Modern military forces rely heavily on cyber-enabled systems; for logistics, communication, and control. Modern military platforms are heavily integrated with computing capability. This integration... Show More

Modern military forces rely heavily on cyber-enabled systems; for logistics, communication, and control. Modern military platforms are heavily integrated with computing capability. This integration and reliance will only increase over time. Modern military operations require the support of flexible, responsive and resilient cyber-capabilities. Current information system security models and information assurance constructs seek to achieve information assurance, a high degree of certainty in the confidentiality, integrity and availability of cyber-systems supporting combat operations. However, this approach assumes that an information assurance approach is a complete and comprehensive defense. History though, has proven otherwise. This work argues that the information assurance approach, whilst a worthy goal, is not reflective of the lessons of history or warfare. Specifically, this work outlines the need for, and introduces The Military Cyber-Maturity Model, a pragmatic model that assumes a technically capable and intelligent adversary. This model assumes the possibility of an adversary utilizing an unknown vulnerability to attack the system, and expends resources to minimise the impact of the successful attack rather than relying entirely on an impregnable defense. This approach extends beyond the assumption that a cyber-attack immediately causes mission failure, by recognizing that each cyber-attack has different requirements and outcomes and will affect different assets and processes. The Military Cyber-Maturity Model seeks to model business continuity through a high degree of cultural change, embedded work practices that parallel analogue and digital work practices with deceptive counterintelligence behavior. The Military Cyber-Maturity Model incorporates the concepts of behavioral defense and mission assurance to provide agility and increase the likelihood of success in combat. Information deception provides a behavioral defense, creating uncertainty and doubt in the adversary's mind and reducing the degree of trust they have in the information available. This paper introduces the model, outlines its aims, components and justifications. This work also outlines the need for simulation and testing to validate the model's effectiveness, and introduces a number of potential use-cases.

Current approaches in cyber defense are flawed as they are fortress-based and generally static in nature. They are not flexible in dealing with variations of attacks, especially zero-day attacks. To... Show More

Current approaches in cyber defense are flawed as they are fortress-based and generally static in nature. They are not flexible in dealing with variations of attacks, especially zero-day attacks. To address this issue, researchers have looked into dynamic cyber defense. However, the available approaches are either only about high-level strategies or only about specific tactics. There is no integrated approach that brings both levels together in a systematic way. This research article intends to address this challenge by proposing a new dynamic cyber defense framework that is systematic and cohesive, and that integrates strategic, operational, and tactical levels. It improves the research in dynamic cyber defense by employing game-changing elements such as a contextual analysis system and an intelligent decision-making system.

In this paper, we examine the benefits of a more quantifiable way to make decisions that enable senior leaders to better manage disruption of and attacks on the critical infrastructure. Most of the... Show More

In this paper, we examine the benefits of a more quantifiable way to make decisions that enable senior leaders to better manage disruption of and attacks on the critical infrastructure. Most of the decisions have been made using intuition and in some cases unrelated experiences and have not particularly worked to the benefit of the sectors' performance and stability. Much of this is due to the history of the logic control systems and networks that were fairly isolated and much better protected. Attempts to reduce costs and secure many of the benefits of IP-based environments have unfortunately now also introduced some of the vulnerabilities indicative of IP-based systems into the logic environments. Senior leaders have not been used to these new ‘hybrid' information technology/operational technology (IT/OT) environments which though creating new opportunities also introduce new challenges. The unique nature of the critical infrastructure in which it is over 80%-owned by the private sector, often regulated by the federal government, and serves the interests and demands of the public, creates a non-trivial challenge at many different levels. More trust and cooperation between the three elements of society is surely a desired interest by the key stakeholders, but there are many concerns in terms of over-regulation, costs, and loss of intellectual property that have consistently sustained a level of discomfort between the three communities in terms of the priorities and self-serving interests of each other. The challenges of the low asymmetry entry and attribution within the cyber domain have raised the profile of many actors who would not even have previously registered in the ‘noise' on a trouble or problem scale. Now, the ability to determine those responsible, as well as, almost any actor having the ability to present a challenge to the environment have changed many of the dynamics in terms of how senior leaders must now operate and manage the appropriate systems and networks. Hence, for obvious reasons, senior leaders are much more cautious in their approach to decision making because of the potential consequences. This is especially true because cyber assets, though so valuable can be also so vulnerable. In this study, we will discuss a method that moves decision from a less arbitrary to a more data-centric, quantifiable approach that drives leadership to better and quicker decisions.

Data breaches are becoming more common and numerous every day, where huge amount of data (corporate and personal) are leaked more frequently than ever. Corporate responses to data breaches are... Show More

Data breaches are becoming more common and numerous every day, where huge amount of data (corporate and personal) are leaked more frequently than ever. Corporate responses to data breaches are insufficient, when commonly remediation is minimal. This research proposes that a similar approach to physical pollution (environmental pollution) can be used to map and identify data leaks as Cyber pollution. Thus, IT institutions should be made aware of their contribution to Cyber pollution in a more measurable method. This article defines the concept of cyber pollution as: security vulnerable (such as unmaintained or obsolete) devices that are visible through the Internet and corporate networks. This paper analyses the recent state of data breach disclosures Worldwide by providing statistics on significant scale data breach disclosures from 2014/01 to 2016/12. Ivan Burke and Renier van Heerden model security threat levels similar to that of pollution breaches within the physical environment. Insignificant security openings or vulnerabilities can lead to massive exploitation of entire systems. By modelling these breaches as pollution, the aim is to introduce the concept of cyber pollution. Cyber pollution is a more tangible concept for IT managers to relay to staff and senior management. Using anonymised corporate network traffic with Open Source penetration testing software, the model is validated.