An Introduction to Cyber Modeling and Simulation

Jerry M. Couretas

• Publisher: Wiley
• Year: 2018
• Print ISBN: 9781119420873
• eBook ISBN: 9781119420835
• Edition: 1
• Topic: Technology & Engineering
• Subtopic: Materials Science
• Index: Technology & Engineering

Introduces readers to the field of cyber modeling and simulation and examines current developments in the US and internationally

This book provides an overview of cyber modeling and simulation (M&S) developments. Using scenarios, courses of action (COAs), and current M&S and simulation environments, the author presents the overall information assurance process, incorporating the people, policies, processes, and technologies currently available in the field. The author ties up the various threads that currently compose cyber M&S into a coherent view of what is measurable, simulative, and usable in order to evaluate systems for assured operation.

An Introduction to Cyber Modeling and Simulation provides the reader with examples of tools and technologies currently available for performing cyber modeling and simulation. It examines how decision-making processes may benefit from M&S in cyber defense. It also examines example emulators, simulators and their potential combination. The book also takes a look at corresponding verification and validation (V&V) processes, which provide the operational community with confidence in knowing that cyber models represent the real world. This book:

• Explores the role of cyber M&S in decision making
• Provides a method for contextualizing and understanding cyber risk
• Shows how concepts such the Risk Management Framework (RMF) leverage multiple processes and policies into a coherent whole
• Evaluates standards for pure IT operations, "cyber for cyber, " and operational/mission cyber evaluations—"cyber for others"
• Develops a method for estimating both the vulnerability of the system (i.e., time to exploit) and provides an approach for mitigating risk via policy, training, and technology alternatives
• Uses a model-based approach

An Introduction to Cyber Modeling and Simulation is a must read for all technical professionals and students wishing to expand their knowledge of cyber M&S for future professional work.

1
Brief Review of Cyber Incidents

When it comes to national security, I think this [i.e., cyber warfare] represents the battleground for the future. I’ve often said that I think the potential for the next Pearl Harbor could very well be a cyber‐attack. If you have a cyber‐attack that brings down our power grid system, brings down our financial systems, brings down our government systems, you could paralyze this country.¹

Leon Panetta

The 1988 Morris Worm, designed to estimate the size of the Internet, caused the shutting down of thousands of machines and resulted in the Defense Advanced Research Projects Agency (DARPA) funding the first Computer Emergency Response Team (CERT) at Carnegie Mellon University (CMU). As shown in Table 1.1, cyberattacks have continued since 1988, with effects that range from data collection to controlling critical infrastructure.

Table 1.1 Select cyber incidents.

Year	Cyberattack	Objective	Effects
1988	Morris Worm	Understand the number of hosts connected to the Internet	Removed thousands of computers from operation
2003	Slammer Worm	Denial of service	Disabled Ohio's Davis–Besse nuclear power plant safety monitoring system for nearly 5 h
2008	Conficker	Implant malware on target machines	Control target machines
2010	STUXNET	Take control of Siemens industrial control systems (ICS’)	Destroyed centrifuges used for Iranian nuclear program
2012	Saudi Aramco (oil provider) business systems (aka Al Shamoon)	Wipe disks on Microsoft Windows‐based systems	Destroyed ARAMCO business systems to cause financial losses due to their inability to bill customers for oil shipments
2013	South Korean Banks	“DarkSeoul” virus used to deny service and destroy data	Destroyed hard drives of selected business systems
	US Banks	Distributed Denial of Service (DDoS)	Caused financial losses through banks’ inability to serve customers
	Rye Dam (NY)	Access control gates for opening and closing at will	Controlled dam gate system
2014	Sony Pictures	Data breach	Downloaded a large amount of data and posted it on the Internet; 3 wk before the release of a satirical film about North Korea
2015	Office of Personnel Management (OPM) breach	Gain access to information on US Government Personnel	Downloaded over 21 million US Government and contractor personnel files
2017	Equifax breach	Gain access to consumer credit information	Downloaded credit history and private information on over 143 million consumers

Table 1.1 also provides a mix of documented cyber incidents, with only the Morris Worm in question, as to malevolent intent. Due to the multiple actors and actions, involving cyberattacks, a conversation around “resilience” (e.g. NIST Cybersecurity Framework) provides a means for communicating about how the overall system will continue to perform, in the face of adversity. In addition, resilience frames the discussion about an organization’s operational risk; due to cyber, in this case. More specifically, the resilience view provides a means to organize the challenges associated with measuring and quantifying the broad scope of an organization’s cyberattack surface by:

1. Recognizing that the autonomy and efficiencies that information systems provide are too valuable to forego, even if the underlying technologies provide a potential threat to business operations.
2. Understanding that cyber “security” (i.e. the ability to provide an effective deterrent to cyberattacks) is not achievable for most organizations in the short term, so resilience is one way to develop organizational policies and processes around
   1. mitigation scenarios for general cyberattacks
   2. comparing tacitly accepted cyber risk to business risks that we already transfer (e.g. hurricanes, earthquakes, natural disasters, etc.) to other organizations (e.g. insurance companies).
3. Coordinating the challenges associated with an organization’s people being a key source of cyber vulnerability.

Resilience, therefore, provides an overarching approach, with some elements already modeled, for bundling the exposure associated with cyber and moving the discussion to a more manageable set of risks; analogous to operational challenges already mitigated or transferred through an organization’s policies and processes. In addition, cyber risk management requires analytical evaluation and testable scenarios that enable contingency planning for each respective organization. Cyber risk assessment is a growing area of interest, and an inspiration for developing cyber modeling and simulation techniques.

1.1 Cyber’s Emergence as an Issue

The issue of cyber security, somewhat slow to be recognized during information technology’s rapid rate of development and dissemination into business enterprises over the last half century, often gets the same level of news coverage as natural disasters or stock market anomalies. While an Office of Personnel Management (OPM)² breach disclosing the private information of millions of US civil servants gets a few days of news, a new iPhone release will create weeks of chatter on social networks. Cyber insecurity is much less interesting to the general public than the Internet’s entertainment and socialization prospects.

The same market growth for personal computing technologies, however, adds to unforesee...

Table of contents

• Cover
• Table of Contents
• 1 Brief Review of Cyber Incidents
• 2 Cyber Security – An Introduction to Assessment and Maturity Frameworks
• 3 Introduction to Cyber Modeling and Simulation (M&S)
• 4 Technical and Operational Scenarios
• 5 Cyber Standards for Modeling and Simulation
• 6 Cyber Course of Action (COA) Strategies
• 7 Cyber Computer‐Assisted Exercise (CAX) and Situational Awareness (SA) via Cyber M&S
• 8 Cyber Model‐Based Evaluation Background
• 9 Cyber Modeling and Simulation and System Risk Analysis
• 10 Cyber Modeling & Simulation (M&S) for Test and Evaluation (T&E)
• 11 Developing Model‐Based Cyber Modeling and Simulation Frameworks
• 12 Appendix: Cyber M&S Supporting Data, Tools, and Techniques
• Bibliography
• Index
• End User License Agreement