A survey on technical threat intelligence in the age of sophisticated cyber attacks

On the battlefields of the future, multitudes of intelligent things will be communicating, acting, and collaborating with one another and with human warfighters. This will demand major advances in science and technology.

The Internet of Battle Things

Confront and Conceal: Obama's Secret Wars and Surprising Use of American Power

Although there is a vast clinical literature on phantom limbs, there have been no experimental studies on the effects of visual input on phantom sensations. We introduce an inexpensive new device--a 'virtual reality box'--to resurrect the phantom visually to study inter-sensory effects. A mirror is placed vertically on the table so that the mirror reflection of the patient's intact had is 'superimposed' on the felt position of the phantom. We used this procedure on ten patients and found the following results. 1. In six patients, when the normal hand was moved, so that the phantom was perceived to move in the mirror, it was also felt to move; i.e. kinesthetic sensations emerged in the phantom. In D.S. this effect occurred even though he had never experienced any movements in the phantom for ten years before we tested him. He found the return of sensations very enjoyable. 2. Repeated practice led to a permanent 'disappearance' of the phantom arm in patient D.S. and the hand became telescoped into the stump near the shoulder. 3. Using an optical trick, impossible postures--e.g. extreme hyperextension of the fingers--could be induced visually in the phantom. In one case this was felt as a transient 'painful tug' in the phantom. 4. Five patients experienced involuntary painful 'clenching spasms' in the phantom hand and in four of them the spasms were relieved when the mirror was used to facilitate 'opening' of the phantom hand; opening was not possible without the mirror. 5. In three patients, touching the normal hand evoked precisely localized touch sensations in the phantom. Interestingly, the referral was especially pronounced when the patients actually 'saw' their phantom being touched in the mirror. Indeed, in a fourth patient (R.L.) the referral occurred only if he saw his phantom being touched: a curious form of synaesthesia. These experiments lend themselves readily to imaging studies using PET and fMRI. Taken collectively, they suggest that there is a considerable amount of latent plasticity even in the adult human brain. For example, precisely organized new pathways, bridging the two cerebral hemispheres, can emerge in less than three weeks. Furthermore, there must be a great deal of back and forth interaction between vision and touch, so that the strictly modular, hierarchical model of the brain that is currently in vogue needs to be replaced with a more dynamic, interactive model, in which 're-entrant' signalling plays the main role.

Synaesthesia in phantom Limbs induced with mirrors

Cyber attackers rely on deception to exploit vulnerabilities and obfuscate their identity, which makes many pessimistic about cyber deterrence. The attribution problem appears to make retaliatory punishment, contrasted with defensive denial, particularly ineffective. Yet observable deterrence failures against targets of lower value tell us little about the ability to deter attacks against higher value targets, where defenders may be more willing and able to pay the costs of attribution and punishment. Counterintuitively, costs of attribution and response may decline with scale. Reliance on deception is a double-edged sword that provides some advantages to the attacker but undermines offensive coercion and creates risks for ambitious intruders. Many of the properties of cybersecurity assumed to be determined by technology, such as the advantage of offense over defense, the difficulty of attribution, and the inefficacy of deterrence, are in fact consequences of political factors like the value of the target and the scale-dependent costs of exploitation and retaliation. Assumptions about attribution can be incorporated into traditional international relations concepts of uncertainty and credibility, even as attribution involves uncertainty about the identity of the opponent, not just interests and capabilities. This article uses a formal model to explain why there are many low-value anonymous attacks but few high-value ones, showing how different assumptions about the scaling of exploitation and retaliation costs lead to different degrees of coverage and effectiveness for deterrence by denial and punishment. Deterrence works where it is needed most, yet it usually fails everywhere else.

Tipping the scales: the attribution problem and the feasibility of deterrence against cyberattack

Cyber Denial, Deception and Counter Deception

Active cyber defense with denial and deception: A cyber-wargame experiment

As attack techniques evolve, cybersystems must also evolve to provide the best continuous defense. Leveraging classical denial and deception techniques to understand the specifics of adversary attacks enables an organization to build an active, threat-based cyber defense. The Web extra at https://youtu.be/9g_HLNXiLto is a video that describes how in January 2012, MITRE performed a real-time, red team/blue team cyber-wargame experiment that presented the opportunity to blend cyber-warfare with traditional mission planning and execution, including denial and deception tradecraft.

Denial and Deception in Cyber Defense

This book presents the first reference exposition of the Cyber-Deception Chain: a flexible planning and execution framework for creating tactical, operational, or strategic deceptions. This methodology bridges the gap between the current uncoordinated patchwork of tactical denial and deception (D&D) techniques and their orchestration in service of an organizations mission. Concepts for cyber- D&D planning operations and management are detailed within the larger organizational, business, and cyber defense context. It examines the necessity of a comprehensive, active cyber denial scheme. The authors explain the organizational implications of integrating D&D with a legacy cyber strategy, and discuss trade-offs, maturity models, and lifecycle management. Chapters present the primary challenges in using deception as part of a security strategy, and guides users through the steps to overcome common obstacles. Both revealing and concealing fact and fiction have a critical role in securing private information. Detailed case studies are included. Cyber Denial, Deception and Counter Deception is designed as a reference for professionals, researchers and government employees working in cybersecurity. Advanced-level students in computer science focused on security will also find this book useful as a reference or secondary text book.

Cyber Denial, Deception and Counter Deception: A Framework for Supporting Active Cyber Defense

The concepts of deception, counter-deception, and deception detection in the cyber-space domain have been the subject of little systematic analysis. Our objective was to conduct scientometric analyses of these concepts in the cyber-space domain. We observed the following: Although various deceptive tactics are addressed in the cyber-security literature, it appears they are characterized more from the standpoint of technology than from their social, behavioral, or cognitive elements; these cyber-tactics are not mapped into the classic components of denial and deception tactics; there is no conventional terminology to describe the phenomenon of deception in cyber-space; classic deception domain terminology is rarely used; and classic deception domain researchers are rarely cited. These observations suggest that cyber-deception is an emerging field.

/pdf/scientometrics-of-deception-counter-deception-and-deception-55o7vovpvb.pdf

Kristin E. Heckman

Papers

Cyber Denial, Deception and Counter Deception

Active cyber defense with denial and deception: A cyber-wargame experiment

Denial and Deception in Cyber Defense

Cyber Denial, Deception and Counter Deception: A Framework for Supporting Active Cyber Defense

Scientometrics of Deception, Counter-deception, and Deception Detection in Cyber-space