Enhancing Strategic Information Security Management in Organizations through Information Warfare Practices

Today’s organizations use control-centred security management systems as a preventative shield against a broad spectrum of attacks. However, these have proven to be less effective against the customized and innovative strategies and operational techniques used by Advanced Persistent Threats (APTs). In this short paper we argue that to combat APTs, organizations need a strategic-level shift away from a traditional prevention-cantered approach to that of a response-cantered one. Drawing on the information warfare (IW) paradigm in military studies, and using Dynamic Capability Theory (DCT), this research examines the applicability of IW capabilities in the corporate domain. We propose a research framework to argue that conventional prevention-centred response capabilities; such as incident response capabilities and IW-centred security capabilities can be integrated into IW-enabled dynamic response capabilities that improve enterprise security performance

Towards Identifying Human Actions, Intent, and Severity of APT Attacks Applying Deception Techniques -- An Experiment

Attacks by Advanced Persistent Threats (APTs) have been shown to be difficult to detect using traditional signature- and anomaly-based intrusion detection approaches. Deception techniques such as decoy objects, often called honey items, may be deployed for intrusion detection and attack analysis, providing an alternative to detect APT behaviours. This work explores the use of honey items to classify intrusion interactions, differentiating automated attacks from those which need some human reasoning and interaction towards APT detection. Multiple decoy items are deployed on honeypots in a virtual honey network, some as breadcrumbs to detect indications of a structured manual attack. Monitoring functionality was created around Elastic Stack with a Kibana dashboard created to display interactions with various honey items. APT type manual intrusions are simulated by an experienced pentesting practitioner carrying out simulated attacks. Interactions with honey items are evaluated in order to determine their suitability for discriminating between automated tools and direct human intervention. The results show that it is possible to differentiate automatic attacks from manual structured attacks; from the nature of the interactions with the honey items. The use of honey items found in the honeypot, such as in later parts of a structured attack, have been shown to be successful in classification of manual attacks, as well as towards providing an indication of severity of the attack

CyberGenomics: Application of behavioral genetics in cybersecurity

Cybersecurity (CS) is a contemporary field for research and applied study of a range of aspects from across multiple disciplines. A cybersecurity expert has an in-depth knowledge of technology but is often also recognized for the ability to view technology in a non-standard way. This paper explores how CS specialists are both a combination of professional computing-based skills and genetically encoded traits. Almost every human behavioral trait is a result of many genome variants in action altogether with environmental factors. The review focuses on contextualizing the behavior genetics aspects in the application of cybersecurity. It reconsiders methods that help to identify aspects of human behavior from the genetic information. And stress is an illustrative factor to start the discussion within the community on what methodology should be used in an ethical way to approach those questions. CS positions are considered stressful due to the complexity of the domain and the social impact it can have in cases of failure. An individual risk profile could be created combining known genome variants linked to a trait of particular behavior using a special biostatistical approach such as a polygenic score. These revised advancements bring challenging possibilities in the applications of human behavior genetics and CS.publishedVersio

Advanced Persistent Threats in Cybersecurity – Cyber Warfare

This book aims to provide a comprehensive analysis of Advanced Persistent Threats (APTs), including their characteristics, origins, methods, consequences, and defense strategies, with a focus on detecting these threats. It explores the concept of advanced persistent threats in the context of cyber security and cyber warfare. APTs represent one of the most insidious and challenging forms of cyber threats, characterized by their sophistication, persistence, and targeted nature. The paper examines the origins, characteristics and methods used by APT actors. It also explores the complexities associated with APT detection, analyzing the evolving tactics used by threat actors and the corresponding advances in detection methodologies. It highlights the importance of a multi-faceted approach that integrates technological innovations with proactive defense strategies to effectively identify and mitigate APT

Amenințările persistente avansate în securitatea cibernetică – Războiul cibernetic

O analiză cuprinzătoare a Amenințărilor Persistente Avansate (Advanced Persistent Threats, APT), inclusiv caracteristicile, originile, metodele, consecințele și strategiile de apărare ale acestora, cu accent pe detectarea acestor amenințări. Se explorează conceptul de amenințări persistente avansate în contextul securității cibernetice și al războiului cibernetic. APT reprezintă una dintre cele mai insidioase și provocatoare forme de amenințări cibernetice, caracterizate prin sofisticarea, persistența și natura lor țintită. Această carte analizează originile, caracteristicile și metodele folosite de actorii APT. De asemenea, explorează complexitățile asociate cu detectarea APT, analizând tacticile evolutive folosite de actorii amenințărilor și a progreselor corespunzătoare în metodologiile de detectare. Cartea subliniază importanța abordării cu mai multe fațete, care integrează inovații tehnologice cu strategii proactive de apărare pentru a identifica în mod eficient și atenua APT

