Details: A Scenarios Played Out In The Financial Services ISAC Tabletop Exercise In April

For security simulations

By Deborah Radcliff

October 01, 2004 — CSO — May 18, 8:10 a.m.

While putting together a materials order, one of Company A's lead hardware developers discovers that several prototype chips are missing, including an advanced AES decryption prototype, several integrated circuits that Company A was developing for medical equipment and some ASICs. No one seems to know who had the chips last or where they could be. One of the other hardware engineers in that department seems to remember seeing them in the lab last week. The lead engineer would like to do a little more searching to see if they were taken to another lab.

May 18, 9:10 a.m.

The hardware developer confirms that the chips are missing.

May 20, 10:00 a.m.

Network administrators at Company A are noticing some odd traffic patterns. Over the last 24 hours, traffic has occasionally jumped up 20 percent to 25 percent for 20 to 30 seconds. The traffic is coming from a variety of internal sources and is not affecting overall throughput or network availability. Most of the traffic appears to be taking place on internal segments only.

May 21, 10:00 a.m.

Several areas of the Company A headquarters have not been cleaned for the last couple of days. When the Company A facilities manager calls the cleaning company to discuss the issue, he is told that several of the employees responsible for cleaning that building quit two days ago. The cleaning company has hired additional personnel and will clean the entire building tonight.

May 21, 3:23 p.m.

During a standard review of the week's closed-circuit television security tapes, security guards notice what appears to be an employee escorting an unknown individual into the building several nights in a row. The pair always enters through a side door, proceeds up two flights of stairs, then disappears somewhere in the building. The employee is seen a few minutes later in a different stairway alone. Approximately two hours later, the employee returns and escorts the guest down the stairs and back out the side door.

SOURCE: Center for Infrastructure Assurance and Security at the University of Texas at San Antonio