Cyber Deception
This chapter outlines a concept for integrating cyber denial and deception (cyber D&D) tools, tactics, techniques, and procedures (TTTPs) into an adversary modeling system to support active cyber defenses (ACD) for critical enterprise networks. We describe a vision for cyber D&D and outline a general concept of operation for the use of D&D TTTPs in ACD. We define the key elements necessary for integrating cyber D&D into an adversary modeling system. One such recently developed system, the Adversarial Tactics, Techniques and Common Knowledge (ATT&CKTM) Adversary Model is being enhanced by adding cyber D&D TTTPs that defenders might use to detect and mitigate attacker tactics, techniques, and procedures (TTPs) We describe general D&D types and tactics, and relate these to a relatively new concept, the cyber deception chain. We describe how defenders might build and tailor a cyber deception chain to mitigate an attacker's actions within the cyber attack lifecycle. While we stress that this chapter describes a concept and not an operational system, we are currently engineering components of this concept for ACD and enabling defenders to apply such a system. Traditional approaches to cyber defense increasingly have been found to be inadequate to defend critical cyber enterprises. Massive exploitations of enterprises, Authors: Frank J. Stech, Kristin E. Heckman, and Blake E. Strom, the MITRE Corporation (stech@mitre.org, kheckman@mitre.org, and bstrom@mitre.org) Approved for Public Release; Distribution Unlimited. Case Number 15 2851. The authors' affiliation with The MITRE Corporation is provided for identification purposes only, and is not intended to convey or imply MITRE's concurrence with, or support for, the positions, opinions or viewpoints expressed by the authors. Some material in this chapter appeared in Kristin E. Heckman, Frank J. Stech, Ben S. Schmoker, Roshan K. Thomas (2015) "Denial and Deception in Cyber Defense," Computer, vol. 48, no. 4, pp. 36 44, Apr. 2015. http:/doi.ieeecomputersociety.org/10.1109/MC.2015.104 F.J. Stech K.E. Heckman B.E. Strom MITRE Corporation, Mclean, VA, USA e mail: stech@mitre.org; kheckman@mitre.org; bstrom@mitre.org (c) Springer International Publishing Switzerland 2016 S. Jajodia et al. (eds. Cyber Deception, DOI 10.1007/978 3 319 32699 3_1 1 The original version of this chapter was revised. An erratum to this chapter can be found at DOI 10.1007/978 3 319 32699 3_13
Springer International Publishing