The Response Continuum Sergio Caltagirone University of Idaho Deborah Frincke Pacific Northwest National Laboratory

Previous Responses… Clifford Stoll v. German Hackers (1986) C. Stoll, “Stalking the Wiley Hacker” in Communications of the ACM, vol 31, 1998, pp DoD v. Electronic Disturbance Theater (1998) Conxion v. E-Hippies (2000) FBI v. Russian Hackers (2001) a.k.a. ‘Invita’ Case

Where Is Everybody?

Primary focus to reduce system vulnerability and/or accurately/rapidly detect misuse Difficult to experiment with extreme or novel forms of response Folded in as part of detection Response == Advocacy of Vigilantism No reason to study response since detection cannot be done reliably

Where We’re At…

Where We Want To Be…

Goals Develop a framework to discuss response actions –Definition –Taxonomy –Summary of Challenges –Response Process Model

Elements of a Definition Time-bound –Subjective Purposeful –Not for retribution or revenge, but to return to a previous secure state Limited –Threat mitigation not elimination Controllable and Deliberate Sequence of Actions Technologically Independent

A Definition: Active Response Any action sequence deliberately performed by an individual or organization between the time an attack is detected and the time it is determined to be finished, in an automated or non-automated fashion, in order to mitigate the identified threat’s negative effects upon a particular asset set. Active does not modify response, but rather describes the state of the attack

Taxonomy of Responses 8 Types –No Action –Internal Notification –Internal Response –External Cooperative Response –Non-cooperative Intelligence Gathering –Non-cooperative ‘Cease and Desist’ –Counter-Strike (Direct vs. Passive) –Preemptive Defense

Challenges of Active Response Legal –Civil, Criminal, Domestic, International Ethical –Teleological, Deontological Technical –Traceback, Reliable IDS, Confidence Value, Real Time Risk Analysis –Measure ethical, legal risk effectively? Unintended Consequences –Attacker Action, Collateral Damage, Own Resources

Response Process Model

Future Work Increased Public Discussion Competitive Co-Evolution to Determine New Strategies Continue to Develop Response Models Increased Research in Response Technologies and Approaches

Conclusions A Need for Response –More Discussion –Greater Understanding A Definition Taxonomy Summary of Challenges Process Model

Contact Information Sergio Caltagirone