Kinetic and Cyber

Kott, Alexander; Buchler, Norbou; Schaefer, Kristin E.

doi:10.1007/978-3-319-11391-3_3

Cited by 7 publications

(6 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Situational awareness was extensively studied in military and aviation and gained recognition in cybersecurity as so-called cyber situational awareness (CSA) [17]. Following the widely-used definition, CSA consists of three levels: the perception of the elements in the cyber environment within a volume of time and space, the comprehension of their meaning, and the projection of their status in the near future [18]. Each level builds upon the previous one; one cannot fully understand the situation without proper perception nor project the situation without understanding it.…”

Section: Background and Related Workmentioning

confidence: 99%

Towards a Data-Driven Recommender System for Handling Ransomware and Similar Incidents

Husák

2021

2021 IEEE International Conference on Intelligence and Security Informatics (ISI)

View full text Add to dashboard Cite

Effective triage is of utmost importance for cybersecurity incident response, namely in handling ransomware or similar incidents in which the attacker may use self-propagating worms, infected files, or email attachments to spread malware. If a device is infected, it is vital to know which other devices can be infected too or are immediately threatened. The number and heterogeneity of devices in today's network complicate situational awareness of incident handlers, and, thus, we propose a recommender system that uses network monitoring data to prioritize devices in the network based on their similarity and proximity to an already infected device. The system enumerates devices in close proximity in terms of physical and logical network topology and sorts them by their similarity given by the similarity of their behavioral profile, fingerprint, or common history. The incident handlers can use the recommendation to promptly prevent malware from spreading or trace the attacker's lateral movement.

show abstract

Section: Background and Related Workmentioning

confidence: 99%

Towards a Data-Driven Recommender System for Handling Ransomware and Similar Incidents

Husák

2021

2021 IEEE International Conference on Intelligence and Security Informatics (ISI)

View full text Add to dashboard Cite

show abstract

“…Situational awareness was extensively studied in military and aviation and is gaining recognition in cybersecurity as cyber situational awareness (CSA) [7]. Following the widely-used definition, (cyber) situational awareness is the perception of the elements in the (cyber) environment within a volume of time and space, the comprehension of their meaning, and the projection of their status in the near future [3,6,10]. CSA builds upon the perception of the cyber environment, without which one cannot fully understand the situation nor project its changes.…”

Section: Cyber Situational Awarenessmentioning

confidence: 99%

“…CSA builds upon the perception of the cyber environment, without which one cannot fully understand the situation nor project its changes. An alternative term is network-wide situational awareness [10,17].…”

Section: Cyber Situational Awarenessmentioning

confidence: 99%

“…Connector. This component gathers information on vulnerabilities in the CVE format 10 from several external sources. The purpose of this component is to put available information on vulnerabilities discovered in the network so that the incident handler can be immediately provided with a human-readable description and technical details on each vulnerability with an assigned CVE identifier.…”

Section: Cvementioning

confidence: 99%

See 1 more Smart Citation

System for Continuous Collection of Contextual Information for Network Security Management and Incident Handling

Husák

Laštovička

Tovarňák

2021

Proceedings of the 16th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

In this paper, we describe a system for the continuous collection of data for the needs of network security management. When a cybersecurity incident occurs in the network, the contextual information on the involved assets facilitates estimating the severity and impact of the incident and selecting an appropriate incident response. We propose a system based on the combination of active and passive network measurements and the correlation of the data with thirdparty systems. The system enumerates devices and services in the network and their vulnerabilities via fingerprinting of operating systems and applications. Further, the system pairs the hosts in the network with contacts on responsible administrators and highlights critical infrastructure and its dependencies. The system concentrates all the information required for common incident handling procedures and aims to speed up incident response, reduce the time spent on the manual investigation, and prevent errors caused by negligence or lack of information. CCS CONCEPTS• Security and privacy → Network security; Vulnerability management; • Applied computing → Operations research.

show abstract

“…The national and economic security depends on the reliable functioning of critical infrastructures. Our dependency upon networked organizations has the consequence that warfare is no longer limited to the physics of the conventional battlefield (Kott, 2014). Cyber attacks are borderless and can be launched from virtually everywhere.…”

Section: Dealing With a Changing Threat Landscapementioning

confidence: 99%

A Public-Private-Partnership Model for National Cyber Situational Awareness

Pahi¹,

Skopik²

2016

IJCSA

View full text Add to dashboard Cite

The information age has led to the merger of various infrastructures, from both business and governmental sectors and their functions, such as information technology, communication and transport systems, banking and finance, energy supply and process control systems. The protection of these systems is essential to resilience and reliability of critical infrastructures and their key resources, consequently to the national security and economic prosperity. The presented public-private-partnership cyber situational awareness (P3CSA) framework provides the mean for swift information flows among the national and private stakeholders working in a strong cooperation. The P3CSA framework offers concepts and methodologies for a multi-level data collection, swift cross-organizational information sharing processes, proper cross-domain incident communication, an early warning system and enhanced cyber situational awareness through customizable big data visualization for superior decision making at both strategic and tactical levels. The gained situational awareness facilitates identifying and responding to cyber threats, enhances the security of essential infrastructures, increases the resistance of critical services for the society and supports decision makers to deal with cyber crises.

show abstract

Kinetic and Cyber

Cited by 7 publications

References 16 publications

Towards a Data-Driven Recommender System for Handling Ransomware and Similar Incidents

Towards a Data-Driven Recommender System for Handling Ransomware and Similar Incidents

System for Continuous Collection of Contextual Information for Network Security Management and Incident Handling

A Public-Private-Partnership Model for National Cyber Situational Awareness

Contact Info

Product

Resources

About