Subject: [Smart] When we say 'cyber'...

From: Mark O <[email-masked]>
Date: Thu, 4 Oct 2018 15:44:38 +0000

There's been some discussion on the list about what to call the main topic of our research. We settled on the name 'SMART' - Stopping Malware And Researching Threats - for the list because it covered a couple of our major aims and made for a handy acronym. But it's not the whole of our ambition.

When we first mooted the possibility of a research group at the SAAG open meeting in Montreal, we referred to 'Cyber Defence'. That's [part of] what we do at the National Cyber Security Centre - we have an Active Cyber Defence<https://www.ncsc.gov.uk/active-cyber-defence> programme, aimed at improving the resistance of UK infrastructure to cyber attacks. So the word 'cyber' trips easily off our tongues. It's not just us - large parts of industry and academia refer to 'cyber security' and 'cyber attacks', as do the media. But we're also aware that 'cyber' means different things to different people, it's a buzzword, it's generic, and it can raise hackles in some. Earlier versions of the draft charter referred to 'cyber security', 'cyber defence', 'security operations', and the current version refers to the rather plain 'attack defence'. Hopefully without getting side-tracked - what speaks best to most people?

Ultimately, we don't have a strong view on what phrase is used - the important point is that it's clear and obvious what type of threats we're trying to defend against (without being prescriptive). So it's probably more helpful to try and build a list of the kind of threats we're meaning.

As a general theme, the threats we're considering:

  *   have malicious intent - as opposed to accidental threats (e.g. hardware failure causing data loss);
  *   involve active interference with data, users or the network - as opposed to passive wiretapping and offline attacks; and
  *   result in harm.

We probably will need to reference a taxonomy of threats, and we needn't reinvent the wheel here - that work has been done before. ENISA has produced one such threat taxonomy<https://www.enisa.europa.eu/topics/threat-risk-management/threats-and-trends/enisa-threat-landscape/etl2015/enisa-threat-taxonomy-a-tool-for-structuring-threat-information> which I've used to construct the list below. This is just a starting point - there will be some things I've missed off, and I certainly can't promise that we'll be able to address all of them:

  *   Unsolicited e-mail - spam and infected e-mails; links to malicious websites
  *   Identity theft - stealing credentials
  *   Denial of service - DDoS, network and application layer, amplification attacks
  *   Malware, worms, trojans, rootkits, injection attacks, viruses, exploits
  *   Spyware, scareware, ransomware
  *   Social engineering - phishing, spear-phishing
  *   Fake certificates, MITM, signed malware
  *   Manipulation of hardware and software
  *   Manipulation of information - hijacking, routing table manipulation, DNS poisoning
  *   Misuse of audit tools to discover security weaknesses
  *   Unauthorised access, network intrusion
  *   Unauthorised installation of software, web/browser-based attacks, drive-by downloads
  *   Data breach
  *   Remote execution, botnets
  *   Advanced Persistent Threats

Note that 'cyber' doesn't appear in the list once - and that's OK.

Is that what everyone's expecting? This is still up for grabs and we'd like everyone to have the same, clear view of what we're trying to achieve.

-- Mark

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [email-masked]

---

From: Bret Jordan <[email-masked]>
Date: Fri, 5 Oct 2018 15:01:52 -0400

Mark,

Thanks for the email and clarification. I for one do not have a problem with the term cyber security or cyber defense. It is so common and well understood in practice from the enterprise SoC, ISAC, ISAO, and IC etc. I think some might take issue with the differences between:

Data Security
Information Security 
Cyber Security

I have also looked at the ENISA work before and really like what they have done.  There are also a lot of taxonomy elements that are defined in STIX for some of these things as well.  But we should not get hung up on this minor stuff, we should be focused on doing the work that this research group needs to do.

