Visible to the public Beyond technical data - a more comprehensive situational awareness fed by available intelligence information

TitleBeyond technical data - a more comprehensive situational awareness fed by available intelligence information
Publication TypeConference Paper
Year of Publication2014
AuthorsKornmaier, A., Jaouen, F.
Conference NameCyber Conflict (CyCon 2014), 2014 6th International Conference On
Date PublishedJune
Keywordsadversary capabilities, Bibliographies, Charge coupled devices, civil environment, civil information providers, Context, cyber, cyber analysis, cyber incidents, cyber intelligence, cyber space, cyber threats, decision makers, decision making, information categories, information collection fusion, information resources, information sources, intelligence, intelligence information, intelligence processing, Malware, military environment, military information providers, security of data, situational awareness, Solids, technical data, threat information, vulnerability information

Information on cyber incidents and threats are currently collected and processed with a strong technical focus. Threat and vulnerability information alone are not a solid base for effective, affordable or actionable security advice for decision makers. They need more than a small technical cut of a bigger situational picture to combat and not only to mitigate the cyber threat. We first give a short overview over the related work that can be found in the literature. We found that the approaches mostly analysed "what" has been done, instead of looking more generically beyond the technical aspects for the tactics, techniques and procedures to identify the "how" it was done, by whom and why. We examine then, what information categories and data already exist to answer the question for an adversary's capabilities and objectives. As traditional intelligence tries to serve a better understanding of adversaries' capabilities, actions, and intent, the same is feasible in the cyber space with cyber intelligence. Thus, we identify information sources in the military and civil environment, before we propose to link that traditional information with the technical data for a better situational picture. We give examples of information that can be collected from traditional intelligence for correlation with technical data. Thus, the same intelligence operational picture for the cyber sphere could be developed like the one that is traditionally fed from conventional intelligence disciplines. Finally we propose a way of including intelligence processing in cyber analysis. We finally outline requirements that are key for a successful exchange of information and intelligence between military/civil information providers.

Citation Key6916400