Saturday, November 06, 2004
2005 BCNGroup Report to the
Congress
On the new work about cA. eC, gFT
and the generative methodology
On the Nature of science and
cultural Polemics à
On the discussion of data
regularity à
On the Stephenson Cyber Attack
Taxonomy à
Communication from Peter Stephenson
Paul,
The conjecture that there exists a set of universal countermeasures suggests that we will soon completely eliminate risk in information systems. Universal countermeasures will not merely eliminate the perception of risk, or the need to analyze it. Universal countermeasures will eliminate the types of cyber security concerns that now define the field and the business of information assurance.
So new concerns will develop, but these concerns will be better defined and will require less social resources. What replaces the IA industry is a new type of information science, as you have suggested in your preface.
In order to validate the value of a Theory of Cyber Attack Mechanics, we need to relate the concepts that surround cyber attacks to a structured ontology. Once we understand Cyber Attack Mechanics, we can apply that understanding to the protection of information systems.
As a starting point, we bring together foundational definitions, lemmas and theorems. We develop the details of cyber event-space structured ontology. These are related directly to cyber events, using some type of substructural instrumentations and some subsetting of the second level systems ontology. The universal countermeasures are defined at the third layer of abstraction and are related directly to a policy document.
This is a many-layered project. As we work on the Cyber Attack Taxonomy, derived, as we discussed, from a structural ontology of cyber attacks, we also are developing rudimentary groundwork that can, over time and with further work, be revealed as axiomatic.
Please have a look at the below definitions, lemmas and theorems and offer your comments. We are working on the algorithms to go along with these and am making good progress. We expect a preliminary paper by 1 December, the deadline for the IFIP 11.9 conference submissions.
Others in the core team may make comments on this preliminary outline, and we will change this outline as issues are visited.
Definitions
1. Incident: A computer
security incident is a change of state in a bounded computer system from the
desired state to an undesired state, where the state change is caused by the
application of a stimulus external to the system. This is the conflict of the
exophysics on the endophysics.
2. Vulnerability: Vulnerability
is a weakness or flaw, in an element of a system, which has the potential to be
exploited with a damaging outcome.
3. Threat: A threat is a
natural disaster, an unintentional act by an individual that causes harm or a
malicious act by an individual or group of individuals.
4. Impact: An impact is an
unwanted or adverse effect on a system or organization that an incident would
cause. The formal notation reveals this
as a change of system state.
5. Risk: Information Systems Risk is the probability that a threat agent will successfully exploit a vulnerability to create an unwanted or adverse impact.
Lemmas
1. Attack Occurrence: An attack is a threat applied to a vulnerability such that there
exists a non-empty set of one or more threat-vulnerability relationships, from
the attack ontology referential base, that yields an impact.
2. Incident Occurrence: A
computer security incident occurs when a cyber attack results in an impact.
3. Presence of Risk: An information system risk is present when a computer security incident can occur.
Theorems
1. Neutralization of Cyber
Attacks: A cyber attack is neutralized by eliminating the threat, vulnerability
or impact comprising it.
2. Elimination of Risk:
Information system risk is eliminated by neutralizing the corresponding cyber
attacks.