Cyber Monitoring & Operations Internship

  On Thursday we traveled to West Virginia to take part in the Foreign Affairs Counter Threat course (FACT). The FACT course is made to provide general information and training to austere and high threat environments. We covered moving out of a burning building safely in the case that fire is being used as a weapon, observed general risks, how to react to directed gunfire/explosives, and medical training.    In the case of a burning building everybody needs to get low to avoid the heat and smoke. Then they need to remain in contact as they proceed to the nearest exit. While doing so they should keep in contact with one of the walls and communicate with each other. I have personally had to escape a burning building and I found the training to be very appropriate.     The general self-defensive was interesting as it was a course for any and everybody, even elderly or physically impaired or political officials who are not intended to participate in combat...

   On Wednesday we covered prioritization. What is the most important thing to respond to first? How do we determine what is and what isn't more important? How do we assess the risk being taken? How much risk is too much risk? While some matters may be more general, a lot of prioritization will be based upon what the establishment is doing, who would target them, what resources does the establishment have for defense, etc. The effectiveness of cyber response teams is determined by how appropriate the prioritization of incidents is. Randomly responding and less formalized response protocols/orders (e.g. stacks/LIFO or queues/FIFO) will hinder the potential security capabilities of an establishment. One cannot prioritize for random or abstract orders and expect any type of long-term success. It is best to make decision making and risk taking as formalized as possible. What you do is just as important as what you do first. Basically, some things are more important to attend to ri...

     A lot of my first day had to do with forms so there isn't much to discuss. On the second day I learned about responding to cyber incidents. I realized just how important formal procedures are for cyber security. Any business or establishment who needs active cyber security employees needs to develop a response protocol. This will help to streamline cyber response, monitor employees’ actions, and avoid analysis paralysis. The next advancement would be to formalize a way of developing and later documenting protocol for new and or unique incident types. This will help develop versatility and to expand the utility of the formalized security protocol. Then of course a council or arbiter could decide upon what to do and may change protocol in the future to fit new contexts. This protocol should also extend to any personnel who works with the cyber incident response team. The tactics, software, and hardware need to synergize together.       My interest ...