Les menaces persistantes avancées en cybersécurité – La guerre cybernétique

Ce livre vise à fournir une analyse complète des menaces persistantes avancées, y compris leurs caractéristiques, origines, méthodes, conséquences et stratégies de défense, en mettant l'accent sur la détection de ces menaces. Il explore le concept de menaces persistantes avancées dans le contexte de la cybersécurité et de la cyberguerre. Les menaces persistantes avancées représentent l’une des formes de cybermenaces les plus insidieuses et les plus complexes, caractérisée par leur sophistication, leur persistance et leur nature ciblée. Le livre examine les origines, les caractéristiques et les méthodes utilisées par les acteurs des menaces persistantes avancées. Il explore également les complexités associées à la détection des menaces persistantes avancées, en analysant l'évolution des tactiques utilisées par les acteurs de la menace et les avancées correspondantes dans les méthodologies de détection. Il souligne l’importance d’une approche multidimensionnelle intégrant les innovations technologiques à des stratégies de défense proactives pour identifier et atténuer efficacement les menaces persistantes avancées

Strategies Using Threat Intelligence to Detect Advanced Persistent Threats: A Qualitative Case Study

Advanced persistent threats (APTs) targeting critical infrastructures can adversely impact human lives. Cyber security analysts are concerned with APT attacks because they make it challenging to defend critical infrastructures. Grounded in routines activity theory (RAT), the purpose of this qualitative exploratory multiple case study was to explore strategies cybersecurity analysts use to defend critical infrastructures from APT attacks. Data were collected through interviews with 8 participants and documents from two organizations. Participants were required to have experience analyzing network traffic on a critical infrastructure network, one year of cyber threat hunting experience, prior or current knowledge of cyber threat intelligence (CTI) and reside in the Southwestern and Northeastern United States. Through thematic analysis, four themes emerged: (a) CTI and threat hunting are part of the defense-in-depth strategy, (b) the lack of standards on CTI and threat hunting has created numerous challenges, (c) CTI informs threat hunting, and (d) threat hunting consists of looking at behaviors, not IOCs. A key recommendation is for cyber security analysts to enhance their defense strategies by incorporating threat hunting and cyber threat intelligence into their playbooks. The implications for positive social change include the potential to protect critical infrastructures and support the local community welfare

Nuevas perspectivas en el estudio de amenazas persistentes avanzadas

[ES] Una amenaza persistente avanzada es un ataque sofisticado, dirigido, selectivo y personalizado, que representa un riesgo para todas las organizaciones, especialmente aquellas que gestionan datos confidenciales o son infraestructuras críticas. En los últimos años, el análisis de estas amenazas ha llamado la atención de la comunidad científica; los investigadores han estudiado el comportamiento de esta amenaza para crear modelos y herramientas que permitan la detección temprana de estos ataques. El uso de la inteligencia artificial y el aprendizaje automático pueden ayudar a detectar, alertar y predecir automáticamente este tipo de amenazas y reducir el tiempo que el atacante puede permanecer en la red de la organización. El objetivo de esta tesis es desarrollar un modelo teórico que permita detectarlas amenazas persistentes avanzadas de manera temprana, basado en el ciclo de vida del ataque y utilizando métodos y técnicas de aprendizaje automático. La metodología que se ha seguido para la realización de este trabajo comenzó con una revisión bibliográfica de los conceptos de amenaza persistente avanzada y de las aplicaciones de detección en el contexto de la ciberseguridad. Además, se analizaron los ciclos de vida existentes que explican el proceso que siguen estas amenazas durante su ejecución. Posteriormente, se desarrolló un modelo para la detección temprana de las amenazas persistentes avanzadas basado en un ciclo de vida de 6 etapas, que han sido divididas en etapas activas, pasivas y recurrentes; además, se han utilizado técnicas de aprendizaje automático para la detección de URL maliciosas, phishing y anomalías en la red. En conclusión, los ataques de amenazas persistentes avanzadas son difíciles de detectar debido a la capacidad y los recursos con los que cuentan los grupos que las desarrollan. El objetivo de estos ataques es permanecer activos el mayor tiempo posible durante la ejecución de la intrusión. Uno de los problemas detectados durante la realización de este trabajo ha sido que no se encuentran disponibles conjuntos de datos reales que permitan el entrenamiento de los algoritmos de aprendizaje automático de forma eficiente, por lo que ha sido necesario crear conjuntos de datos semi reales a partir de muestras de malware. Finalmente, como trabajo futuro, se recomienda que el modelo que ha sido propuesto en este trabajo sea probado en un entorno informático controlado, para evitar ocasionar perjuicios