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

> On Oct 4, 2018, at 11:44 AM, Mark O <Mark.O=[email-masked]> wrote:
> 
>  
> There’s been some discussion on the list about what to call the main topic of our research. We settled on the name ‘SMART’ – Stopping Malware And Researching Threats - for the list because it covered a couple of our major aims and made for a handy acronym. But it’s not the whole of our ambition.
>  
> When we first mooted the possibility of a research group at the SAAG open meeting in Montreal, we referred to ‘Cyber Defence’. That’s [part of] what we do at the National Cyber Security Centre – we have an Active Cyber Defence <https://www.ncsc.gov.uk/active-cyber-defence> programme, aimed at improving the resistance of UK infrastructure to cyber attacks. So the word ‘cyber’ trips easily off our tongues. It’s not just us – large parts of industry and academia refer to ‘cyber security’ and ‘cyber attacks’, as do the media. But we’re also aware that ‘cyber’ means different things to different people, it’s a buzzword, it’s generic, and it can raise hackles in some. Earlier versions of the draft charter referred to ‘cyber security’, ‘cyber defence’, ‘security operations’, and the current version refers to the rather plain ‘attack defence’. Hopefully without getting side-tracked – what speaks best to most people?
>  
> Ultimately, we don’t have a strong view on what phrase is used – the important point is that it’s clear and obvious what type of threats we’re trying to defend against (without being prescriptive). So it’s probably more helpful to try and build a list of the kind of threats we’re meaning.
>  
> As a general theme, the threats we’re considering:
> have malicious intent – as opposed to accidental threats (e.g. hardware failure causing data loss);
> involve active interference with data, users or the network – as opposed to passive wiretapping and offline attacks; and
> result in harm.
>  
> We probably will need to reference a taxonomy of threats, and we needn’t reinvent the wheel here – that work has been done before. ENISA has produced one such threat taxonomy <https://www.enisa.europa.eu/topics/threat-risk-management/threats-and-trends/enisa-threat-landscape/etl2015/enisa-threat-taxonomy-a-tool-for-structuring-threat-information> which I’ve used to construct the list below. This is just a starting point – there will be some things I’ve missed off, and I certainly can’t promise that we’ll be able to address all of them:
> Unsolicited e-mail – spam and infected e-mails; links to malicious websites
> Identity theft – stealing credentials
> Denial of service – DDoS, network and application layer, amplification attacks
> Malware, worms, trojans, rootkits, injection attacks, viruses, exploits
> Spyware, scareware, ransomware
> Social engineering – phishing, spear-phishing
> Fake certificates, MITM, signed malware
> Manipulation of hardware and software
> Manipulation of information – hijacking, routing table manipulation, DNS poisoning
> Misuse of audit tools to discover security weaknesses
> Unauthorised access, network intrusion 
> Unauthorised installation of software, web/browser-based attacks, drive-by downloads
> Data breach
> Remote execution, botnets
> Advanced Persistent Threats
> Note that ‘cyber’ doesn’t appear in the list once – and that’s OK.
>  
> Is that what everyone’s expecting? This is still up for grabs and we’d like everyone to have the same, clear view of what we’re trying to achieve.
>  
> -- Mark
>  
>  
> This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [email-masked] <mailto:[email-masked]> -- 
> Smart mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.irtf.org/mailman/listinfo/smart <https://www.irtf.org/mailman/listinfo/smart>

---

From: Olaf Kolkman <[email-masked]>
Date: Fri, 19 Oct 2018 11:58:56 +0000

Hello all,

I am normally lurking on this list but I would personally stay somewhat at arms length from ‘cyber defence’. There is a delta in understanding between how technologists, policy makers, and diplomates use and understand the term _cyber security_ and in my experience the delta may be bigger for the words _cyber defence_.

—Olaf Kolkman

On 4 Oct 2018, at 17:44, Mark O wrote:

> When we first mooted the possibility of a research group at the SAAG open meeting in Montreal, we referred to 'Cyber Defence'. That's [part of] what we do at the National Cyber Security Centre - we have an Active Cyber Defence<https://www.ncsc.gov.uk/active-cyber-defence> programme, aimed at improving the resistance of UK infrastructure to cyber attacks. So the word 'cyber' trips easily off our tongues. It's not just us - large parts of industry and academia refer to 'cyber security' and 'cyber attacks', as do the media.. But we're also aware that 'cyber' means different things to different people, it's a buzzword, it's generic, and it can raise hackles in some. Earlier versions of the draft charter referred to 'cyber security', 'cyber defence', 'security operations', and the current version refers to the rather plain 'attack defence'. Hopefully without getting side-tracked - what speaks best to most people?
>
>
>

> -- 
> Smart mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/smart

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 19 Oct 2018 09:43:47 -0400

On Fri, Oct 19, 2018 at 7:59 AM Olaf Kolkman <[email-masked]> wrote:

> Hello all,
>
> I am normally lurking on this list but I would personally stay somewhat at
> arms length from ‘cyber defence’. There is a delta in understanding between
> how technologists, policy makers, and diplomates use and understand the
> term *cyber security* and in my experience the delta may be bigger for
> the words *cyber defence*.
>

Thanks, Olaf.  I agree and have been trying to watch how others use the
word cyber and am not coming up with any special meaning yet that make it
distinct as a useful term.  If there is something that makes it distinct,
hearing it would be good to know.  I also tried tweeting (@KathleeMoriarty)
this to see how people define it, but haven't gotten many responses and
none that are convincing yet.  If someone has one please post.

