CNA Tactics and Techniques: A Structure Proposal

Abstract

Destructive and control operations are today a major threat for cyber physical systems. These operations, known as Computer Network Attack (CNA), and usually linked to state-sponsored actors, are much less analyzed than Computer Network Exploitation activities (CNE), those related to intelligence gathering. While in CNE operations the main tactics and techniques are defined and well structured, in CNA there is a lack of such consensuated approaches. This situation hinders the modeling of threat actors, which prevents an accurate definition of control to identify and to neutralize malicious activities. In this paper, we propose the first global approach for CNA operations that can be used to map real-world activities. The proposal significantly reduces the amount of effort need to identify, analyze, and neutralize advanced threat actors targeting cyber physical systems. It follows a logical structure that can be easy to expand and adapt.

Special Issue “Security Threats and Countermeasures in Cyber-Physical Systems”

“…Six papers have been selected in this special issue that covers the secure design [1], emerging threats [2], counter measures [3,4], operation [5], and forensic investigation [6] methodologies of CPS and IoT systems.…”

“…The review study "Computer Network Attack (CNA) Tactics and Techniques: A Structure Proposal" by the team of researchers from Spanish university studies destructive and control operations, which are a major threat for CPS [1]. In this article, the authors propose the first global approach for CNA operations that can be used to map real-world activities.…”