CybersecurityEnhancing Defenders’ Predictive Power in Cyberspace

How can organizations proactively protect themselves against cyber threats? What are the current frameworks in use to protect organizations against cyber threats? How can a RAND-developed model called Scalable Warning and Resilience Model (SWARM) improve on previously existing frameworks to proactively defend against cyber threats? How is SWARM applied in practice?

A new RAND report aims to answer these questions.

In the first two decades of the 21st century, the coevolutionary adaptation of cyber threat actors and technology has been akin to an escalatory arms race between cyber offense and cyber defense. Paradigm-shifting technology advancement, transparent unclassified reporting on cyber incidents, and the proliferation of open-source hacking tools in the context of complex geopolitical dynamics further exacerbate the cyber defense challenge.

Although the integration of such practices as cyber threat modeling, information-sharing, and threat-hunting into defensive strategies has become more common in recent years, the cyber defense community needs to continue to push the envelope to become more resilient and, ideally, get ahead of the threats facing organizations.

RAND says that this research endeavors to contribute to the community via the formulation of a process-based model called the Scalable Warning and Resilience Model (SWARM), which focuses on cyber threats from state-sponsored actors but without the assumption of access to classified information or assets. SWARM prioritizes threat detection, facilitates better prediction of cyber incidents, and enhances network resilience by combining processes which seek to help organizations anticipate and defend against attackers. The model tailors data collection, cyber threat intelligence, and penetration testing to the particular type of intrusion sets most likely to target one’s network.

This proposed model adapts the concept of applying both resilience and indications and warning (I&W) frameworks to information environments while also incorporating a combination of tailored threat modeling and emulation. The new report also includes a case study—based on cyber incidents that occurred at the RAND Corporation—that demonstrates how the model has the potential to produce promising results for defenders by proactively protecting their systems through early warning of cyber incidents before they occur.

Key Findings
The variety of cyber threats which organizations face necessitates a tailored and targeted approach to cyber security

·  The current wide spectrum of actors, methods, and scenarios that can pose a risk to U.S. and allied interests is reflected in a broader definition of threats in cyberspace.

·  Current cyber defenses primarily focus on identifying and managing cyber threats after the cyber adversary has already breached the networks, not beforehand.

·  I&W frameworks—that have been developed by the U.S. intelligence community and are intended to be analytical processes providing ways of monitoring, reporting on, and detecting developments related to threats—can be effectively applied to cyberspace and can increase cyber defenders’ ability to anticipate threats before those threats breach the networks of an organization.

SWARM is a four-step threat-centric process that facilitates the prioritization of threats while enhancing resilience and predictive power

·  SWARM is adaptable across organizations and helps defenders prioritize state-sponsored threats to their information environment.

·  SWARM is designed to increase predictive power by providing advance warning for cyber incidents through early and more-comprehensive indicators, both technical and nontechnical.

·  SWARM intends to enhance network resilience against targeted cyber incidents.