Into the Gray Zone

4 | The Cyber Threat and Active Defense
not enough to keep out hackers, and the inherent advantage
rests with the attacker. A sophisticated adversary
can easily disrupt a service, steal assets, or even
destroy data held on private servers. Even non-state
malicious actors have increased their sophistication in
recent years, at times nearing a level of sophistication
previously thought only achievable by the most capable
of state actors.
Despite the limitations of defensive measures, it is
important to note that private sector companies that
implement basic practices of cyber hygiene can prevent
the vast majority of malicious cyber activity.
Companies are increasingly adopting security controls
that will allow them and government partners
to focus more resources on countering advanced
threats—ones where active defense capabilities come
into consideration.
The Anatomy of Exploitation and Attack
Although security policy experts have put much
thought into how to preserve and protect U.S. national
security, economic security, human rights,
and privacy from cyber threats, the nature of evolving
technologies make this an ongoing and challenging
task. In order to understand why malicious
actors have such an advantage in cyberspace, and
why defending against them remains so problematic
for both the government and the private sector, it is
helpful to have a basic understanding of how computer
network exploitations and computer network
attacks occur.
The Cyber Kill Chain, originally developed by the
Department of Defense, can serve as a strong starting
point for this type of analysis. 25 The model divides
the life cycle of a hack into three major steps:
preparation, intrusion, and active breach; and was
developed as a guide for gathering intelligence on
cyber attacks that would help defenders secure their
systems throughout the life-cycle of a hack. This report’s
“anatomy of exploitation and attack” outlined
in Figure 1, is a slightly modified model that incorporates
details included in other analyses of hacker
behavior, such as the InfoSec Institute’s Cyber Exploitation
Cycle. 26 Critics of the cyber kill chain argue
that it relies too heavily on perimeter-based defense
techniques and is therefore less helpful when it
comes to describing socially engineered attacks, the
insider threat, and other modern methods of cyber
exploitation. 27 While it was never intended to be
operationalized against all types of cyber exploitation,
the true weakness in applying the kill chain to
cybersecurity is not that the model overemphasizes
intrusions at the perimeter, but rather that those
who use the model limit themselves to cybersecurity
tools that are almost exclusively geared towards perimeter
security. This report will frame the anatomy
of exploitation and attack in such a way that is
directly relevant to the private sector and can begin
to guide cybersecurity practitioners away from limiting
notions of network defense.
A modified version of the kill chain concept is a useful
tool to analyze the stages of a cyber threat at which
certain defensive tactics become relevant. Thus, the
anatomy of exploitation and attack will serve as a reference
point, as this report continues, to demonstrate
where emerging cybersecurity practices can disrupt
and defeat cyber threat actors. Furthermore, it will
help to visually demonstrate how new cybersecurity
practices can fill the gaps that intrusion-based cyber
defenses currently leave exposed.
Key U.S. Interests In Cyberspace
Although the number and sophistication of cyber
threats continues to grow, the United States has thus
far escaped a significant cyber attack that has seriously
damaged its critical infrastructure or way of life.
How long this relative sense of security can last is
unclear. Over the past decade, the arsenal of offensive
cyber measures has grown unbounded; botnets,
DDoS attacks, ransomware, remote access tools, encryption-based
exploitation tools, social engineering,
and zero-day exploits are the standards of the day. 28 It
will only be a matter of time before an adversary successfully
capitalizes on these advantages and carries
out an attack that damages and disrupts critical infrastructure.
This type of asymmetric threat environment
requires a carefully calibrated strategic response
and calls for a broader cyber deterrence strategy. Not
all threats are deterred in the same manner, however,