SoK: Contemporary Issues and Challenges to Enable Cyber Situational Awareness for Network Security

Cyber situational awareness is an essential part of cyber defense that allows the cybersecurity operators to cope with the complexity of today's networks and threat landscape. Perceiving and comprehending the situation allow the operator to project upcoming events and make strategic decisions. In this paper, we recapitulate the fundamentals of cyber situational awareness and highlight its unique characteristics in comparison to generic situational awareness known from other fields. Subsequently, we provide an overview of existing research and trends in publishing on the topic, introduce front research groups, and highlight the impact of cyber situational awareness research. Further, we propose an updated taxonomy and enumeration of the components used for achieving cyber situational awareness. The updated taxonomy conforms to the widely-accepted three-level definition of cyber situational awareness and newly includes the projection level. Finally, we identify and discuss contemporary research and operational challenges, such as the need to cope with rising volume, velocity, and variety of cybersecurity data and the need to provide cybersecurity operators with the right data at the right time and increase their value through visualization

Insight:an application of information visualisation techniques to digital forensics investigations

As digital devices are becoming ever more ubiquitous in our day to day lives, more of our personal information and behavioural patterns are recorded on these devices. The volume of data held on these devices is substantial, and people investigating these datasets are facing growing backlog as a result. This is worsened by the fact that many software tools used in this area are text based and do not lend themselves to rapid processing by humans.This body of work looks at several case studies in which these datasets were visualised in attempt to expedite processing by humans. A number of different 2D and 3D visualisation methods were trialled, and the results from these case studies fed into the design of a final tool which was tested with the assistance of a group of individuals studying Digital Forensics.The results of this research show some encouraging results which indicate visualisation may assist analysis in some aspects, and indicates useful paths for future work

Cyber Situational Awareness and Cyber Curiosity Taxonomy for Understanding Susceptibility of Social Engineering Attacks in the Maritime Industry

The maritime information system (IS) user has to be prepared to deal with a potential safety and environmental risk that can be caused by an unanticipated failure to a cyber system used onboard a vessel. A hacker leveraging a maritime IS user’s Cyber Curiosity can lead to a successful cyber-attack by enticing a user to click on a malicious Web link sent through an email and/or posted on a social media website. At worst, a successful cyber-attack can impact the integrity of a ship’s cyber systems potentially causing disruption or human harm. A lack of awareness of social engineering attacks can increase the susceptibility of a successful cyber-attack against any organization. A combination of limited cyber situational awareness (SA) of social engineering attacks used against IS users and the user’s natural curiosity create significant threats to organizations. The theoretical framework for this research study consists of four interrelated constructs and theories: social engineering, Cyber Curiosity, Cyber Situational Awareness, and activity theory. This study focused its investigation on two constructs, Cyber Situational Awareness and Cyber Curiosity. These constructs reflect user behavior and decision-making associated with being a victim of a social engineering cyber-attack. This study designed an interactive Web-based experiment to measure an IS user’s Cyber Situational Awareness and Cyber Curiosity to further understand the relationship between these two constructs in the context of cyber risk to organizations. The quantitative and qualitative data analysis from the experiment consisting of 174 IS users (120 maritime & 54 shoreside) were used to empirically assess if there are any significant differences in the maritime IS user’s level of Cyber SA, Cyber Curiosity, and position in the developed Cyber Risk taxonomy when controlled for demographic indicators. To ensure validity and reliability of the proposed measures and the experimental procedures, a panel of nine subject matter experts (SMEs) reviewed the proposed measures/scores of Cyber SA and Cyber Curiosity. The SMEs’ responses were incorporated into the proposed measures and scores including the Web-based experiment. Furthermore, a pilot test was conducted of the Web-based experiment to assess measures of Cyber SA and Cyber Curiosity. This research validated that the developed Cyber Risk taxonomy could be used to assess the susceptibility of an IS user being a victim of a social engineering attack. Identifying a possible link in how both Cyber SA and Cyber Curiosity can help predict the susceptibility of a social engineering attack can be beneficial to the IS research community. In addition, potentially reducing the likelihood of an IS user being a victim of a cyber-attack by identifying factors that improve Cyber SA can reduce risks to organizations. The discussions and implications for future research opportunities are provided to aid the maritime cybersecurity research and practice communities

