Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
423
ing) is also potential source of information changes (corruption). In example
the missile guidance systems rely only on primary information, which proves how
important primary information can be considered. Within the process of cyber
incidents data acquisition a multiple limitations (boundary conditions) have to
be considered:
• this process relies on a very formal set of (field) documents, e.g: OPORD
(OPerational ORDer, operational order), FRAGO (FRAGmentary Order,
more specific, fragmentary OPORD),
• incorrect (inappropriate) training of personnel responsible for implementation
of an observation process (for e.g. too high/low sensitivity threshold),
• time limitation during debriefing,
• presence of typical psychological barriers of a soldier/civilian during
the AAR (After Action Review) stage
• lack of contextual knowledge, needed to associate events to each other,
• most of the factual data is rather plain text than reach multimedia content.
The example of typical psychological barriers of a soldier during AAR stage
can be among all:
• details, which can negatively influence opinion, assessment of activities
of other soldiers,
• observations, which seem to be irrelevant, infantile,
• emotional states, which may indicate weaknesses of soldiers and result
in lack of acceptance or ridiculousness (abnormal, excessive fear, caution,
tendency to recklessness, taking excessive risk),
B. Formalization of the process of collecting information about cyber
incidents in cyberspace
The incident observation control sheet, which is an integral part of the method
of collecting information about incidents consists of four main sections: start, event/
incident itself, status of the observer and the end (Figure 3).
The following information should be included in particular sections of such
sheet:
1. Indication of the starting point of the observation (location, time)
2. Event/incident itself, description of observation with parameters
3. The status of an observer (data, which could be combined for the purpose
of identification of a person, who formalizes observation materials and
information, which makes possible to assess the level of competence of this
person);
4. The endpoint of the observation (location, time).
Proposed methodology covers both – the AAR (After Action Review), debriefing
and other materials acquired automatically through technical devices (both
civilian and military).