Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
417
In this article, the formalised sheet for collecting factual data related to cyberspace
is introduced. The data from such a sheet would in turn constitute one
record in a repository of past incidents from cyberspace (Figure 1). Some number
of incidents collected in a repository will evidence information about security
breaches in telecommunication and IT systems – namely cyber security incidents.
For sake of clarifying nomenclature used in this article the following concepts
definitions are given:
• factual data – is a set of facts and/or activities in the area of: collection, selection
and assessment of usability of information being stored and further
used in respect of reflecting past incidents in an overall picture;
• cyber security incident – this notion should be understood as an overall set
of events that threatens network security, that is each activity that results
in a direct threat to security level.
Especially the following list of events is considered here:
• threats to the availability of networked services (e.g. DoS attacks),
• intrusion and/or attempt of intrusion to telecommunication and information
technology system,
• spamming,
• spreading of malicious codes, viruses.
It is important to notice that only limited set of (carefully processed) past cyber
events registered in a repository will eventually get the status of security incidents.
This paper is structured as follows – first authors introduce motivation that
has led them towards publication of this paper. In chapter III the subject of “cyber
incidents collection” for military is introduced. Eventually the collection process
of factual data is proposed in chapter IV. Methodology of collecting information
about cyber incidents is introduced in Chapter V. Finally conclusions are drawn and
a sample cyber observation sheet is delivered filled with exemplary information.
II. Motivation
In the process of designing the Cyber Tool software component in the EDA
Athena project authors have faced serious exploitation-oriented challenges related
to the lack of data about vulnerabilities required as an input for the tool. In order
to be able to deliver expected benefits attributed to the tool, the following showstoppers
need to be resolved:
• lack of (ready-to use) repositories containing verified knowledge about
vulnerabilities of IT systems used in military. On the other hand, existing
civil repositories of vulnerabilities (e.g. SCADA systems – Supervisory
Control And Data Acquisition) are publicly available. However, it is difficult
to determine their relevance to the military domain
• unavailability of knowledge (or lack thereof) about existing methodology,
that would allow gathering of information about cyber threats in the mili-