Predictions of Network Attacks in Collaborative Environment

This paper is a digest of the thesis on predicting cyber attacks in a collaborative environment. While previous works mostly focused on predicting attacks as seen from a single observation point, we proposed taking advantage of collaboration and exchange of intrusion detection alerts among organizations and networks. Thus, we can observe the cyber attack on a large scale and predict the next action of an adversary and its target. The thesis follows the three levels of cyber situational awareness: perception, comprehension, and projection. In the perception phase, we discuss the improvements of intrusion detection systems that allow for sharing intrusion detection alerts and their correlation. In the comprehension phase, we employed data mining to discover frequent attack patterns. In the projection phase, we present the analytical framework for the predictive analysis of the alerts backed by data mining and contemporary data processing approaches. The results are shown from experimental evaluation in the security alert sharing platform SABU, where real-world alerts from Czech academic and commercial networks are shared. The thesis is accompanied by the implementation of the analytical framework and a dataset that provides a baseline for future work

A Taxonomy Framework for Maritime Cybersecurity: A Demonstration Using the Automatic Identification System

The maritime transportation system is increasingly a target of cyber attacks. This paper describes a taxonomy that supports the creation of adversarial cyber models, risk mitigation, and resiliency plans as applied to the maritime industry, using the Automatic Identification System as a specific illustration of the approach. This method has already been applied to the aviation sector; retooling it for a maritime example demonstrates its broad applicability to the transportation sector, in general

A Taxonomy Framework for Maritime Cybersecurity: A Demonstration Using the Automatic Identification System

The maritime transportation system is increasingly a target of cyber attacks. This paper describes a taxonomy that supports the creation of adversarial cyber models, risk mitigation, and resiliency plans as applied to the maritime industry, using the Automatic Identification System as a specific illustration of the approach. This method has already been applied to the aviation sector; retooling it for a maritime example demonstrates its broad applicability to the transportation sector, in general

CISE as a Tool for Sharing Sensitive Cyber Information in Maritime Domain

The ECHO project aims at organizing and coordinating an approach to strengthen proactive cyber security in the European Union through effective and efficient multi-sector collaboration. One important tool for this aim is the ECHO Early Warning System (E-EWS). The development of the E-EWS will be rooted in a comprehensive review of information sharing and trust models from within the cyber domain, as well as models from other domains. In 2009, the Commission adopted a Communication Towards the integration of maritime surveillance in the EU: “A common information sharing environment for the EU maritime domain (CISE),” setting out guiding principles towards its establishment. The aim of the COM(2010)584 final was to generate a situational awareness of activities at sea and impact overall maritime safety and security. As a outcome of COM(2010)584 final, the EUCISE2020 project has developed a test-bed for maritime information sharing. This case study analyses information sharing models in the maritime domain, the EUCISE2020 test bed and the CISE itself as an alternative for cyber information sharing system. The maritime sector represents a suitable research case because it is already digitized in many aspects

