SAFE Cyber 2022 - Exercise report

Authors:

  • Tommy Gustafsson

Publish date: 2023-04-19

Report number: FOI-R--5445--SE

Pages: 48

Written in: Swedish

Keywords:

  • Cyber security exercise
  • Cyber defence exercise
  • CDX
  • TTX
  • Crate
  • National cyber range
  • SAFE Cyber

Abstract

This report describes the cyber security exercise SAFE Cyber 2022, which was executed in the Swedish national cyber range Crate in September 2022. The exercise was a close collaboration between the Swedish Armed Forces and the Swedish Defence Research Agency. SAFE Cyber is an annual cyber security exercise where the Swedish Armed Forces train incident management and reporting with civilian actors. SAFE Cyber 2022 included a combined exercise format with a discussion-based exercise (TTX, Table Top Exercise) for decision makers and a technical cyber defence exercise (CDX, Cyber Defence Exercise) for system administrators, acting on a shared timeline. The exercise was partially executed remotely, with half of the CDX teams participating from another location. The 71 participants were divided into four TTX- and eight CDX-teams, tasked with defending nine interconnected exercise environments. The exercise also included two different red teams, including an automated team. The evaluation indicates that the participants, the client and the project team at FOI were largely satisfied with the exercise. The purpose and learning goals were largely met, but that there is room for improvement. The combined exercise format was complicated, but showed how operational, tactical and strategical capabilities may be trained together. The development and execution of SAFE Cyber 2022 also enhanced Sweden's ability to conduct advanced and large cyber security exercises. The exercise would not have been possible to arrange within budget, without access to the automation features in the cyber range or Crate tools such as SVED or Lore.