March 23, 2020

Noisy Operations on the Silent Battlefield Preparing for adversary use of unintrusive precision cyber weapons

Cyber weapons can be divided into intrusive and unintrusive capabilities. Intrusive attacks, which require first gaining privileged access, have earned notoriety in the popular media. However, unintrusive attacks, which can be “noisy” but do not require privileged access, offer a potential cyber adversary many benefits. Using attack methods such as denial of service and telephony denial of service, and energy depletion attacks such as denial of sleep, an adversary can achieve demonstrable effects against a range of targets. These effects can be achieved while reducing the costly burden of pre-attack intelligence-gathering and pre-positioning of exploits that could signal intent or constitute a hostile act. The growth of the Internet of Things in national civilian and defense sectors has resulted in an expanded cyber-attack surface and increased the vulnerability of critical systems to certain unintrusive attacks. In this paper, we define, characterize, and present examples of unintrusive precision cyber weapons used in real-world operations. Given the high likelihood of encountering adversary employment of electronic warfare-like unintrusive capabilities, analyses of cyber conflict and friendly cyber security measures designed to defend against them should be predicated on scenarios that include their employment. Therefore, taking lessons from electronic protection doctrine, we advocate for preparation against the use of unintrusive precision cyber weapons through improved acquisition, training, and integration.

March 23, 2020

A Quest for Indicators of Security Debt

Security Debt (SD) manifests itself every day: In the media, we can witness stories about debt defaults: significant data leaks, disruptions of service, and businesses of global companies affected by security incidents. Critical infrastructure customers need more practical tools to ensure that the SD is properly identified in order to make informed risk decisions. Existing tools like security audits and cross-referencing system configuration with available vulnerability information do reveal a lot of data regarding the present state of the system. Many tools that can bring up the hidden security issues like ones included in Secure Development Lifecycles (SDLC) are tuned for the product creation. Some of them can be taken into good use by the customer, but for that, the system should be already procured and in place. In practice, the customer would benefit from a comprehensive and realistic view of the security stance of the system when it is being procured to minimize the nasty surprises the underlying security issues are prone to bring.

March 23, 2020

Wargaming and the Education Gap: Why CyberWar: 2025 Was Created

Wargames have been an integral part of planning operations since the 19th Century. They are designed to teach and educate players on specific learning objectives using real-life problem sets to advance knowledge and understanding of those problems. With the increased focus on cyberspace operations in the past decade, wargaming is the key to teach cyber-based operations and prepare for the future. CyberWar: 2025 is an innovative and newly designed interactive wargame that brings together cyber practitioners, policy writers, and decision-makers to gain experience and understanding through iterative gameplay within a virtual environment.

Dec. 9, 2019

Combining Recurrence Quantification Analysis and Adaptive Clustering to Detect DDoS Attacks

The high number of Distributed Denial of Service (DDoS) attacks executed against a lot of nations has demanded innovative solutions to guarantee reliability and availability of internet services in cyberspace. In this sense, different methods have been used to analyze network traffic for denial of service attacks, such as statistical analysis, data mining, machine learning, and others. However, few of them explore hidden recurrence patterns in nonlinear network traffic and none of them explore it together with Adaptive Clustering. This work proposes a new method, called DDoSbyRQA, which uses the Recurrence Quantification Analysis (RQA) based on the extraction of network traffic dynamic features and combination with an Adaptive Clustering algorithm (A-Kmeans) to detect DDoS attacks. The experiments, which were performed using the Center for Applied Internet Data Analysis (CAIDA) and University of California, Los Angeles (UCLA), databases, have demonstrated the ability of the method in real-time.

Dec. 9, 2019

The Calculus of Protecting Interstate Competition from Cyberattack

Lethal conflict may be approximated using power law statistics which, on a log-log plot of exceedance probability (EP) versus severity, is characterized by constant slope -q. Values of q1 and allows for the use of Bayesian hypothesis tests based on q to serve as a decision criterion about when to react to threats, leading to a set of parameters that determine whether conflict will escalate and to the conclusion that redundant networks, deterrence, and attack detection stabilize competition against cyber conflict. Examples of the importance of the Bayesian parameters in creating and adapting networks to stabilize competition are provided.

