Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
379
nations including Government of the Islamic Republic of Afghanistan (GIRoA),
as well as between NATO forces and international organizations such as the United
Nations World Food Programme.
These classical use cases are expected to constitute the main source of traffic
mediated by the HAAG in the NATO Future Mission Networks (FMN) and
of the NATO Network Enabled Capability (NNEC). However, future networks will
also likely need to support real-time sharing of information between functional
services running in different security domains. Two examples of such emerging
use cases, i.e. cyber defence information exchange and civilian-military cooperation
(CIMIC) in passive missile defence applications, are discussed in more
details below.
A. Cyber defence information exchange infrastructure
Cyber defence is quickly becoming one of the critical tasks as the military
operations rely more and more on capabilities provided by the Communications
and Information Systems (CIS). Not only must the CIS be protected before going
into operation but there must also be a capability to respond and recover from attacks
targeting these systems during their operation. In federated environments,
where no one has control over the entire system, collaboration between different
parties is critical in order to ensure effective cyber defence. However, exchange
of the relevant information is often sensitive, and requires careful control of release.
At the same time relevant information from public sources should be automatically
imported.
Therefore, the cyber defence information exchange infrastructure (CDXI)
must support both the ability to import information from public sources as well
as partners, and also ability to selectively share information. This requires a strict
control of boundary such as the one provided by the HAAG. Further, the ability
to automatically release information based on the associated metadata is critical
in order to support the strict timeliness requirements in cyber defence. An example
of CDXI architecture is shown in Figure 1.
As shown in the Figure 1, the control barrier is needed in order to ensure that
only authorized data is shared, and that only quality assured information is imported
into the organizational domain. As some of the data sources on the low side typically
will be public sources, the assurance level of the control barrier must be high.
The type of information exchanges can include vulnerability and exploit information,
incidence information, as well as a number of other types of information
that potentially could be very useful in federated incidence handling. The format
of the information should allow automated processing, as manual processing is not
time effective when trying to combat cyber-attacks.
The actual format depends on the type of information, and a number of standardization
efforts are currently underway to support such information sharing