Frequently Asked Questions for CSEC 670's Cybersecurity Capstone Simulation
Applicable to All Users
Section A: System Client Hw/Sw Requirements
1. Question: Which Web browsers are compatible with the simulation?
Answer: You must use one of the following browsers.
Internet Explorer 9 or later Firefox 4.0 or later Safari 3.0 or later Google Chrome 15.0 or later
2. Question: Which are the recommended operating systems for the simulation?
Answer: The following operating systems can be used:
Desktop with Windows XP/Vista/7 Desktop with Mac OS X Galaxy Tab with Android version 2.3 The following table provides a summary of additional system requirements:
FAQs for the Simulation_v2 for Students Page 1 of 5
3. Question: Which tablets are compatible with the simulation?
Answer: Below is the list of tablet devices that the Juniper VPN client will officially support, one of which is no longer made, but is still in the wild. The simulation is designed for the lowest form factor, i.e., 1024 x 600, which is the default screen size for the popular Android tablets.
Apple iOS 4+: iPhone 4/4s, iPad 2, new iPad Cisco Cius: Cisco Cius (no alternatives) Google Android: HTC Thunderbolt Generic Google Android with root privileges: (2.3+/Gingerbread) LG Optimus Slider (can be rooted with Gingerbreak.apk) HP: Palm Pre Plus (for O2 in Germany and Vodafone in Europe), Palm Pre 2, HP Pre 3, HP TouchPad, and HP Veer HP webOS 2.0 and 3.0: HP no longer produces the device Nokia: E6 and other device support planned by Nokia (N8, C6-01, C7, and E7) Nokia Symbian Anna: N8-00 (USA GSM unlocked); upgradeable to Belle Samsung: Galaxy S, S II (2.3+/Gingerbread+), Tab (2.3+), Tab 8.9 (3.0/Honeycomb+)
FAQs for the Simulation_v2 for Students Page 2 of 5
Section B: Best Practices
1. Selecting Controls: Simulation objective is to have a balanced approach as it relates to security, profits, downtime, and employee morale. Please note that these indexes are not independent and that one index could affect one or more of the other indexes.
2. Magnitude of Indexes: Please note that not all increases in the value of an index are positive. The Downtime Index and the Disaster Damage Indexes move in the opposite direction of most indexes. The higher the value for the Downtime indexes the worse the condition of your organization. For example, a Downtime index of 120 implies you had 20% more downtime for the round, your customers and employees will be affected and as a result your revenue will decrease.
3. Problem Reporting: When asking a question or reporting a simulation problem it is very important that you provide before and after screen images by using the Windows “Prnt Scrn” key and paste the screen images into a word document. Please explain what you were trying to do.
4. Capital Cost versus Operating costs: The expenses associated with a control have both a capital cost and operating/maintenance costs component. Capital cost is a one-time fee like purchase price of software. Operating/maintenance costs are annual expenses for operating the control. It is better to go with higher capital costs control options in the early rounds (1 & 2) and go with low capital cost control options in the later rounds (3 & 4). Why? Note: every time you change your control options you will incur a capital cost; this implies that changing your control settings can get very expensive.
5. Don’t Over Control: Controls that are too severe will have a negative effect on productivity and employee morale and reduce revenue and profitability.
6. Overdraft: Overdraft is a nice option but must be used with extreme care. As a rule of thumb do not exceed 40% of the overdraft amount. Overdraft is similar to a house under water that is if the overdraft exceeds the allowable amount it will cause the system to lock- up. If this occurs, your team’s simulation may have to start over from the beginning. Lock- up can be caused by the simulator when it recalculates profitability and if it decreases it can reduce the overdraft amount to less than what you have already borrowed or it can be
FAQs for the Simulation_v2 for Students Page 3 of 5
caused by selecting controls whose costs exceed the overdraft amount. To be safe, avoid using the Overdraft option.
7. Selecting Decision Dollars with a Sliding Scale: When in doubt on how much to spend when a control decision has a sliding scale then set the dollar value at the mid-point of the dollar range, you can always increase later if required , for example for the range $5M -> $10M then set the initial value at $7.5M.
8. Revenue & Profitability (Surplus): Don’t over spend just because you have the budget or don’t save the budget just because you can. Bottom line - spend your budget wisely. You will get a new budget every round. What affects future round budgets? Your new budget is a percentage of revenue from the previous round less the operating costs of your controls. Any budget saved from the previous round will indirectly help improve revenue.
Section C: Simulator Bugs
1. Budget Allocation not Updating: When selecting your control settings and hit save, you may notice the “budget remaining” did not change, correct this problem by hitting saves again.
2. Virtualization or Cloud Computing Decisions: The screen for Virtualization or Cloud Computing decisions overlap and displays the wrong options. Below is the intended correct relationship for “Virtualization” control choice and options that apply, and for “Cloud Computing” control choice and options that apply –
3. Saving Rationale for Decisions: The Rationale function has a bug. It will usually record/store the rationale for the first 2 students and then stops working. Recording the rationale is to help you remember why you changed a decision. You can use Word or Note
FAQs for the Simulation_v2 for Students Page 4 of 5
Pad to record your rationale and then paste it into the Rationale field of the simulator. If it does not save it, you will still have your copy for reference.
4. Dash Board Due Date: The Dash Boards Round Due Date is not correct. Currently, the Round Due Date reflects the Start and not the End of the Round. Please check your schedule for the best information on Due Dates.
5. Phishing Attack Event Message Typo: Phishing Attack generated the message below:
"A significant portion of our customer base has been successfully to this type of attack as per our reports."
One can see that this message is very confusing. The typo is the word “successfully” should be “subjected”. The corrected messaged is:
"A significant portion of our customer base has been subjected to this type of attack as per our reports." The message states that as a result of the Phishing attack many customers have been affected.
6. Between Round Message (After the end of the previous round and before the start of the next round): Several students trying to change their decisions between rounds received these two erroneous messages: effects of this event may only be seen at the end of this round, if the event impacts your team. The reports will be viewable after Round 1 is completed These messages are incorrect and should be ignored or considered for information purposes because in this scenario Round 1 is ended but Round 2 has not started.
7. Erroneous Outcome message for RootKit Attacks: You may receive the message - Rootkit Outcome message “Great job, you have successfully mitigated the threat”. This message is poorly worded because the rootkit attack was successful. When in question about the outcome of an event use the table in the Decisions and Events report for the correct information.
FAQs for the Simulation_v2 for Students Page 5 of 5