Military Communications and Information Technology: A Trusted ...

424 Military Communications and Information Technology...
Figure 3. Division of the incident observation sheet onto two basic parts: observed incident
and status of the observer
The universal character of proposed methodology stems from the fact that
particular sections of the incident observation sheet are also valid for describing
parameters with observations from every other sources of information both civilian
and military (from mission plans and mission reports) and technical devices
used for collecting factual data. The stage of collecting cyber incidents ends by filling
particular sections of the observation sheet with content. Underlying information
sources consist of a set of:
• factual data about incidents in civilian security domain (registered for e.g.
by NASK – Research and Academic Computer Network).
• military documents about planning, execution and debriefing of a mission
• factual data reported by ICT systems, which covers e.g. network traffic,
reports from port scanning, number and size of transferred batches.
Every single entry inserted into incident database can be packaged as paper or/
and an electronic form. Proposed information structure (parameters) of database
records is presented in the following sub-section. All information which will not
be selected for inclusion into the observation sheet are considered to be irrelevant.
This way information from the data sources about single cyber incident is carefully
selected (Figure 4).
C. Recommendations for the gathering process
Every role involved in the process of cyberspace data gathering should obey
a well-defined set of rules in order to assure reliability of results. These rules concern
among all:
• focusing on particular objects (e.g. central, base station, access to active
network elements, type of software) and processes (e.g. way of communication,
activities coordination),
• omitting irrelevant details (they are defined separately for every mission
and type of event),
• using one or a well-defined set of recording techniques (paper notes, photos,
videos, mind mapping, other)