to increase their security by developing policies and procedures that specify what should be done in case of security incidents. However, without appropriate testing of those policies and procedures, it is difficult to know how well they are planned and how well the participants execute them. An effective and frequently used means to achieve this goal is organizing or participating in cybersecurity exercises. Numerous cybersecurity exercises were conducted over the past years, with some taking place periodically. The organisations taking part in cybersecurity exercises come from a variety of sectors as well as geographic locations. Furthermore, cybersecurity exercises differ in various parameters: how they are organised, who their participants are, or how large they are. While generic guidelines on how to organise cybersecurity exercises exist, to the authors’ knowledge, there are still no publicly available reviews and databases with categorised data on the current state-of-the-art regarding cybersecurity exercises. To fill in this gap, we collected publicly available data on cybersecurity exercises conducted in 2019. The search was limited by a language barrier, as the authors could only review the sources written in English. We managed to collect data for 16 exercises. Each exercise was then analysed, and key data was then defined and extracted. Therefore we proposed a cybersecurity exercise categorisation and classified each exercise accordingly. Additionally, we define a cybersecurity exercise maturity level and assign each exercise with a level based on our findings. We discuss correlations between the cybersecurity exercises’ features, research problems, as well as the best practices of conducting those exercises. Furthermore, we store the collected and categorised information on these exercises into a publicly-accessible online database that can be queried and contributed to. Our objective is to provide an extensive review of the current state-of-the-art cybersecurity exercises that are conducted around the world.

cybersecurity, cybersecurity exercises, categorisation, systematic review, maturity level

nije evidentirano