Cyber Primer

Cyber threats
• damaging industrial control systems (ICS) such as supervisory
control and data acquisition systems (SCADA); distributed control
systems (DCS) and programmable logic controls (PLC). 19
2.3. Evidence of cyber activity and an actor’s will to use it against the UK
can be challenging to source and even harder to attribute. Attribution is
difficult not only due to the disparate and anonymous nature of cyberspace,
but because it is not solely a technical problem – the problem spans
technical/tactical (how), operational (what) and strategic levels (why).
2.4. Assessing the level of threat from and through cyberspace can be
achieved by understanding the sum of the following three factors.
a. Intent. Intent is the most critical component as it provides
‘intelligence-in-depth’ or context as to ‘why’ an adversary may
act. An adversary’s intent can either be declared, demonstrated or
a combination of both. In some cases, intent may be unknown so
understanding will be based on observed activity.
b. Capability. Intelligence analysis focuses primarily on
understanding the adversary’s strengths and their ability to generate
and sustain them. However, whilst a capability may exist, there may be
no intent or opportunity to use it.
c. Opportunity. Opportunity is the key variable in assessing threat
as the opportunity to act can present itself in many guises and at
any time. An adversary may also actively seek to generate their
own opportunity to act, through a variety of influencing or shaping
activities. Opportunities will be available through changes or
variances in the environment, providing potential advantage to the
adversary. An adversary could also drive friendly forces along a specific
operational path resulting in potentially higher, repeatable risk. There
may also be opportunities provided by friendly force activity more
widely – their vulnerabilities provide avenues that threat actors can
exploit to achieve their aims.
19 Similar functionality to that of dedicated industrial control systems (ICS) can be
provided through the use of embedded controllers or control software.
22
Cyber Primer (2nd Edition)