Cyber Situation Awareness

A cyber-attack perpetrated by nation states or violent extremist groups could be as destructive as the terrorist attack on 9/11” Leon E. Panetta, US Secretary of Defense, October 2012. This paper discusses the application of User Centered and System Based approaches to cyber situation awareness. 1.0 INTRODUCTION We are increasingly dependent on the ever expanding Internet with its increasing complexities and interdependencies. While on the one hand its immensely powerful infrastructure underpins society, on the other hand its vulnerabilities to cyber-attack pose immense risks to society and national security. Cyber attackers can cause widespread network destruction remotely, anonymously and at low cost. The attacks can be conducted through distributed denial-of-service (DDOS), flooding, worms, viruses, hacking etc. [13] and [25]. In Spring 2007 the DDOS attack in Estonia targeted government websites as well as websites of banks, universities, and Estonian newspapers. After three weeks, the attacks ceased abruptly, but not before the Estonian government decided to block all international web traffic, effectively shutting off the entire country from the rest of the world. This is a vivid illustration of why cyber defence is a growing concern for safeguarding national security. In 2008, NATO set up the NATO Co-operative Cyber Defence Centre of Excellence in Tallinn. NATO 2020 states – Responding to the rising danger of cyber-attacks: NATO must “accelerate efforts to respond to the danger of cyber-attacks by protecting its own communications and command systems, helping Allies to improve their ability to prevent and recover from attacks, and developing an array of cyber defence capabilities aimed at effective detection and deterrence. ” [23]. Cyber situation awareness is vital in support of making informed decisions for maintaining a safe and secure environment [6], [8], [14] and [19]. The enhancement of the cyber operators’ situation awareness is thus the goal for any interface design. Cyber Situation Awareness 2 2 STO-EN-IST-143 2.0 CYBER SITUATION AWARENESS What is situation awareness? In the simplest term, it means being aware of ones surroundings. A search of ‘definition of situation awareness’ on Google returned 596,000 links. However, Endsley’s work on situation awareness (SA) is an established standard for the definition of SA, in particular for dynamic environments: “Situation awareness is the perception of the elements in the environment within a volume of time and space, the comprehension of their meaning and the projection of their status in the near future. ” [10]. Endsley considered that there are three stages of situation awareness, namely: (1) perception, (2) comprehension and (3) projection [10]. This links cognitive psychology with human factors in the explanation of making sense in complex situations, such as the cyber domain. In cyber defence operations all three stages are continual round the clock functions, because they are tightly interlinked. Awareness includes awareness of network services availability, confidentiality, operations and integrity, etc. It also encompasses decisions on configuration and policy, scanning mechanisms, strategy on monitoring, detection and responses. It thus requires awareness of the network infrastructure and the security aspects of both the physical and cyber domains. Effective cyber situation awareness, and thence cyber security management, must not only be reactive but pro-active, and thus be able to make predictions as to the state(s) of the situation. In order to support the users in their operations and the awareness of the cyber situation the analysts need to be able to detect, recognise, identify and communicate trends, patterns and anomalies in a timely manner [9] and [20]. To be effective security analysts must thus: • Have a constant and clear understanding of the status, health and performance of the networks; • Be able to detect, recognise and identify any patterns or trends; • Be able to detect, recognise and identify any changes or anomalies, and recognise their significance in a timely manner; • Be able to communicate, present and update the situation clearly and succinctly. The challenges faced by the analysts are: • How to manage, process, filter and analyse the massive amount of data from different data sources regarding the network activity, i.e. complex, diverse and noisy data. • How to manage the dynamic network topology. • How to understand the operation and the status of network system: • What is the purpose of the system, i.e. what does it do? • What is the network infrastructure? • Where and what are the vulnerabilities? • What are the network components? • What are the relationship and interrelationship in the network? • What are the dependencies? • What type of effect or impact? Sequential / consequential / isolated? The main challenge is how to present the massive volume of dynamic and complex data in a