Abstract

Most military exercises rely on a document that lays the foundation for the entire event: the Master Scenario Event List (MSEL). Over the past two years, we’ve delivered 54 collective training events (cyber exercises) to 15 different military units. What we’ve found, is that the MSEL is nearly worthless. Far too much time goes in to meticulously planning out every hour of the proposed exercise timeline. Far too much scrutiny goes into injects and expected reactions. We’ve discovered that the fog of war is true, maybe more so in the cyberspace terrain. That is, once the exercise begins, it’s nearly impossible to predict what will happen and at what time. Recently, we’ve been delivering cyber exercises to U.S. Army Cyber Protection Teams (CPT), with no MSEL. The results have been amazing. The exercises are more realistic, more immersive, and deliver far more value, than those with a strict MSEL. The exercises are typically 40 hours long. The CPT goes through all of its normal procedures: Mission Planning, Survey Phase, Protect Phase, and Secure Phase. But rather than spend time prior to STARTEX deciding what might happen, we decide real-time, while the exercise is underway. That doesn’t mean that we don’t prepare for the exercise. We have a rigorous preparation process and rehearse for all types of directions that the exercises might go in. This allows us to be ready for anything, once the war kicks off. As the CPT moves through the exercise, we respond in an agile manner: altering attacks, injecting new characters, updating artifacts, etc. Finally, why does this matter? The DoD is currently fielding 133 Cyber Protection Teams that are required to conduct several collective training events per year. This adds up to hundreds of thousands of hours of training. How those cyber units train impacts our nation’s security. We believe our “No MSEL” model is immersive and realistic, delivering top notch training value to these cyber units. This paper will explain the pitfalls of a MSEL, our adaptive training model, present two case studies, analyze survey data collected from soldiers, and discuss our ongoing improvements.