Hack the room:an augmented reality game for non-experts to learn ethical hacking

Abstract. The shortage of cybersecurity skills caused by a widespread talent drought is having a signifcant economic impact on organizations globally. Several initiatives have been implemented to address this defcit, providing new educational pathways for novice and advanced students. Recently, ethical hacking gamifcation platforms and Capture the Flag (CTF) online games have risen in popularity, offering fun and engaging content that motivate beginners to acquire offensive and defensive cybersecurity skills. However, the use of augmented reality (AR) applications for cybersecurity skill development remains mostly unexplored. Against this backdrop, the overall aim of the thesis is to examine whether CTF games in AR can improve learning outcomes in information security and enhance security situational awareness. Specifcally, we explore how AR gamifcation impacts training and overall experience in the context of ethical hacking tasks. To achieve this, we have created Hack the Room, which is an ethical hacking game developed in Unity, where players use Linux terminals to solve CTF-style tasks. The game can be used for learning key cybersecurity concepts vital for organizations, and target users who have no previous cybersecurity experience, and need to be retrained for future-proofng organizations. In the game, the player has to use simple simple Linux terminal commands like listing fles in directories and reading fles stored in virtual machines hosted in the cloud (CSC Pouta) to reach the predetermined tasks. Each playthrough lasts 20 minutes and features three tasks. The game can be modifed or made more diffcult by changing the tasks in the virtual machine. The main goal of the game is to complete all of the tasks in the game. Our gamifcation concept was evaluated in a feld experiment that included six participants divided into two groups, an expert group (N=3) and a non-expert group (N=3). The expert group responded to a questionnaire that assessed their situational awareness during the game, while the non-expert group responded to a questionnaire that evaluated learning outcomes. The participants reported positive learning outcomes and high situational awareness after playing the game.Hack the room : lisätyn todellisuuden peli eettisen hakkeroinnin oppimiseen. Tiivistelmä. Pula tietoturvaosaamisesta vaikuttaa taloudellisesti organisaatioihin maailmanlaajuisesti. Tämän puutteen korjaamiseksi on tehty useita aloitteita, joissa tarjotaan oppipolkuja aloitteleville sekä edistyneemmille oppillaille. Eettisen hakkeroinnin pelillistämisalustat sekä Capture the Flag- (CTF) (suom. lipunryöstö) verkkopelit ovat lisänneet suosiotaan viime vuosina ja ne tarjoavat hyvän mahdollisuuden vasta-alkajille opetella tietoturvahyökkäämistä ja -puolustamista. Lisätyn todellisuuden hyödyntämistä tietoturvakoulutuksessa ei ole kuitenkaan tutkittu laajalti. Tässä kandidaatin tutkinnossa käsitellään lisätyn todellisuuden hyödyntämistä CTF-peleissä sekä sitä, miten lisätty todellisuus vaikuttaa tietoturvallisuuden ja turvallisuuden tilannetietoisuuden oppimiseen. Käsittelemme erityisesti, miten lisätyn todellisuuden pelillistäminen vaikuttaa harjoitteluun sekä yleiseen kokemukseen eettisissä hakkerointitehtävissä. Tämän mahdollistamiseksi loimme Hack the Roomin, joka on Unityssä kehitetty kyberturvallisuuspeli, jossa pelaajat käyttävät Linux-terminaaleja läpäistäkseen lipunryöstötyyppisiä tehtäviä. Sitä voidaan käyttää työkaluna henkilöiden tietoturvaan tutustuttamiseen, kouluttamiseen ja uudelleen opettamiseen. Pelin tehtävät koostuivat yksinkertaisista tehtävistä, joissa käytettiin Linuxkomentoja, kuten tiedostojen listaamista ja -lukemista. Jokainen pelikerta on 20 minuutin pituinen ja sisältää kolme tehtävää. Peliä voi muokata tarpeiden mukaan, esimerkiksi nostaa vaikeustasoa muuttamalla pelin virtuaalikonetta. Pelin käyttämä virtuaalikone sijaitsee CSC Pouta-palvelimella. Kehittämämme pelillistämiskonsepti evaluoitiin kenttäkokeella. Kokeessa oli 6 osallistujaa, jotka jaettiin kahteen ryhmään. Ryhmät koostuivat asiantuntijoista ja henkilöistä, joilla ei ollut aiempaa kokemusta eettisestä hakkeroinnista. Asiantuntijoiden ryhmä vastasi kyselyyn, joka mittasi heidän tilannetietoisuuttaan ja toinen ryhmä kyselyyn, joka mittasi heidän oppimistaan pelissä. Kenttäkoe osoitti sekä positiivisia oppimistuloksia, että korkeaa tilannetietoisuutta pelissä

Tabletop Exercise For Cybersecurity Educational Training; Theoretical Grounding And Development

