Cyber Counterintelligence

In recent years, there have been intensifying cyber risks and volumes of cyber incidents prompting a significant shift in the cyber threat landscape. Both nation-state and non-state actors are increasingly resolute and innovative in their techniques and operations globally. These intensifying cyber risks and incidents suggest that cyber capability is inversely proportional to cyber risks, threats and attacks. Therefore, this confirms an emergent and critical need to adopt and invest in intelligence strategies, predominantly cyber counterintelligence (CCI), which is a multi-disciplinary and proactive measure to mitigate risks and counter cyber threats and cyber-attacks. Concurrent with the adoption of CCI is an appreciation that requisite job roles must be defined and developed. Notwithstanding the traction that CCI is gaining, we found no work on a clear categorisation for the CCI job roles in the academic or industry literature surveyed. Furthermore, from a cybersecurity perspective, it is unclear which job roles constitute the CCI field. This paper stems from and expands on the authors’ prior research on developing a CCI Competence Framework. The proposed CCI Competence Framework consists of four critical elements deemed essential for CCI workforce development. In order of progression, the Framework’s elements are: CCI Dimensions (passive-defensive, active-defensive, passive-offensive, active-offensive), CCI Functional Areas (detection, deterrence, deception, neutralisation), CCI Job Roles (associated with each respective Functional Area), and Tasks and Competences (allocated to each job role). Pivoting on prior research on CCI Dimensions and CCI Functional Areas, this paper advances a proposition on associated Job Roles in a manner that is both intelligible and categorised. To this end, the paper advances a five-step process that evaluates and examines Counterintelligence and Cybersecurity Job Roles and functions to derive a combination of new or existing Job Roles required for the CCI workforce/professionals. Although there are several cybersecurity frameworks for workforce development, establishing the CCI Job Roles is specifically based on the expression of the Job Roles defined in the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework.

Section: Introductionmentioning

confidence: 55%

Section: Identifying Job Roles For the CCI Competence Frameworkmentioning

confidence: 65%

A Cyber Counterintelligence Competence Framework: Developing the Job Roles

Sithole

Toit²,

Solms³

2023

“…In fact, "mature offensive cyber capability" includes "intelligence collection and analysis" (Devanny, Goldoni and Medeiros, 2022), as well as cyber counterintelligence (CCI). The latter in turn includes substantial defensive facets (Duvenage, 2019). Cavelty (2018) rightly points out that the Global North's discourse was until very recently all about the offensive domination of one actor over others-be it through hard and/or soft power.…”

Section: 'Offensive' Dimensionmentioning

confidence: 99%

Cyber power in the African context: an exploratory analysis and proposition

Duvenage

Bernhardt

Solms

2023

While the centrality of cyber power in the safeguarding and advancing nation states’ national interests and objectives is now widely accepted, the academic discourse (on cyber power) is still incipient. In literature reviewed, cyber power is predominantly viewed as comprising of two dimensions, namely offensive and defensive. The exploratory analysis we conducted found that Africa’s unique, contextual factors necessitate an expanded conceptualisation of cyber power. This alternative conceptualisation does not dispute the existing notion that cyber power has offensive and defensive dimensions. The fact that cyber is by its very nature borderless and that African countries function in an interconnected global arena of competition and conflict, are also not contested. What is required is the addition of a third dimension to cyber power, namely developmental power. This paper advances a tentative proposition on a cyber-power triad (with offensive, defensive and developmental dimensions). This proposition, we argue, is more apposite to African countries’ national objectives —strategically and in the allocation of resources. At least on a notional level, the cyber-power triad can guide the leveraging of the asymmetric advantages that cyber space offers African nation states and in a manner that pursues all three (cyber power) dimensions in a complementary manner. Such synergetic wielding of cyber power is one of the keys indispensable to African countries addressing their substantial challenges and unlocking their vast potential.

“…As illustrated in Figure 1 below, by dotted lines on the active-defensive quadrant, the ACD falls on the activedefensive quadrant of the cyber counterintelligence (CCI) model (Ntingi, Duvenage, du Toit & von Solms, 2022). Even though the tools and techniques used to conduct activities of active cyber offence and active cyber defence are the same, active cyber defence aims to strengthen the cyber defences of an organisation rather than intrusive actions towards the adversaries (Duvenage, Jaquire & von Solms., 2020a;Ntingi, et al, 2022). Our focus is on the cybersecurity operations of organisations, particularly SMMEs, to strengthen their cyber defences and actively defend their ICT systems without resorting to intrusive actions against adversaries.…”

Section: Conceptualisation Of 'Active Cyber Defence'mentioning

confidence: 99%

“…According to Burke (2020), the United Kingdom (UK) and the United States of America (USA) are among the countries that incorporate defensive AI technologies into their cybersecurity strategies. Duvenage, Jaquire & von Solms (2020b) state that the convergence of emerging technologies such as AI, the Internet of Things, Big Data, and social media is important in strengthening efforts to cybersecurity defences. Furthermore, Duvenage, et al, (2020b) also alludes that these technologies are not only useful for large organisations and nation-states but also for smaller organisations with limited resources.…”

Section: Optimisation Of Acd Using Artificial Intelligence (Ai)mentioning

confidence: 99%

Towards an active cyber defence framework for SMMEs in developing countries

Ntingi¹,

Solms²,

Toit³

2023

Small, medium, and micro enterprises (SMMEs) are obliged to adopt digital technologies to render services to their clients and remain competitive. The COVID-19 global crisis has accelerated the cyberfication of systems and services. The move to digital platforms has afforded SMMEs opportunities to offer their services to a broader geographical area. However, this has also presented opportunities for cybercriminals to invade the digital infrastructure. Adopting digital transformation has put SMMEs in a vulnerable position since they need to manage their cybersecurity while lacking the necessary skills and ICT infrastructure. The inability of SMMEs to defend themselves against cyberattacks compels them to outsource their security needs to external security service providers. These external security service providers offer security services based on a hierarchical operating model. Essential security services are offered at a lower level. If the paying clients require advanced security services, they may be provided as an add-on to the contractual agreement resulting in additional cost. This paper explores the active cyber defence (ACD) approach to enhance cybersecurity defence while minimising service costs. Therefore, the primary objective and outcome of this paper are to identify some of the essential drivers that will contribute towards developing the active cyber defence framework for SMMEs in developing countries. For purposes of clarity, essential drivers are the gaps highlighted during the literature review and will be referred to as “essential drivers” throughout the paper. The essential drivers, together with suggested recommendations, will be consolidated. The essential drivers were drawn from existing literature by going through peer-reviewed academic papers and company whitepapers. To achieve the primary objective, we need to establish whether SMMEs are utilising the services of external security service providers. The external security service providers will be referred to as “Security Operation Centre - SOC as a service” throughout the paper. The secondary objective of this paper is to determine whether SMMEs are utilising the SOC as a service and if they do, whether they realise value for money.