Lawful Cyber Decoy Policy

Abstract

Abstract:Cyber decoys provide a means for automating, to a degree, counterintelligence activities and responses to cyber attacks. Like other security mechanisms for protecting information systems, it is likely that cyber decoys will in some instances be misused. In the United States, criminal law provides us with analogies for preventing or punishing improper state use of deception, and criminal and civil law give us a range of tools to use against private actors. However, in addition to states, nongovernmental entities and individuals can employ cybel' decoys. In this paper we present a principled analysis of the use of cyber decoys. We explore the absolute minima in terms of customary principles for what might be considered to be acceptable use of deception.Key words: Deception, Law, Computer security DECEPTION IN CYBERSPACEIn [1], Michael et al. propose to use software-based deception as a means for hardening operational systems against attack. Critical units of software are wrapped with "decoying" rules, which are the cyber embodiment of both the policy (including doctrine) of an organization or individual for conducting counterintelligence and applying countermeasures against attackers. The wrappers are placed around critical units of software (e.g., a component or method) to be protected. By critical, we mean units of software that are integral to the continued survivability of an information system and the correct enforcement of the policy embedded in the system.When a wrapper detects a suspicious pattern of system calls by one or more computer processes, it begins to conduct counterintelligence tasks and initiates countermeasures; pattern recognition is performed at runtime. The

Strategic Approach to Information Security in Organizations

“…Recovering and/or restoring damaged system(s) and service(s) back to original state(s) do not belong to reaction since we believe that they are basically pertained to reconstruction performed after the end of the conflict, which is not the scope of the defense. Some of Reaction strategies are deception [29,32,33], delay [25], and isolation of attackers [21,29,34].…”

An ontology‐based distributed whiteboard to determine legal responses to online cyber attacks

“…Like their commercial analogs, they provide quick and reliable access to the documents themselves, but are not designed to assist in the legal analysis per se. The University of Minnesota's Human Rights Library is an excellent example, and is the source of UN Charter text provided in one of our examples [10].…”

An Abstraction of Cyber Inception: Using a Modified Version of Battleship to Study Strategies and Behavior of Deception

“…In light of the ever growing number and complexity of cyberattacks, it is necessary to find more novel solutions to defend our cyber networks and critical infrastructure. Inception has been proposed as an effective way to defend our networks and ward off attackers, for the best defense is a great offense (Michael & Wingfield, 2003;Mitnick & Simon, 2011;Rowe & Goh, 2007). Fighting deception with reverse deception thwarts the assumptions of attackers and allows defenders to defend systems and information dynamically rather than after attacks have already occurred (dynamic defense).…”