12.1.1 Factors to Consider for Cyber Modeling

Factors that influence how a system is modeled are provided in Table 12.2 (Velez and Morana 2015).

Table 12.2 spans the considerations for cyber threat modeling. While computer‐based systems present attack surfaces that require combinatoric description, known practices in physical security use simple time estimates to abstract on access complexities (e.g. time to “crack” a safe).

12.1.2 Lessons Learned from Physical Security

Determining the burglary rating of a safe is a similar problem to determining the security rating of a network. Both involve a malicious threat agent attempting to compromise the system and take action resulting in loss. Safes in the United States are assigned a burglary and fire rating based on well‐defined Underwriters Laboratory (UL) testing methodologies such as UL Standard 687. A few selected UL safe burglary ratings are given in Table 12.3.

The rating system is based around the concept of “Net Working Time” (NWT), the UL expression for the time that is spent attempting to break into the safe by testers using specified sets of tools such as diamond grinding tools and high‐speed carbide tip drills. Thus, TL‐15 means that the safe has been tested for NWT of 15 minutes using high‐speed drills, saws, and other sophisticated penetrating equipment. The tool sets are also categorized into levels – TRTL‐30 indicates that the safe has been tested for a NWT of 30 minutes, but with an extended range of tools such as torches. Assumptions about the processes include:

1. There is an implication that given the proper resources and enough time, any safe can eventually be broken into.
2. A safe is given a burglary rating based on its ability to withstand a focused attack by a team of knowledgeable safe crackers following a well‐defined set of rules and procedures for testing.
3. The rules include using well‐defined sets of common resources for safe cracking.
4. The resources available to the testers are organized into well‐defined levels that represent increasing cost and complexity and decreasing availability to the average attacker.
5. Even though there might be other possibilities for attack, only a limited set of strategies will be used, based on the tester’s detailed knowledge of the safe.

The UL rating does not attempt to promise that the safe is secure from all possible attack strategies – it is entirely possible that a design flaw might be uncovered that would allow an attacker to break into a given safe in seconds. However, from a statistical point of view, it is reasonable to assume that as a group, TL‐30 safes are more secure than TL‐15 safes. This ability to efficiently estimate a comparative security level for a given system is the core objective of looking Mean Time to Exploit (MTTE) (Chapter 9).

Learning from the safe rating methodology, MTTE for rating a network makes the following assumptions:

1. Given the proper resources and enough time, any network can be successfully attacked by an agent skilled in the art of electronic warfare.
2. A target network or device must be capable of surviving an attack for some minimally acceptable benchmark period (e.g. MTTE).
3. The average attacker will typically use a limited set of strategies based on their expertise and their knowledge of the target.
4. Attackers can be statistically grouped into levels, each with a common set of resources such as access to popular attack tools or a level of technical knowledge and skill.

Complementing the UL analog for cyber system access estimation is the cyber threat data providers’ tactical and strategic outlook for current trends in system attack practices.

12.1.3 Cyber Threat Data Providers

Ponemon, Verizon, and Symantec are some of the most famous open‐source cyber threat reports (Table 12.4).

Each of Table 12.4’s threat data reports provides practical insights into current cyber operations. This includes informing the application of CSCs as a preventive measure for network security.

12.1.4 Critical Security Controls (CSCs)

CSCs (Table 12.5) are the product of multiple man‐years of time and effort. Designed to be prioritized, based on their level of effective security, CSCs provide an easy reference for cybersecurity professionals, from beginning to advanced. An additional note about CSCs is that they are designed to be automated, being a first step in machine‐based course of action (COA) reaction to cyber threats.

Some of Table 12.5’s automated responses include patching, port closure, and packet screening (e.g. to find encrypted data transmission in an exfiltration). Similar to Table 12.5’s controls are Australia’s opposition force (Table 12.6), estimated to provide 85% of the network security requirements.

As shown in Tables 12.5 and 12.6, security controls provide a cross‐institutional memory that can help security researchers approach key challenges to creating cyber agents that include (i) modeling the complex and continually evolving processes of cyber operations and (ii) leveraging the tools and data standards that enable cognitive agents to interoperate with networks invisibly to the user; distilling models of cyber offensive and defensive behavior based on observation and elaboration of human expertise.

12.1.5 Situational Awareness Measures

Cyber M&S benefits from a long line of SA research, much of it used to develop aircraft training programs, and currently available for cybersecurity training development (Table 12.7).

Table 12.7’s methods for evaluating SA are used in conjunction with training systems, providing the simulated cyber terrain for rehearsing known and hypothesized scenarios.

12.2.1 Scalable Network Defense Trainer (NDT)

This is one of the few tools identified to date that provides a representation of the impact of an event in cyberspace on both the informational and operational capabilities of a mission. It creates linkages between the cyber training environment and the classical domain training exercises. It is service oriented and Computer Generated Forces (CGF)‐agnostic adding cyber effects to traditional training effects, thereby training operators to work round a cyberattack and complete their mission objectives. The tool is interoperable with other simulations via HLA to create an emulated software virtual network running in real time.

The NDT cyber tools and ranges provide an engine for representing a cyberattack, and this engine uses the network protocols and standards appropriate to these tools. A DIS/HLA gateway provides an interface to training simulators and simulations, allowing the NDT to deliver a representation of cyber traffic to the federation running the training simulation, which uses the standards appropriate to its own level.

12.2.2 SELEX ES NetComm Simulation Environment (NCSE)

This tool allows users to model and simulate operational network assets. By implementing a “System‐in‐the‐Loop” capability users can establish a “Live‐Constructive” connection and allow real hardware or applications and the simulation environment to interact as a common operational picture. It incorporates communications effects with the rest of the simulation to generate an enhanced awareness of the impact a cyberattack might have on the scenario. It can be integrated with “most common CGFs” and using HLA can be federated into a synthetic environment to allow decision makers to understand how a cyberattack might alter the interactions of entities within the scenario.

The NCSE environment is designed to be integrated with virtual training tools to provide cyber personnel with training on communications assets. This allows them to analyze the scalability, survivability, availability, and reliability of the networks. In turn, this leads to an improved SA by enabling users to identify where the main impact of a cyberattack might be noticed and to make appropriate provision. At the network level, the provision could be to ensure a robust configuration that includes an appropriate level of deliberate redundancy. For non‐cyber operators, this could be to ensure they are trained to operate in reversionary modes should certain equipment become unavailable.

Both the Scalable NDT and SELEX’ NCSE are training platforms to improve the SA of the respective cyber and mission operators. These training platforms are usually targeted toward training mission operators to know when to call the cyber professionals, who maintain specialized tools.

12.2.3 Example Cyber Tool Companies

While it is a challenge to monitor the almost daily evolution of cyber offerings, Table 12.9 provides a sample of cyber‐specific companies.

Table 12.9’s offerings span from foundational research (e.g. Virginia Tech) to specialized tools for assessing (e.g. Lumeta IPSonar), evaluating (e.g. GNS3), and performing strategy evaluation (e.g. CAULDRON) on a network of interest. While Table 12.9’s offerings are already on the market, with a developing user community, looking at recent patents, and patent applications, provide a view of what to expect, in terms of capabilities, over the next few years.