Dec. 9, 2019

Critical Infrastructure Protection at the Local Level Water and Wastewater Treatment Facilities

The increasing number of Industrial Control System (ICS) vulnerabilities, coupled with continuing revelations about ICS compromises, emphasizes the importance of securing critical infrastructure (CI) against cyber threats[1],[2]. The ability to adversely affect the operation of an ICS through cyberspace is exacerbated by the increasing use of automation and implementation of common routing protocols to communicate with control devices [3]. Local water treatment facilities are particularly vulnerable to this attack vector due to the need to manage key functions with minimal staff. Reacting to specific cyber risks without developing a holistic method for managing risk provides only a modicum of protection. This monograph demonstrates how focusing on risk management as a mitigation strategy – not individual risks – maximizes the security efforts at the local level.

Dec. 9, 2019

Applied computational social choice theory as a framework for new cyber threats

Social media and “big data” have combined to create a new era of marketing, political campaigning, and hostile propaganda. The tactics, such as microtargeting of ads, have recently received intense public scrutiny. However, little has been publicly said about the tools and techniques of strategy. In this context, Applied Computational Choice (ACSC) refers to a framework for analyzing data, modeling tactics, and planning strategy. Here we describe an ACSC framework derived from the work being done by some of the main actors and apply it to show how a few simple scenarios can be modeled and realistic behaviors predicted, as well as illuminate possible motivations for certain patterns observed in the real world. We introduce the concept of vulnerability assessment applied to voting systems by analyzing the cost of influence operations on simple model voting systems. We believe this framework reflects those being used by a number of different actors with goals and hope that this article helps to provide an overview and introduction to the field.

Dec. 9, 2019

Predicting enterprise cyber incidents using social network analysis on dark web hacker forums

With the rise in security breaches over the past few years, there has been an increasing need to mine insights from social media platforms to raise alerts of possible attacks in an attempt to defend conflict during competition. We use information from dark web forums by leveraging the reply network structure of user interactions with the goal of predicting enterprise cyberattacks. We use a suite of social network features on top of supervised learning models and validate them using a binary classification problem that attempts to predict whether there would be an attack on any given day for an organization. We conclude from our experiments, which gathered information from 53 forums on the dark web over a span of 12 months and attempted to predict real-world cyberattacks across 2 security incidents, that analyzing the path structure between groups of users is better than merely studying centralities like Pagerank or relying on user-posting statistics in forums.

Dec. 9, 2019

Cyber Acquisition Policy Changes to Drive Innovation in Response to Accelerating Threats in Cyberspace

The United States of America faces great risk in the cyber domain because our adversaries are growing bolder, increasing in number, improving their capabilities, and doing so rapidly. Meanwhile, the associated technologies are evolving so quickly that progress toward hardening and securing this domain is ephemeral, as systems reach obsolescence in just a few years and revolutionary paradigm shifts, such as cloud computing and ubiquitous mobile devices, can pull the rug out from the best-laid defensive planning by introducing entirely new regimes of operations. Contemplating these facts in the context of Department of Defense (DoD) acquisitions is particularly sobering because many cyber capabilities bought within the traditional acquisition framework may be of limited usefulness by the time that they are delivered to the warfighter. Thus, it is a strategic imperative to improve DoD acquisitions pertaining to cyber capabilities. This paper proposes novel ideas and a framework for addressing these challenges.

Dec. 9, 2019

United by Necessity: Conditions for Institutional Cooperation against Cybercrime

Cybercrime continues to grow despite ongoing remediation efforts at the state and international level. The ease of access to commit cybercriminal activity beyond one’s borders makes this an international issue. Examining the cooperative schemes utilized in intergovernmental institutions such as the European Union (EU) Agency for Law Enforcement and Cooperation (Europol) illuminates possible conditions that encourage states to cooperate to fight cybercrime. Testing these conditions shows that the preexistence of an institution in a related issue area serves as the strongest driver of cooperation within an international institution against cybercrime.