Toward a Military Smart Cyber Situational Awareness (CSA)

TL;DR

This paper reviews five Cyber Situational Awareness platforms, proposes six criteria for military smart CSA development, and validates these criteria using the open-source CRUSOE platform to enhance cyber defense strategies.

Contribution

It introduces six criteria for creating military smart CSA platforms and validates them through modifications and experiments on the CRUSOE platform.

Findings

CRUSOE platform can be adapted for military CSA use

Proposed criteria differentiate CSA platform features

Validation shows applicability to cyber defense context

Abstract

The development of technology across multiple sectors and the growing importance of cyber warfare make the development of Cyber Situational Awareness (CSA) a fundamental component of any cyber defense strategy. CSA, as a practice, enables understanding of the current landscape within an organization or critical infrastructure, anticipating potential threats, and responding appropriately to cyber risks. With CSA, we are not simply seeking a passive point of view, but rather informed decision-making that allows us to improve response times and monitor the consequences and effects an attack has on one of our elements and how it will affect other elements it interacts with. In this paper, we review 5 CSA platforms, seeking differentiating characteristics between each proposal and outlining 6 proposed criteria that can be applied when creating a military smart CSA platform. To this end, we have validated the proposed criteria in CRUSOE, an open-source CSA platform developed by CSIRT-MU. After applying some modifications and experiments, it turned out to be applicable to this field.