Thank you,
Kathleen

> There’s been some discussion on the list about what to call the main topic
> of our research. We settled on the name ‘SMART’ – Stopping Malware And
> Researching Threats - for the list because it covered a couple of our major
> aims and made for a handy acronym. But it’s not the whole of our ambition.
>
>
>
> When we first mooted the possibility of a research group at the SAAG open
> meeting in Montreal, we referred to ‘Cyber Defence’. That’s [part of] what
> we do at the National Cyber Security Centre – we have an Active Cyber
> Defence <https://www.ncsc.gov.uk/active-cyber-defence> programme, aimed
> at improving the resistance of UK infrastructure to cyber attacks. So the
> word ‘cyber’ trips easily off our tongues. It’s not just us – large parts
> of industry and academia refer to ‘cyber security’ and ‘cyber attacks’, as
> do the media. But we’re also aware that ‘cyber’ means different things to
> different people, it’s a buzzword, it’s generic, and it can raise hackles
> in some. Earlier versions of the draft charter referred to ‘cyber
> security’, ‘cyber defence’, ‘security operations’, and the current version
> refers to the rather plain ‘attack defence’. Hopefully without getting
> side-tracked – what speaks best to most people?
>
>
>
> Ultimately, we don’t have a strong view on what phrase is used – the
> important point is that it’s clear and obvious what type of threats we’re
> trying to defend against (without being prescriptive). So it’s probably
> more helpful to try and build a list of the kind of threats we’re meaning.
>
>
>
>    - have malicious intent – as opposed to accidental threats (e.g.
>    hardware failure causing data loss);
>    - involve active interference with data, users or the network – as
>    opposed to passive wiretapping and offline attacks; and
>    - result in harm.
>
>
>
> We probably will need to reference a taxonomy of threats, and we needn’t
> reinvent the wheel here – that work has been done before. ENISA has
> produced one such threat taxonomy
> <https://www.enisa.europa.eu/topics/threat-risk-management/threats-and-trends/enisa-threat-landscape/etl2015/enisa-threat-taxonomy-a-tool-for-structuring-threat-information>
> which I’ve used to construct the list below. This is just a starting point
> – there will be some things I’ve missed off, and I certainly can’t promise
> that we’ll be able to address all of them:
>
>    - Unsolicited e-mail – spam and infected e-mails; links to malicious
>    websites
>    - Identity theft – stealing credentials
>    - Denial of service – DDoS, network and application layer,
>    amplification attacks
>    - Malware, worms, trojans, rootkits, injection attacks, viruses,
>    exploits
>    - Spyware, scareware, ransomware
>    - Social engineering – phishing, spear-phishing
>    - Fake certificates, MITM, signed malware
>    - Manipulation of hardware and software
>    - Manipulation of information – hijacking, routing table manipulation,
>    DNS poisoning
>    - Misuse of audit tools to discover security weaknesses
>    - Unauthorised access, network intrusion
>    - Unauthorised installation of software, web/browser-based attacks,
>    drive-by downloads
>    - Data breach
>    - Remote execution, botnets
>    - Advanced Persistent Threats
>
> Is that what everyone’s expecting? This is still up for grabs and we’d
> like everyone to have the same, clear view of what we’re trying to achieve.
>
>
>
> -- Mark
>
>
>
>
> This information is exempt under the Freedom of Information Act 2000
> (FOIA) and may be exempt under other UK information legislation. Refer any
> FOIA queries to [email-masked]
>
> --
> Smart mailing list
> [email-masked]

-- 

Best regards,
Kathleen

---

From: Bret Jordan <[email-masked]>
Date: Fri, 19 Oct 2018 11:00:17 -0600

Olaf, et al.,

I do not discount that there is some vagueness within and across some groups when they use the term Cyber Security or Cyber Defense.  I get it.  But we also know that it is highly used and generally well understood and accepted in the industry. In fact, NIST has produced a very popular and widely deployed framework called the “Cybersecurity Framework” [1].  ENISA also uses this term throughout their policy and strategy documents [2]. The ITU uses it [3] and nearly every Fortune 2000 company uses it.  It seems like not using it here is just swimming up stream. 

What we do know for sure, is that Cyber Security references a concept that is more than just:

1) Data Security 
2) Information Security
3) Physical Security in relation to electronic assets
4) Network Security
5) Server and System Security
6) Host based Security
7) Endpoint Security
8) Protocol Security

Perhaps one of the line items of this research group should be to come up with a great definition of Cyber Security and Cyber Defense that can be accepted by the IETF / IRTF. Or we could just use one of the NIST / ENISA / UK NCSC / ITU etc. definitions.  There is a good blog post (though it could be better) at: http://www.cisoplatform.com/profiles/blogs/understanding-difference-between-cyber-security-information <http://www.cisoplatform.com/profiles/blogs/understanding-difference-between-cyber-security-information> that everyone should read.

[1] https://www.nist.gov/cyberframework <https://www.nist.gov/cyberframework>
[2] https://www.enisa.europa.eu/topics/national-cyber-security-strategies <https://www.enisa.europa.eu/topics/national-cyber-security-strategies>
[3] https://www.itu.int/en/action/cybersecurity/Pages/default.aspx <https://www.itu.int/en/action/cybersecurity/Pages/default.aspx>

Thanks,
Bret

> On Oct 19, 2018, at 5:58 AM, Olaf Kolkman <[email-masked]> wrote:
> 
> Hello all,
> 
> I am normally lurking on this list but I would personally stay somewhat at arms length from ‘cyber defence’. There is a delta in understanding between how technologists, policy makers, and diplomates use and understand the term cyber security and in my experience the delta may be bigger for the words cyber defence.
> 
> —Olaf Kolkman
>