Proceedings of the 11th European Conference on Information ...

Metrics Framework <strong>of</strong> Cyber Operations on
Command and Control
Melanie Bernier 1 , Sylvain Leblanc 2 and Ben Morton 2
1
Defence Research and Development Canada - Centre for Operational
Research and Analysis, Ottawa, Canada
2
Computer Security Laboratory, Department <strong>of</strong> Electrical and Computer
Engineering, Royal Military College <strong>of</strong> Canada, Kingston, Canada
Abstract: The reliance <strong>of</strong> modern military forces on networks and information
systems makes <strong>the</strong>m susceptible to cyber attacks and highlights <strong>the</strong>
importance <strong>of</strong> cyber operations. This increased awareness <strong>of</strong> cyber operations
has led to a need for concept development and experimentation.
Concept development and experimentation work must be assessed, which
requires measurement and metrics. To date, little work has been done to
measure <strong>the</strong> impact <strong>of</strong> cyber operations on military command and control.
This paper will address this requirement by putting forward a framework
for <strong>the</strong> measurement <strong>of</strong> <strong>the</strong> impact <strong>of</strong> cyber operations on <strong>the</strong> effectiveness
<strong>of</strong> <strong>the</strong> command and control <strong>of</strong> military missions. There have been
many research efforts to describe measurement in <strong>the</strong> following capabilities:
Command, Control, Communications, Computers, Intelligence, Surveillance
and Reconnaissance (C4ISR), Network Enabled Operations (Net
Enabled Ops), and Command and Control (C2). While <strong>the</strong>se related fields
have strong links to cyber operations, none <strong>of</strong> <strong>the</strong> associated measurement
efforts specifically address <strong>the</strong> particular measurement requirements
<strong>of</strong> <strong>the</strong> cyber realm. We propose a metrics framework for cyber operations
that is adapted from <strong>the</strong> measures development work <strong>of</strong> <strong>the</strong> US Department
<strong>of</strong> Defence Director <strong>of</strong> Operational Test and Evaluation, which recommends
conducting <strong>the</strong> assessment at <strong>the</strong> mission, task and system level.
We pay particular attention to <strong>the</strong> mission and task levels, which describe
what is being done, why it is being done, and how well it is being
done. The framework elements are “Mission Objective”, “Desired Effects”,
“Functions”, “Attributes”, and “Metrics”. This paper will describe how <strong>the</strong>
framework measures <strong>the</strong> cyber effects described in Simulation Approach
for Military Cyber Operations (also submitted to this conference). The major
contribution <strong>of</strong> <strong>the</strong> paper will be <strong>the</strong> application <strong>of</strong> <strong>the</strong> attributes and
metrics discussed in <strong>the</strong> related capabilities <strong>of</strong> C4ISR, Net Enabled Ops, and
C2 to <strong>the</strong> measurement <strong>of</strong> cyber effects.
7