Supplementing IT event standards for mission assurance

Computer network defense (CND) capabilities are designed for business efficiency in a static, stable network environment, where network assets are known and the mission of the network rarely varies. Such capabilities do not consider mission needs when identifying and compensating for attacks on assets critical to the current mission. Security awareness remains the same whether the network is carrying redundant inventory data or supporting critical operations. Advanced attackers who may already know the network details, its systems and software, and any mission objectives therefore already have an advantage. We propose a three-step process to enable migration from the current CND strategy toward one of mission network defense. This transition would lead to better, more adaptable security capabilities by encouraging exchange of mission-related event information. By adopting and extending the Common Event Expression standard to support mission-relevant data, CND systems can begin to monitor their mission environment. Once standardized mission event information becomes available, we can concentrate on developing more adaptive CND capabilities that are better suited to the various mission environments.