MISSION AWARE: Evidence-Based, Mission-Centric Cybersecurity Analysis

2017-12-05

arXiv.org

AI Summary

Traditional perimeter-based defenses fail against advanced persistent threats (APTs), compromising mission continuity. Method: This paper proposes a mission-success-oriented cybersecurity analysis framework. It introduces a novel hierarchical modeling approach integrating mission requirements, functional behaviors, and system architecture, supported by structured requirement elicitation, HAZOP hazard analysis, SysML modeling, and evidence-chain traceability to quantify attack impact pathways on mission objectives. Contribution/Results: The framework enables a paradigm shift from tactical defense to strategic resilience assessment, significantly improving identification accuracy of critical mission components and efficiency of protective resource allocation. Its capability for interpretable, impact-path modeling under APT scenarios is empirically validated across multiple defense information system prototypes.

Abstract

Currently, perimeter-based approaches are the mainstay of cybersecurity. While this paradigm is necessary, there is mounting evidence of its insufficiency with respect to sophisticated and coordinated attacks. In contrast to perimeter-based security, mission-centric cybersecurity provides awareness of how attacks can influence mission success and therefore focuses resources for mitigating vulnerabilities and protecting critical assets. This is strategic as opposed to tactical perimeter-based cybersecurity. We propose MISSION AWARE, which assists in the identification of parts of a system that destabilize the overall mission of the system if compromised. MSSION AWARE starts with a structured elicitation process that leads to hazards analysis. It employs hierarchical modeling methods to capture mission requirements, admissible functional behaviors, and system architectures. It then generates evidence---attacks applicable to elements that directly correlate with mission success. Finally, MISSION AWARE traces evidence back to mission requirements to determine the evidence with the highest impact relative to mission objectives.

Problem

• Mission Aware addresses cyber-physical attacks on mission-critical systems
• It identifies components whose compromise destabilizes mission objectives
• The approach prioritizes vulnerabilities impacting mission requirements and assets

Innovation

• Mission Aware identifies mission-destabilizing components via systems-theoretic analysis
• It generates evidence by tracing attack vectors to mission requirements
• Prioritizes high-impact vulnerabilities relative to mission objectives