Spring 2021

Infrastructure Resiliency from a Macro Cyber Perspective

In our 2019 special edition of the Journal of Information Warfare, the foundations for autonomic control for critical infrastructure and operational technology systems were introduced. Herein we build on that foundation by introducing the concept of resiliency from a macro cyber perspective. The prefix ‘macro’ has been applied previously to concepts such as ‘economics’ to differentiate national scale economic concepts such as gross domestic product from ‘micro’ scale economics, which focuses on solvency of, for example, individual homes and businesses. Here we apply the same prefix to resiliency in cyber systems to differentiate between micro cyber resiliency, which we define as ensuring the functionality of individual cyber devices, systems, and networks; and macro cyber resiliency, which we define as ensuring the functionality of interconnected systems comprising control, sensing, and physical elements such as are found in critical infrastructure like the power grid.

Abstract:

This paper discusses the use and integration of disparate but complementary tools for dealing with solvability, operability, and security challenges in Cyber-Physical Systems (CPSs): the Koopman operator for solvability, disjunctive programming for operability, and multi-level optimisation for security. These methods can obviate the need for some of the traditional assumptions used in modelling CPSs. This paper demonstrates the methods’ capabilities and considers ways to advance each method individually. It concludes by discussing how to integrate the different methods and identify useful synergies generated by doing so.

Abstract:

Cyber deception is a burgeoning defence technique that provides increased detection and slowed attack impact. Deception could be a valuable solution for defending the slow-to-patch and minimally cryptographic industrial Cyber-Physical Systems. However, it is necessary for cyber- physical decoys to appear connected to the physical process of the defended system to be convincing. In this paper, the authors present a machine-learning approach to learn good-enough models of the defended system to drive realistic decoy response. The results of studying this approach with simulated and real building systems are discussed.

Abstract:

Deceptive content—misleading, falsified, and fabricated—is routinely created and spread online with the intent to create confusion and widen political and social divides. This study presents a comprehensive overview of content intelligence capabilities (WatchOwl– https://watchowl. pnnl.gov/) to detect, describe, and defend against information operations on Twitter as an example social platform to explain the influence of misleading content diffusion and enable those charged with defending against such manipulation and responsive parties to counter it. We first present deep learning models for misinformation and disinformation detection in multilingual and multimodal settings followed by psycho-linguistic analysis across broad deception categories. 

Abstract:

PNNL developed an Adaptive Cyber Integration Framework (ACIF) in a pilot program to facilitate the timely sharing of cyber threat information along with the advancement of situational awareness tools to enhance protection against and respond to critical infrastructure cybersecurity threats. ACIF comprises components implemented iteratively to achieve research and mission goals. The ACIF components include data-generation technologies, analytic-tools development and maturation, data enrichment and fusion, trust building with stakeholders, investigative research, analytic rigor, production, and dissemination. Each component, its importance to the ACIF, and how each can be adopted and applied across other information-sharing sectors and domains are discussed as a case study in this paper.

Abstract:

The holy grail in cyber analytics is to find new ways to understand the information we already have access to. One way to do that is to characterize the data into reasonable sizes and then leverage any known information to generate new insights. Biologists have been using a similar process for decades. This paper introduces the MLSTONES tool set that was developed by leveraging biology and bioinformatics, high-performance computing, and statistical algorithms applied to cyber data and specifically to malware. Furthermore, the paper discusses the tool suite, its applications, and how it compares to or can work with other related tools.

Abstract:

Software-Defined Networking for Operational Technologies, referred to as OT-SDN, is a leading technology to secure critical infrastructure and command and control systems. As the name implies, OT-SDN networks are programmable, which allows system owners to utilise the characteristics of their physical processes to inform the security of their network. There are best practices for deploying OT-SDN into an environment, whether it is all at once or over time (hybrid) that the network is converted to SDN technologies. Through the development of data-mining tools and standardised process control, OT SDN can be deployed reliably. These tools will minimise or eliminate any communication failures during the transition and will provide network owners with complete documentation of their network environment. The resulting documentation could enable or facilitate network owners to pass any audits or policy checks (such as Authority to Operate) before being allowed to utilise the OT-SDN infrastructure.

Abstract:

The concepts of ‘persistent engagement’ and ‘defend forward’ signify a shift in how the U.S. employs its military cyber capabilities. These new concepts reorient U.S. Cyber Command from a reactive response force to a proactive force with continuous engagement that operates outside U.S. military networks to discover and expose adversary activity as well as to execute actions before they harm U.S. national interests. Persistent engagement can form the basis for a whole-of-nation cyber strategy if the private sector is a central player, rather than an afterthought.

Abstract:

The U.S. Army Office of Energy Initiatives (OEI) facilitates the procurement of independently owned and operated energy generating assets to support energy resilience capabilities at U.S. Army installations. When developing contracts for these assets, OEI implements a set of cybersecurity requirements it has developed based on energy sector consensus guidance. For many energy projects, these OEI Cybersecurity Requirements are the primary set of cybersecurity requirements the U.S. Army applies. For others, the U.S. Department of Defense Risk Management Framework and Cybersecurity Maturity Model Certification provide additional cybersecurity requirements and guidance.