Cyber Fire Simulation gives participants a full week to work with
data from a historical event,
with veteran investigator assistance.
This is not an event to learn a new skill,
but rather sharpen existing skills working with real data.
Participants act in one of four groups:
Attendees start with an initial indicator and a piece of
evidence, and work as a single team to respond to the incident.
The incident response team is expected to process
hard drive images,
and windows registry.
During daily executive management briefings,
Simulation participants provide:
Event staff serve as mock IT, distributing collected evidence
when asked, mock counterintelligence, sharing indicators to keep the group
progressing, and as general computer security experts giving other tips and
tricks as needed.