Haridus- ja treeningaspektid on riiklike küberturvalisuse strateegiate vitaalsed komponendid, et kujundada, tugevdada ning proovile panna otsustajate valmisolekut nii aktuaalsete kui võimalike tulevaste küberväljakutsete ees. Küberkaitses ja -julgeolekus on otsuste langetamisel üliolulised kriisijuhtimisoskused, et suuta adekvaatselt vastata juhtumitele, mil era- või avalik heaolu ja turvalisus on ohustatud. Selle magistritöö eesmärk on välja pakkuda küberjulgeoleku strateegiate hariduslike komponentide võimalike ning teadaolevate nõrkuste parandamine, arutledes teadlikkuse väljaõpete mudeleid märkimisväärse mõjuga osavõtjatele, fookusega strateegilise otsustamisvõimega personalil, mis võiks osaleda küberjuhtumis. Töö toetab simulatsioonil põhinevate stsenaariumite kasutamist ning keskendub mudelõppuste kujundamisele. Käesolev töö näitab, kuidas mudelõpe võib olla tõhus viis küberjuhtumites strateegiliste otsuste langetamisel teadlikkuse, mõistmise ja ettevalmistuse kujundamiseks, parandamiseks ning proovilepanemiseks. Lõputöö tugineb ditsiplinaarsel ja kontseptuaalsel õpinguteooriate integratsioonil mängustamisel põhinevate ajenditega ning juhtimisteooriatega. Stsenaariumil põhinev treening pakub turvalist ja paindlikku keskkonda, kus osavõtja on pandud kriitilisse situatsiooni, säilitades realistlikku ülevaate küberkriisi tunnustest ning võimalikest ohtudest. Simulatsioon väljendab võimalikke väljakutseid, nõudes kriisijuhtimisoskusi ning kohast reaktsiooni. Mudelõppused võimaldavad andragoogilise kasu ja hariduslike eesmärkide realiseerimist innovatiivsel ja kaasaval meetodil. Selle treeningmudeli tulemused mõõdetakse kasutades Bloomi õppe-kasvatustöö eesmärkide liigituse kontrollitud taksonoomiat, arvesse võttes kogemusõppe ja paiknevustunnetuse elemente. VOOT-tsükkel pakub läbimõeldud otsustusprotsessi, mis samuti sobib antud ettepaneku dünaamikasse. Lisaks panustab töö originaalse modulaarse juhendiga, mida treenijad ning õppejõud saavad kasutada mudelõppe teostamiseks küberjulgeolekus. Riikliku ja rahvusvahelise tasandi mudelõppuste kogemus ja osavõtt sai empiirilist tuge teoreetilisele integratsioonile ning teadustas modulaarse juhendi arengut. Töö on kvalitatiivne. Lõputöö panustab asjakohasesse akadeemilisse dialoogi selle teoreetiliste alustega. Samuti praktiliselt, kuna pakub vahendeid simulatsioonipõhise mudelõppe läbiviimiseks.Education and training aspects are vital components of national cybersecurity strategies, to shape, enhance and test the decision maker’s level of preparedness before current and future challenges that can arise from a cyber incident. Decision-making processes in cyber defense and security require crucial crisis management competences capable of generating a comprehensive response where safety, well-being and other public and private assets could be put at stake. The purpose of this thesis is to suggest the improvement of potential and perceived weaknesses on the educational components of cyber security strategies, discussing awareness-training models with significant impact on the participants, focusing on strategic decision-making level personnel that could partake of cyber related incidents. The work supports the use of simulation-based scenarios, and concentrates on the design of Tabletop exercises. This thesis shows when a tabletop exercise could be an effective mechanism to shape, enhance and test the awareness, understanding and preparation for strategic decision makers in cyber related incidents. The thesis draws from a disciplinary integration of learning, human computer interaction, and management theories. A scenario-based training provides a safe and flexible environment where the participant is placed into a critical situation while maintaining a realistic insight into the characteristics of cyber crisis and the threats and attacks that may take place. The simulation represents possible challenges, demanding crisis management capacity and an appropriate response. Tabletop exercises permits that andragogical benefits and educational purposes be realized through an innovative and engaging method. Considering elements from experiential learning and situated cognition the learning outcomes of this training model will be measured, using Bloom’s revised taxonomy of educational objectives. The OODA Loop will suggest a thoughtful decision making process that also fits well the dynamic of the current proposal. Additionally, the thesis will contribute with an original modular guide that trainers and educators can use for the implementation of a Tabletop exercise on cyber security. National and international level tabletop exercises experience and participation provided empirical support to the theoretical contribution on theory integration, and informed the modular guide development. The work is qualitative and therefore seeks to observe, interpret and understand, by using documental analysis, and observation methods. The work contributes to the relevant academic dialog on its theoretical grounds and also in practical terms, by providing with tools readily applicable to the creation of simulation based tabletop exercises