Introduction to Cyber Modeling and Simulation

JERRY M. COURETAS, PHD, is Technology Lead for the Office of Secretary Defense's (OSD) Modeling and Simulation Coordination Office (DM&SCO) of Booz, Allen & Hamilton in McLean, VA, USA. He is currently the Editor-in-Chief of The Journal of Defense Modeling and Simulation. Dr. Couretas is a Global Industrial Cyber Security Professional (GICSP), a Project Management Professional (PMP), and a Certified Enterprise Architect (FEAC Institute).

• 1 Brief Review of Cyber Incidents 11.1 Cyber’s Emergence as an Issue 31.2 Estonia and Georgia – Militarization of Cyber 41.3 Conclusions 62 Cyber Security – An Introduction to Assessment and Maturity Frameworks 92.1 Assessment Frameworks 92.2 NIST 800 Risk Framework 92.2.1 Maturity Models 122.2.2 Use Cases/Scenarios 132.3 Cyber Insurance Approaches 142.3.1 An Introduction to Loss Estimate and Rate Evaluation for Cyber 172.4 Conclusions 172.5 Future Work 182.6 Questions 183 Introduction to Cyber Modeling and Simulation (M&S) 193.1 One Approach to the Science of Cyber Security 193.2 Cyber Mission System Development Framework 213.3 Cyber Risk Bow‐Tie: Likelihood to Consequence Model 213.4 Semantic Network Model of Cyberattack 223.5 Taxonomy of Cyber M&S 243.6 Cyber Security as a Linear System – Model Example 253.7 Conclusions 263.8 Questions 274 Technical and Operational Scenarios 294.1 Scenario Development 304.1.1 Technical Scenarios and Critical Security Controls (CSCs) 314.1.2 ARMOUR Operational Scenarios (Canada) 324.2 Cyber System Description for M&S 344.2.1 State Diagram Models/Scenarios of Cyberattacks 344.2.2 McCumber Model 354.2.3 Military Activity and Cyber Effects (MACE) Taxonomy 364.2.4 Cyber Operational Architecture Training System (COATS) Scenarios 374.3 Modeling and Simulation Hierarchy – Strategic Decision Making and Procurement Risk Evaluation 394.4 Conclusions 424.5 Questions 435 Cyber Standards for Modeling and Simulation 455.1 Cyber Modeling and Simulation Standards Background 465.2 An Introduction to Cyber Standards for Modeling and Simulation 475.2.1 MITRE’s (MITRE) Cyber Threat Information Standards 475.2.2 Cyber Operational Architecture Training System 495.2.3 Levels of Conceptual Interoperability 505.3 Standards Overview – Cyber vs. Simulation 515.3.1 Simulation Interoperability Standards Organization (SISO) Standards 525.3.2 Cyber Standards 545.4 Conclusions 565.5 Questions 576 Cyber Course of Action (COA) Strategies 596.1 Cyber Course of Action (COA) Background 596.1.1 Effects‐Based Cyber‐COA Optimization Technology and Experiments (EBCOTE) Project 596.1.2 Crown Jewels Analysis 606.1.3 Cyber Mission Impact Assessment (CMIA) Tool 616.1.4 Analyzing Mission Impacts of Cyber Actions 636.2 Cyber Defense Measurables – Decision Support System (DSS) Evaluation Criteria 646.2.1 Visual Analytics 656.2.2 Managing Cyber Events 676.2.3 DSS COA and VV&A 686.3 Cyber Situational Awareness (SA) 686.3.1 Active and Passive Situational Awareness for Cyber 696.3.2 Cyber System Monitoring and Example Approaches 696.4 Cyber COAs and Decision Types 706.5 Conclusions 716.6 Further Considerations 726.7 Questions 727 Cyber Computer‐Assisted Exercise (CAX) and Situational Awareness (SA) via Cyber M&S 757.1 Training Type and Current Cyber Capabilities 777.2 Situational Awareness (SA) Background and Measures 787.3 Operational Cyber Domain and Training Considerations 797.4 Cyber Combined Arms Exercise (CAX) Environment Architecture 817.4.1 CAX Environment Architecture with Cyber Layer 827.4.2 Cyber Injections into Traditional CAX – Leveraging Constructive Simulation 847.4.3 Cyber CAX – Individual and Group Training 857.5 Conclusions 867.6 Future Work 877.7 Questions 878 Cyber Model‐Based Evaluation Background 898.1 Emulators,Simulators, and Verification/Validation for Cyber System Description 898.2 Modeling Background 908.2.1 Cyber Simulators 918.2.2 Cyber Emulators 938.2.3 Emulator/Simulator Combinations for Cyber Systems 948.2.4 Verification, Validation, and Accreditation (VV&A) 968.3 Conclusions 998.4 Questions 1009 Cyber Modeling and Simulation and System Risk Analysis 1019.1 Background on Cyber System Risk Analysis 1019.2 Introduction to using Modeling and Simulation for System Risk Analysis with Cyber Effects 1049.3 General Business Enterprise Description Model 1059.3.1 Translate Data to Knowledge 1079.3.2 Understand the Enterprise 1149.3.3 Sampling and Cyber Attack Rate Estimation 1149.3.4 Finding Unknown Knowns – Success in Finding Improvised Explosive Device Example 1169.4 Cyber Exploit Estimation 1169.4.1 Enterprise Failure Estimation due to Cyber Effects 1189.5 Countermeasures and Work Package Construction 1209.6 Conclusions and Future Work 1229.7 Questions 12410 Cyber Modeling & Simulation (M&S) for Test and Evaluation (T&E) 12510.1 Background 12510.2 Cyber Range Interoperability Standards (CRIS) 12610.3 Cyber Range Event Process and Logical Range 12710.4 Live,Virtual, and Constructive (LVC) for Cyber 13010.4.1 Role of LVC in Capability Development 13210.4.2 Use of LVC Simulations in Cyber Range Events 13310.5 Applying the Logical Range Construct to System under Test (SUT) Interaction 13410.6 Conclusions 13510.7 Questions 13611 Developing Model‐Based Cyber Modeling and Simulation Frameworks 13711.1 Background 13711.2 Model‐ Based Systems Engineering (MBSE) and System of Systems Description (Data Centric) 13711.3 Knowledge‐ Based Systems Engineering (KBSE) for Cyber Simulation 13811.3.1 DHS and SysML Modeling for Buildings (CEPHEID VARIABLE) 13911.3.2 The Cyber Security Modeling Language (CySeMoL) 14011.3.3 Cyber Attack Modeling and Impact Assessment Component (CAMIAC) 14011.4 Architecture‐ Based Cyber System Optimization Framework 14111.5 Conclusions 14111.6 Questions 14212 Appendix: Cyber M&S Supporting Data, Tools, and Techniques 14312.1 Cyber Modeling Considerations 14312.1.1 Factors to Consider for Cyber Modeling 14312.1.2 Lessons Learned from Physical Security 14412.1.3 Cyber Threat Data Providers 14612.1.4 Critical Security Controls (CSCs) 14712.1.5 Situational Awareness Measures 14712.2 Cyber Training Systems 14812.2.1 Scalable Network Defense Trainer (NDT) 15312.2.2 SELEX ES NetComm Simulation Environment (NCSE) 15312.2.3 Example Cyber Tool Companies 15412.3 Cyber‐ Related Patents and Applications 15412.4 Conclusions 160Bibliography 161Index 175

Select Guide Rating