Decision Support for Mission-Centric Cyber Defence

Abstract

In this paper, we propose a novel approach to enterprise mission modeling and mission-centric decision support for cybersecurity operations. The goal of the decision support analytical process is to suggest an effective response for an ongoing attack endangering established mission security requirements. First, we propose an enterprise mission decomposition model to represent the requirements of the missions' processes and components on their confidentiality, integrity, availability. The model is illustrated in a real-world scenario of a medical information system. Second, we propose an analytical process that calculates mission resilience metrics using the attack graphs and Bayesian network reasoning. The process is designed to help cybersecurity operations teams in understanding the complexity of a situation and decision making concerning requirements on enterprise missions.As the IT infrastructures grow larger, it is more and more complicated to protect them and all their components. The insufficient workforce in cyber security and the risks of misunderstanding between security operations and management further underline the problem. The security teams are not always aware of all the missions in an organization, nor knowing about missions' priorities. Under such circumstances, the risk of unwanted actions rises. For example, dropping network traffic of an infected system interrupts operations of a critical IT system or one of its dependencies, which ARES '

Mission‐centric decision support in cybersecurity via Bayesian Privilege Attack Graph

“…We were inspired by these works in the creation of our own mission decomposition model presented in our earlier paper. 4 The model used in our work uses the AND/OR notation and is based on the constraint satisfaction problem. 17,20,24,25 The difference between our approach and the related work is that we do not consider mission capacity; functional requirements, that is, constraints, are a binary matter.…”

“…Having multiple satisfying configurations is a natural outcome of avoiding a single point of failure in critical systems. 4 The alternative mission configurations are derived from the AND/OR relations between the mission and its dependencies. 20 Second, the mission-supportive processes are regarded as critical assets to be protected.…”

“…The cybersecurity experts need to come to an understanding with the organization's management and users and administrators of critical IT infrastructure. 4 In our work, we assume two prerequisites. First, the organization operating an IT infrastructure has its mission or business objectives, which put functional requirements on the IT infrastructure.…”

“…To resolve the outlined issues, we propose a mission-centric decision support system for cybersecurity operations that also facilitates understanding between the cybersecurity experts and other stakeholders. We use a mission decomposition model from our previous work 4 that represents the enterprise mission, its supporting IT services, and their components, thus enumerating the services the organization depends on and stating the objectives that must be achieved despite the presence of threats. 5 Moreover, the mission's security requirements are included, representing the impact of a successful compromise or disruption in terms of loss of confidentiality, integrity, and availability (CIA).…”

“…5 Moreover, the mission's security requirements are included, representing the impact of a successful compromise or disruption in terms of loss of confidentiality, integrity, and availability (CIA). 4 The decision support system also relies on cybersecurity state assessment processes that enrich the mission decomposition model with the information on vulnerabilities found in the network and enumerate the hosts and services that are or are suspected to be under the control of an attacker. Common tools, such as vulnerability scanners and intrusion detection systems, can be used for this purpose, and our proposed approach is independent of the tools in use.…”