tractable, comprehensible and usable manner that enables the analysts to make sense of the data thus maintain effective situational awareness for cyber security [21], [22], [32], [39] and [41]. Cyber Situation Awareness STO-EN-IST-143 2 3 It is often said that a picture is worth a thousand words; in the case of cyber operations a picture is worth millions of log files. The use of visual aids is a well-established practice, they are used by humans as essential tools to help them define, understand, analyse, explore, explain and navigate their way through their tasks / problems to understand the situation. In short, cyber situation awareness encompasses the human cognitive process and the processing of data from, in effect, sensors as well as certain status information. In the complex and dynamic cyber environment, acute situation awareness greatly enhances the rate and the quality of human decision making. This paper will discuss different human machine interface design approaches applicable to addressing presentation and analysis for cyber situation awareness. 3.0 CYBER SITUATION AWARENESS AND VISUAL ANALYTICS There are different tasks in cyber security and D’Amico [7] developed a nine-way taxonomy: 1) Triage analysis: Weed out false positives, escalate suspicious activity for further analysis. 2) Escalation analysis: Analyze data over longer time and incorporate multiple data sources, which is more than the triage analysis. 3) Correlation analysis: Look for patterns and trends and assess similarity to related internal and external incidents. 4) Incidence response: Recommend, implement Courses of Action and support law enforcement investigation. 5) Malware analysis: Reverse-engineer malware and develop defences against malware. 6) Forensic analysis: Collect and preserve evidence and support law enforcement investigation. 7) Threat analysis: Characterize attackers, their identification, modus operandi, motivation and location. 8) Vulnerability analysis: Identify and prioritize vulnerabilities to manage remediation of vulnerabilities. 9) Sensor management: Develop signatures, tune sensors and modify placement of sensors. Figure 1 shows the relationship between the above first eight tasks in the three stages of situation awareness and visualization [7]; it can be seen that the three stages are inter-linked. Figure 1: Relationship Between the Stages of Situational Awareness, the Use of Visualization and the Types of Analysis Performed [7]. Cyber Situation Awareness 2 4 STO-EN-IST-143 The roles of visualization and visual analytics are essential in maintaining situation awareness. The need to explore data for patterns and anomalies as well as reporting and explaining what has been observed cut across all three stages. Triage, vulnerability and forensic analysis enable attention orientation to be conducted during the perception stage, while escalation and correlation analysis are conducted during the comprehension stage. Forensic analysis is conducted during the perception and comprehension stages and malware analysis is conducted during the comprehension and projection stages. This shows how visualization / visual analytics are used to support the analysts to assess the situation and thus make informed decisions, for instance, to manage the detected threats, i.e. how best to contain; isolate; minimise, mitigate, recover from the attacks. The three stages of situation awareness (perception, comprehension and projection) are tightly integrated and at times can be difficult to differentiate, and visualization and visual analytics provide the necessary means to support the three stages. Visual Analytics is the science of analytical reasoning facilitated by interactive visual interfaces [35]. It exploits interactive analysis, visualization and human cognitive abilities to provide an extremely powerful methodology to support situation awareness and decision making. It can provide an effective means for analysts to see, interact with, explore and compare data of different dimensions at multiple granularities and in real-time, i.e. to undertake sense making, and this allow for the detection of trends, patterns, changes, anomalies and weak points [15], [17], [26], [36] and [44]. 4.0 HUMAN MACHINE INTERFACE DESIGN APPROACHES Different approaches to human machine interface design can be adopted to address the different operational and users’ needs, for example: • User centered approaches [11], [18], [24], [35], [37] and [38] on one hand, and • System based approaches, such as the Ecological Interface Design (EID), on the other hand. An EID is an interface design specifically for complex socio-technical, real-time, and dynamic systems [40]. It is a methodology to communicate complex work domains in a cognitively effective manner through different abstraction levels [30]. These two approaches are radically different in their manner of providing situational awareness. The user centered approach focusses on the users’ and tasks’ needs, the users’ skills