Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
421
implement this kind of activities. It results in lack of one, unified classification,
because different authors use different criteria of cyber terrorist attack description.
Applying the above mentioned Ockham’s razor rule, the following classification,
according to CERT Poland (Computer Emergency Response Team), is proposed
(in alphabetical order):
• attack on email subsystem,
• attack on operational system,
• attack on a server (for e.g.: WWW, DNS – Domain Name System),
• illegal software,
• denial of service,
• dissemination of illegal and insulting, abusive content,
• scanning,
• social engineering,
• spamming.
It can also be handful to differentiate attacks and intrusions following categories:
• reconnaissance activities before an attack (intrusion)
• passwords cracking methods
• exploiting vulnerabilities and security holes (using characteristics of applications,
operating systems and protocols)
• malicious code attacks (Trojans, viruses, worms) [4].
V. Methodology of collecting information about cyber incidents
A. Characteristic of data sources and registration process
Among variety of events identified during military missions some can be
registered and observed by human senses (soldiers’ and civilians’ participating
in mission) and some other only by means technical devices (Figure 2).
Considering the scope of the ATHENA project and the characteristics of typical
military mission, which are among all:
• occurrence of asymmetric threats,
• occurrence of sudden events,
• time deficit,
• incomplete and unsure information,
• high pressure for completion of the tasks assigned and the overall goal
achievement,
it is difficult to perform a comprehensive (and complete) observations by soldiers
and civilians (e.g. the main sources of information about incidents) in the timeframe
of a mission. As a result a factual data about incidents is usually limited and
fragmentary. Thus some auxiliary sources of information should be considered:
• correctly constructed models – simulation environments, (e.g. simulation
models, war games, battlefield simulators)