Cyber Attack Task Force - Final Report - NERC

More documents

Recommendations

Info

Appendix A: Introduction to Attack Trees Appendix A: Introduction to Attack Trees Threat trees are the first component of an attack tree. Threat (or fault) trees are used to determine whether the conditions necessary for a threat to be realized exist and are unmitigated. A threat tree consists of threat outcomes: (e.g., long-term service disruption to a large area), in which preexisting conditions that must be true for an adversary to realize the threat (e.g., a circuit breaker is accessible through Internet connectivity). Any condition can, in turn, have one or more preconditions. Two or more conditions at the same level and sharing the same parent node can be combined, resulting in an “and” relationship; otherwise, an implicit “or” condition exists. Determining whether one or more vulnerabilities are associated with a threat is simply a matter of starting at a leaf condition (a node in the threat tree with no child nodes) and following it up to the root threat. If a path is unbroken by a mitigated node or a broken “and” condition exist, a vulnerability exists. This information combined with intelligence about adversaries can be used to create an attack tree. Certain vulnerabilities are more likely to be exploited based on the attacker’s capabilities (resources, geographic location, and industry experience.), while others will be virtually impossible to exploit. The impact of a threat can be calculated quickly from the attack tree, which can, in turn, be used to justify or inform expenditures or resource allocation planning on mitigation strategies. Impact can be calculated by adding the financial and operational impact of the root of the tree to any impact created as attackers work their way up the tree. Some of the intermediate nodes in the tree may have an adverse impact, even if the attacker doesn’t have the capabilities to extend further up the tree. Once an impact is calculated, it is possible to calculate the value of investing in mitigation strategies. Based on the impact and the likelihood of occurrence, it is possible to determine whether countermeasures should be used for that vulnerability – or whether the vulnerability is so difficult to exploit (or has so little impact) that countermeasures are unnecessary. 32 32 American Electric and Power Attack Tree Methodology 44 Cyber Attack Task Force Report
Appendix A: Introduction to Attack Trees Cyber Attack Task Force Report 45
Page 1 and 2:
Cyber Attack Task Force Final Repor
Page 3 and 4:
Table of Contents Table of Contents
Page 5: Denial of Service - EMS application
Page 8 and 9: Executive Summary Defining a Coordi
Page 10 and 11: Executive Summary Key Recommendatio
Page 13 and 14: Executive Summary Introduction A hi
Page 15 and 16: Adversaries, Motivations, and Capab
Page 17 and 18: Adversaries, Motivations, and Capab
Page 19 and 20: Low Level Threat Criminals, Hackers
Page 21 and 22: Cyber Threat Group Foreign State Na
Page 23 and 24: What a Coordinated Attack Looks Lik
Page 25 and 26: Expanding each of the two events: S
Page 27 and 28: Detection Capabilities Global Monit
Page 29 and 30: Detection Capabilities Appendix F c
Page 31 and 32: Defensive Capabilities / Deterrence
Page 33 and 34: For example: Defensive Capabilities
Page 39 and 40: Responses to Attack Responses to At
Page 41 and 42: Responses to Attack staff to locati
Page 43: Responses to Attack Entities that u
Page 46 and 47: Recommendations • Continue to dev
Page 48 and 49: Recommendations node attack. At a m
Page 50 and 51: Outreach Outreach Outreach is an im
Page 52 and 53: References References Name Link DOE
Page 54 and 55: References NERC CATF Roster - Contr
Page 58 and 59: Appendix B: Resources Appendix B: R
Page 60 and 61: Appendix C: Cyber Event Scenarios f
Page 66 and 67: Appendix D: Acronyms Appendix D: Ac
Page 69 and 70: Appendix E: Potential Responses to
Page 71 and 72: Appendix E: Potential Responses to
Page 73 and 74: Appendix F: Precursors and Local In
Page 75: Appendix G: Isolation and Survivabi
Page 78 and 79: Appendix H: Defensive Capabilities
Page 80 and 81: Appendix I: CRPA Observations and R
Page 82 and 83: Appendix I: CRPA Observations and R
Page 84 and 85: Appendix J: Case Studies to underst
Page 86 and 87: Appendix J: Case Studies Lateral Mo
Page 88: Appendix K: Task Force Goals and Ob
show all

Cyber Attack Task Force - Final Report - NERC

Create successful ePaper yourself

Delete template?

Save as template?