The Department of Defense Information Network–Army (DODIN-A) is one of the largest and most complex networks in the world, and commanders are struggling to determine the effectiveness of their defensive posture as threat actors constantly attack the unclassified and classified networks. To gain a shared understanding of threats across its Defensive Cyber Operations–Internal Defensive Measures (DCO-IDM) and the cybersecurity community, the Army must establish a catalog of known and unknown threat techniques. This catalog would provide a list of analyzed threat techniques and potential mitigation actions so that Army forces spend less time reacting to the results of exploitations and more time defeating malicious actors. The catalog would also provide the foundation to support persistent penetration testing to provide a mechanism to find overlooked weaknesses, and to train analysts with real-world vulnerabilities. With this methodology in place, an Attack-Based Defense would establish an objective and quantifiable way to assess the effectiveness of cyber forces, inform commanders on how to employ cyber forces, provide business metrics for where cyber forces can improve, and ensure a common incident response across the enterprise.
FULL ARTICLE HERE