Visible to the public On the Use of Cyber Threat Intelligence (CTI) in Support of Developing the Commander's Understanding of the Adversary

TitleOn the Use of Cyber Threat Intelligence (CTI) in Support of Developing the Commander's Understanding of the Adversary
Publication TypeConference Paper
Year of Publication2019
AuthorsParmar, Manisha, Domingo, Alberto
Conference NameMILCOM 2019 - 2019 IEEE Military Communications Conference (MILCOM)
Keywordsadvanced persistent threats, Adversary Attribution, Adversary Models, adversary tactics, ATT&CK framework, ATT&CK®, communication and information system security, Computer crime, CTI field, cyber related crimes, cyber threat intelligence, Cyberspace, cyberspace operations, deception techniques, decision making process, Decoys, Human Behavior, indicators of compromise, Metrics, military computing, military organization, Mission planning, NATO Allied Command Transformation, NATO Communication and Information Agency, Organizations, pubcrawl, Resiliency, Scalability, security, Servers, Testing, threat models, Tools, Workstations
AbstractCyber Threat Intelligence (CTI) is a rapidly developing field which has evolved in direct response to exponential growth in cyber related crimes and attacks. CTI supports Communication and Information System (CIS)Security in order to bolster defenses and aids in the development of threat models that inform an organization's decision making process. In a military organization like NATO, CTI additionally supports Cyberspace Operations by providing the Commander with essential intelligence about the adversary, their capabilities and objectives while operating in and through cyberspace. There have been many contributions to the CTI field; a noteworthy contribution is the ATT&CK® framework by the Mitre Corporation. ATT&CK® contains a comprehensive list of adversary tactics and techniques linked to custom or publicly known Advanced Persistent Threats (APT) which aids an analyst in the characterization of Indicators of Compromise (IOCs). The ATT&CK® framework also demonstrates possibility of supporting an organization with linking observed tactics and techniques to specific APT behavior, which may assist with adversary characterization and identification, necessary steps towards attribution. The NATO Allied Command Transformation (ACT) and the NATO Communication and Information Agency (NCI Agency) have been experimenting with the use of deception techniques (including decoys) to increase the collection of adversary related data. The collected data is mapped to the tactics and techniques described in the ATT&CK® framework, in order to derive evidence to support adversary characterization; this intelligence is pivotal for the Commander to support mission planning and determine the best possible multi-domain courses of action. This paper describes the approach, methodology, outcomes and next steps for the conducted experiments.
Citation Keyparmar_use_2019