Comparing models of offensive cyber operations

Abstract

Cyber operations denote the response of governments and organisations to cyber crime, terrorism, and warfare. To date, cyber operations have been primarily defensive, with the attackers seemingly having the initiative. Over the past three years, several nations (e.g. USA, UK, France, The Netherlands) and NATO have published cyber security strategies emphasising national and international collaboration. Many strategies call for the establishment of a Cyber Security Operations Centre, as well as for a better understanding of attacks. In the scientific literature, Lin (2009) and Denning and Denning (2010) have argued that offensive cyber operations deserve a more open discussion than they have received to date. Research into cyber attacks would improve the scientific understanding of how attackers work, why they choose particular targets, and what tools and technologies they employ. This improved understanding could then be used to implement better defences. Moreover, research would enable governments and other organizations to take offensive action where justified against adversaries, whether these be criminals, terrorists, or enemies. This could include responding to an (impending) attack by counter-attacking or by proactively neutralizing the source of an impending attack. A good starting point to improving understanding would be to model the offensive cyber operations process. The purpose of this paper is to find, formalise, and compare models of the offensive cyber operations process available in the open scientific literature. Seven models were sufficiently well described for formalisation using Structured Analysis and Design Technique (SADT) notation. Finally, a canonical model has been constructed by rational reconstruction. Although the model has not yet been tested, it has been reviewed by subject matter experts. The paper describes the search methodology, the SADT analysis, the shortcomings of each model, rational reconstruction, and the canonical model. Further work will include elaborating the canonical model to identify the resources needed to set up a Cyber Security Operations Centre with offensive capabilities and to cross-compare the model with the literature on attack ontologies.