Global adversarial capability modeling

Abstract

Intro: Computer network defense has models for attacks and incidents comprised of multiple attacks after the fact. However, we lack an evidence-based model the likelihood and intensity of attacks and incidents.Purpose: We propose a model of global capability advancement, the adversarial capability chain (ACC), to fit this need. The model enables cyber risk analysis to better understand the costs for an adversary to attack a system, which directly influences the cost to defend it. Method: The model is based on four historical studies of adversarial capabilities: capability to exploit Windows XP, to exploit the Android API, to exploit Apache, and to administer compromised industrial control systems.Result: We propose the ACC with five phases: Discovery, Validation, Escalation, Democratization, and Ubiquity. We use the four case studies as examples as to how the ACC can be applied and used to predict attack likelihood and intensity.

Review of Human Decision-making during Computer Security Incident Analysis

“…MITRE Corporation [126] on whether cybersecurity is a science is not within our current, relatively narrow scope. However, since CSIR is an important subset of cybersecurity, whether security investigations are a kind 23 As a convenient sample, one of the authors has presented at Anti-Phishing Working Group (APWG) [161,164] and attended InfraGuard meetings, and does not expect there would be significant benefit in expanding the scope to include them. Likewise, the same author has interacted with several Information Sharing and Analysis Centers (ISACs), and reviewed their available materials (Research and Education Networking ISAC (REN-ISAC) and Financial Services ISAC (FS-ISAC) especially) and does not believe they have any documents of importance to our topic.…”

Cybersecurity incident response capabilities in the Ecuadorian financial sector

“…One example cited by respondents is malware attacks to ATMs, and another case recently reported by the international press is malware attack to conduct fraud by using the SWIFT network [39]. These two cases as well as the ongoing global development of adversarial cyber capabilities [40] suggest that the Ecuadorian financial sector necessitates preparation for even more aggressive attacks than those confronted so far. As part of such an endeavor, financial institutions could benefit from applying models such as the "adversarial capability chain" to support prediction of threats' movements and their proficiencies [40].…”

“…Lockheed Martin's cyber kill chain (CKC) allows us to recognize the stages taken by advanced adversaries' during cyber intrusions and helps identify discrete attacks connected to intrusive campaigns [92]. The "global adversarial capability chain model" intends to expand the time-frame in which security analysts can investigate and predict adversaries behavior against a particular software system [40]. The diamond model for intrusion analysis [93] identifies and analyzes granular, essential elements (e.g.…”

Review of human decision-making during computer security incident analysis

“…As a convenient sample, I have presented at APWG(Spring, 2013;Spring et al, 2015) and attended InfraGuard meetings, and I do not expect there would be significant benefit in expanding the scope to include them. Likewise, I have interacted with several ISACs, and reviewed their available materials (Research and Education Networking Information Sharing and Analysis Center (ISAC) (REN-ISAC) and Financial Services Information Sharing and Analysis Center (ISAC) (FS-ISAC) especially) and do not believe they have any documents of importance to our topic.…”