Computer network defense

1. A system for training IT professionals in defense of a computer network, the system comprising:

a communications subsystem between a first computer, a second computer, and a third computer;

the first computer comprising an enterprise asset subsystem to be defended by the IT professionals,

operable to run a plurality of enterprise asset programs,

wherein the enterprise asset subsystem is to be defended in a state that is known to not be compromised;

the second computer comprising an exploitation asset subsystem,

in communication with the enterprise asset subsystem through the communications subsystem, and

operable to launch a plurality of exploits against the enterprise asset subsystem; and

the third computer comprising a neutral subsystem:

in communication with the enterprise asset subsystem through the communications subsystem, and

operable to:

set up and run at least one exercise scenario for at least one of the plurality of exploits against the enterprise asset subsystem, and

assign a score to the IT professionals based on their performance in defending the enterprise asset subsystem.

2. The system of claim 1 wherein:

the communications subsystem further comprises the Internet between the enterprise assets and at least one of the neutral assets and the exploitation assets.

3. The system of claim 1 wherein:

each subsystem is isolated from external networks.

4. The system of claim 1 wherein:

scenarios are repeatable.

5. The system of claim 1 wherein:

exercises are run in real time.

6. The system of claim 1 wherein the communications subsystem further comprises:

communication through a local area network (LAN) attack gateway of the exploitation subsystem to a switch of the enterprise asset subsystem.

7. The system of claim 1 wherein the communications subsystem further comprises:

a scoring data collection path from the neutral subsystem to at least one of:

the external interface of an enterprise asset firewall,

the internal interface of an enterprise asset router,

and a DMZ host.

8. The system of claim 1 wherein the enterprise asset subsystem further comprises means for performing a plurality of the following:

identifying vulnerabilities, locking down systems, configuring router policies, and configuring and monitoring intruder detection systems.

9. The system of claim 1 wherein:

communication between enterprise assets and neutral assets comprises trouble tickets completed by enterprise asset users and trouble ticket responses completed by neutral asset users.