A framework to evaluate cyber agility

Abstract

In this paper, we propose a framework to help evaluate the cost and utility of cyber agility maneuvers within networks that have constrained resources such as bandwidth and energy (e.g., MANETs). Many new methods of cyber agility and defensive maneuvers have been proposed; however, a framework to evaluate cost and utility of these maneuvers in the context of mission success is lacking. We outline preliminary considerations such as mission goals, operating conditions and maneuvers to be evaluated. Then, we introduce notional measures of health, security and capability and their interrelationship resulting in an initial framework design. A simple defensive cyber operation of securing a critical communication path for some time duration, both with and without the presence of a detected infection, is provided to illustrate the framework components and mission considerations that must be made before selecting a sequence of maneuvers.

Metrics Towards Measuring Cyber Agility

“…, T . triangle area as security gain in [2,3] triangle area as security loss in [5,6] 3) Aggregated-Generational-Impact (AGI): This metric aims to measure the overall security gained by the defender over time horizon [0, T ]. We propose measuring the security gain over time interval [t i−1 , t i ], denoted by G s (i), for i = 1, .…”

“…In the cybersecurity domain, agility often refers to reasoned changes to a system or environment in response to functional or security needs, but has not been paid due attention until very recently [15], [1], [2], [3], [4], [5]. While it would be intuitive to understand agility as how fast (e.g., response ability [23]) and how effective a system can adapt its configuration to unexpected attacks against it (e.g., considering the cost incurred by the degraded system performance or the cost incurred by response actions [1], [24]), the concept of agility is, like other metrics, elusive to formalize.…”

“…While it would be intuitive to understand agility as how fast (e.g., response ability [23]) and how effective a system can adapt its configuration to unexpected attacks against it (e.g., considering the cost incurred by the degraded system performance or the cost incurred by response actions [1], [24]), the concept of agility is, like other metrics, elusive to formalize. Indeed, there is no rigorous or quantitative definition of agility in the cybersecurity domain and existing attempts to model agility have not been able to produce concrete measurements [2], [25], [26]. Despite the apparent importance, systematic and quantitative agility metrics have not been studied and understood in-depth.…”

“…We call this problem measuring cyber agility. Cyber agility and its quantification have recently been recognized as critical cybersecurity issues that are little understood [1], [2], [3], [4], [5].…”

Identifying Key Cyber-Physical Terrain

“…Marvel et al propose a framework to evaluate cyber agility, but they focus on scenarios in which either a specific vulnerability or infected node is known to exist, and attempt to optimize the patching and isolation process in the network to preserve network integrity under various constraints including connectivity and power usage [8]. Huber et al examine a similar problem using a decision support system in a small network of 10 active nodes [5].…”