2014 6TH INTERNATIONAL CONFERENCE ON CYBER CONFLICT (CYCON 2014) Copyright © 2014 by NATO CCD COE Publications. All rights reserved. IEEE Catalog Number: CFP1426N-PRT ISBN (print): 978-9949-9544-0-7 ISBN (pdf): 978-9949-9544-1-4 COPYRIGHT AND REPRINT PERMISSIONS No part of this publication may be reprinted, reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior written permission of the NATO Cooperative Cyber Defence Centre of Excellence ([email protected]). This restriction does not apply to making digital or hard copies of this publication for internal use within NATO, and for personal or educational use when for non-profi t or non-commercial purposes, providing that copies bear this notice and a full citation on the fi rst page as follows: [Article author(s)], [full article title] 2014 6th International Conference on Cyber Confl ict P.Brangetto, M.Maybaum, J.Stinissen (Eds.) 2014 © NATO CCD COE Publications PRINTED COPIES OF THIS PUBLICATION ARE AVAILABLE FROM: NATO CCD COE Publications Filtri tee 12, 10132 Tallinn, Estonia Phone: +372 717 6800 Fax: +372 717 6308 E-mail: [email protected] Web: www.ccdcoe.org Layout: Jaakko Matsalu LEGAL NOTICE: This publication contains opinions of the respective authors only They do not necessarily refl ect the policy or the opinion of NATO CCD COE, NATO, or any agency or any government NATO CCD COE may not be held responsible for any loss or harm arising from the use of information contained in this book and is not responsible for the content of the external sources, including external websites referenced in this publication ABOUT THE NATO CCD COE The NATO Cooperative Cyber Defence Centre of Excellence (NATO CCD COE) is an international military organisation accredited in 2008 by NATO´s North Atlantic Council as a “Centre of Excellence”. The Centre is not part of NATO’s command or force structure, nor is it funded by NATO. However, it is part of a wider framework supporting NATO Command Arrangements. The NATO CCD COE’s mission is to enhance capability, cooperation and information-sharing between NATO, NATO member States and NATO’s partner countries in the area of cyber defence by virtue of research, education and consultation. The Centre has taken a NATO- orientated, interdisciplinary approach to its key activities, including academic research on selected topics relevant to the cyber domain from legal, policy, strategic, doctrinal and/ or technical perspectives, providing education and training, organising conferences, workshops and cyber defence exercises and offering consultations upon request. For more information on the NATO CCD COE, please visit the Centre’s website at http://www.ccdcoe.org. FOREWORD This is the second time that the CyCon conference devotes its attention to advanced methods of cyber confl ict and their strategic and policy implications. In 2013 we discussed the role and methods of automated cyber defense. We looked at automation not only as an enabling technological device or method that allowed us to increase the effectiveness and sophistication of cyber defensive and offensive actions, but also as a social factor which borders with the political, legal, moral and ethical framework of modern societies. All these factors remain in place as we move to the territory of Active Cyber Defense (ACD), the focus of CyCon 2014. Historically, under the umbrella of Information Technology (IT)-centric cyber security many defensive cyber security paradigms were proposed, including perimeter bound cyber defense, cyber defense based on protection of mission-critical assets, and network-centric cyber defense. The perimeter bound cyber defense is based on a collection of various outward-facing security measures including fi rewalls, intrusion detection systems, and anti-virus software. The essence of mission criticality in cyber security is in the idea of protection of some, not all assets, and protecting them, not always, but within some time window. The network-centric cyber security paradigm that was promoted by the U.S. Department of Defense was motivated by the acceleration of the speed and mobility of the modern battlespace, and aimed building a secure information space for connecting people and systems independent of time and location. Regardless of the research and developments of numerous IT-centric cyber security standards and software/hardware solutions, it has become increasingly evident, from the large number of cyber security incidents collected by government, academic, and industrial cyber security organizations during the last 10 years, that cyber defense, as an institution and industry, is not adequately protecting the national interests of states. The practice of everyday usage of IT- centric cyber defense has revealed that it is technically and fi nancially unconceivable to protect each and every IT component, especially while dealing with very large IT infrastructures, or where IT assets are used in dynamic and unpredictable operational environments. Second, although known for several years that main cyber threats are not coming from casual hackers and petty criminals, but from well organized, well-funded, and well-informed criminal groups and state-sponsored actors, only recently this fact has been institutionalized and elevated to the national security level. The term Advanced Persistent Threat (APT) is often used to describe those criminal and state-sponsored cyber attacks that penetrate specifi c industrial or governmental organizations and evade detection within those organizations for weeks, months or even years, sometimes even with the help of insiders. The traditional cyber security methods, mostly passive, perimeter-bound and reactive are not conceptually and technologically well- equipped to challenge APT. The commonly used term for ACD is the one given in the 2011 US Department of Defense, Strategy for Operations in Cyberspace. It states that “Active cyber defense is DoD’s synchronized, real-time capability to discover, detect, analyze, and mitigate threats and vulnerabilities. […] It operates at network speed by using sensors, software, and intelligence to detect and stop malicious activity before it can affect DoD networks and systems.” One can ii see two major activities defi ned in the above-given defi nition, (1) Cyber Situation Awareness, and (2) Cyber Defensive Actions Planning and Execution. The activities of Cyber Situation Awareness encompass a variety of real-time tasks of cyber infrastructure sensing, real-time data collection, information fusion, analysis, and attack detection. Cyber Defensive Actions include the tasks real-time and pro-active measures like attack neutralization, attacker deception, target masking, cyber forensics, cyber infrastructure and mission adaptation and self-organization in order to assure mission continuation, undertaking offensive measures against the threat agents, prediction of potential future threats and reconfi guration of the cyber infrastructure accordingly, and others. The current state of ACD brings us to technically, strategically, politically and legally active territory, which is in the process of developing its own widely-accepted models, architectures and solutions, but still debates on some fundamentals on the role, concepts, and scope of ACD. All aspects of ACD mentioned above are refl ected in the papers presented at CyCon 2014. The mission and vision of this conference is to look at the issues, models, and solutions of ACD from a synergistic multi-disciplinary perspective. The conference intention was to underscore the fact that signifi cant progress has been made recently in defenses, industrial and academic communities in developing a common and actionable understanding of the objective, models, as well as boundaries of ACD. In this context, the annual Cyber Confl ict (CyCon) conferences conducted in Tallinn by the NATO Cooperative Cyber Defence Centre of Excellence are continuing to provide a unique perspective. This distinctiveness is marked by an innovative synergistic approach to the conceptual framework, architectures, processes and systems of cyber defense. It holistically examines computer science and IT, through the lenses of technology, law, strategy and policy, military doctrine, social and economic concerns and human behavioral modeling with respect to the security of cyber space. The proceedings of this 6th International Conference on Cyber Confl ict 2014 (CyCon 2014) are collected in this volume. The 20 papers were selected by the conference program committee following a rigorous peer review process. The papers are spread across the legal, policy, strategic, and technical spectra of cyber defenses, specifi cally focusing on the issues of Active Cyber Defence. They include in-depth analyses the concept of ACD as well as its legal and socio-political aspects, models of ACD cyber situational awareness and detection of malicious activities, and cyber operational activities. This volume is arranged into fi ve chapters. The fi rst chapter, Active Cyber Defence – Concepts, Policy and Legal Implications, discusses the conceptual framework, and legal and (socio-) political aspects of ACD to modern societies. The second chapter, Models of Active Cyber Defense, discusses three important models of ACD, weaponization of code, attacker deception, and deployment of actor agnostic threat models, and the benefi ts and risk factors of exploitations of those models. The third chapter, Cyber