A Framework for Supporting Active Cyber Defense Advances in Information Security

Advances in Information Security 64 Kristin E. Heckman Frank J. Stech Roshan K. Thomas Ben Schmoker Alexander W. Tsow Cyber Denial, Deception and Counter Deception A Framework for Supporting Active Cyber Defense Advances in Information Security Volume 64 Series Editor Sushil Jajodia, Center for Secure Information Systems, George Mason University, Fairfax, VA 22030-4444, USA More information about this series at http://www.springer.com/series/5576 Kristin E. Heckman • Frank J. Stech Roshan K. Thomas • Ben Schmoker Alexander W. Tsow Cyber Denial, Deception and Counter Deception A Framework for Supporting Active Cyber Defense Kristin E. Heckman Frank J. Stech The MITRE Corporation The MITRE Corporation McLean, VA, USA McLean, VA, USA Roshan K. Thomas Ben Schmoker The MITRE Corporation The MITRE Corporation McLean, VA, USA McLean, VA, USA Alexander W. Tsow The MITRE Corporation McLean, VA, USA ISSN 1568-2633 Advances in Information Security ISBN 978-3-319-25131-8 ISBN 978-3-319-25133-2 (eBook) DOI 10.1007/978-3-319-25133-2 Library of Congress Control Number: 2015953440 Springer Cham Heidelberg New York Dordrecht London © Springer International Publishing Switzerland 2015 This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed. The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. The publisher, the authors and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, express or implied, with respect to the material contained herein or for any errors or omissions that may have been made. Printed on acid-free paper Springer International Publishing AG Switzerland is part of Springer Science+Business Media (www.springer.com) Preface The field of cyber security has evolved over the last three decades and today is at a critical juncture. Computer network defense (CND) has reached the limits of what traditional perimeter defenses such as boundary controllers and firewalls, as well as intrusion detection systems, can do to increase an organization’s overall security posture. Sophisticated, well-organized attackers collectively known as the advanced persistent threat (APT) continue to bypass these traditional defense mechanisms by exploiting zero-day vulnerabilities. Trying to block access by intruders in many cases is futile: it is more realistic to assume that the defense perimeter is porous and that stealthy adversaries may have established a semi-persistent presence in the defender’s network. Both researchers and practitioners acknowledge, at least tacitly, that they need more advanced and active defense security techniques. Such techniques would not merely monitor, detect, and block intrusions, but would actively engage adversaries and study their tactics, techniques, and procedures (TTPs) and craft customized responses and mitigation strategies. Throughout history, denial, deception, and counterdeception have proven effec- tive force multipliers when used in conflict. As the challenges to U.S. national security increasingly move into the cyber domain, the field of cyber security needs an analogous force multiplier to defend effectively against computer network attacks, intrusions, and pervasive electronic espionage. What role can cyber denial and deception (cyber-D&D) play in such a paradigm? That is the subject of this book. A significant opportunity exists for advancing CND by adapting and applying classical D&D theory and techniques to CND operations. Such adaptation and application entail connecting classical D&D theory and techniques to cyber defense in order to develop a framework that facilitates greater use of D&D in routine CND operations. As adversaries’ attack techniques evolve, defenders’ cyber systems must also evolve to provide the best continuous defense. This will usher in a new paradigm, consisting of a highly customized network defense based on understand- ing the specifics of adversary attacks. By knowing how to engineer cyber systems to better detect and counter the deception aspects of advanced cyber threats, and how to apply D&D against the APT and other threats, cyber defenders will force v vi Preface adversaries to move more slowly, expend more resources, and take greater risks, while themselves possibly avoiding or at least better fighting through cyber degradation. A review of the cyber security research literature indicates that the use of denial, deception, and counterdeception in the cyber domain is in its infancy when com- pared to D&D use in the physical world and kinetic warfare.1 Training in govern- ment and academic settings rarely integrates classical deception theory with cyber security. As a result, many computer network defenders have limited familiarity with D&D theory or approaches, let alone how to apply them. This, coupled with disjoint terminology, theory, and lack of a cohesive framework, may have contributed to fewer empirical and operational applications of D&D in cyber security. Given this, we wished to introduce a wide audience to the role that cyber-D&D can play as part of a larger and more comprehensive active CND scheme. However, this book is not intended as a technical manual for crafting cyber-D&D techniques. Viewing cyber-D&D primarily as a technical initiative or problem would lead to low adoption and failure to counter cyber threats. Instead, concepts for cyber-D&D must be conceived, championed, managed, and matured within the larger organiza- tional, business, and cyber defense context. This book represents our attempt to lay out a blueprint for these broader considerations. Mc Lean, VA, USA Kristin E. Heckman Frank J. Stech Roshan K. Thomas Ben Schmoker Alexander W. Tsow 1 Frank Stech, Kristin E. Heckman, Phil Hilliard, and Janice R. Ballo. “Scientometrics of Deception, Counter-deception, and Deception Detection in Cyber-space,” PsychNology Journal, v. 9, no. 2, pp. 79–122, 2011. Acknowledgments The authors, our significant others, as is their habit, have overestimated their capa- bilities and underestimated their responsibilities, and the time and resources needed to meet them. Hence we undertook to acknowledge everyone who contributed to the creation of this book, beginning with ourselves. The authors basically ignored fam- ily and friends, and, we suspect, other duties and obligations, in order to produce this volume. The authors have expressed their deep gratitude and appreciation for our forbearance, patience, and assistance. We shan’t let them forget that. Nevertheless, we believe the end justifies their negligence. We are proud of the product and of the authors. Having had to listen to the authors’ tales of inadequate cyber security and computer systems compromises of all forms, we became aware of the promise of cyber deceptions in active defense of computer systems. But many defenses obviously are still needed, and many horses have left too many barns, so these Acknowledgments will tend to use first names and last initials. The individuals involved are probably already known to foreign intelligence services, but we need not make connecting the dots any easier for them. Those thanked know who they are. Without question, this book is dedicated to the late Dr. Barton S. Whaley (1928— 2013), America’s foremost scholar of all matters of deception, and authority on the literature and research on deception and counterdeception. He was a dear friend of Frank and Kristin. His influence permeates this book and will influence deception and counterdeception, in the cyber realm and elsewhere, for years to come. This volume is very much a product of the MITRE Corporation’s dedication to cutting-edge and meaningful research and development. MITRE’s support for deception and counterdeception research predates the work reflected in this volume by over a decade. Thanks for such support are due to Richard G., Dave L., Steve H., Anne C., Rod H., and Robert N. (a bit of a deception scholar himself). Similarly, supporting the connection between deception and counterdeception research and MITRE’s long-standing efforts to enhance cyber defenses reflects the vision and foresight of Vipin S., Mark M., Gary G., Marion M., Marnie S., Rich B., Rick S., Kerry B., and MITRE’s Engineering Council. vii viii Acknowledgments Many at MITRE have partnered with the authors in various deception and counterdeception research projects and other activities. Thanks to Janice B., Phil H., Margaret M., Chris E., Mike T., Mark B., Charles W., Barry C., Lisa C., Frank D., Blake S., Adam P., Mark G., Dave K., Marc B., Irv L., Todd O., Michael W., Stephen D., Audra H., Justin A., and Justin L. All scholars stand on the shoulders of others. The footnotes and references in this volume reflect the influence and contributions made by the communities of researchers of deception and counterdeception, and the growing cadre of researchers

Load more