1. Cyber Offense vs. Cyber Defense: A Theoretical Framework
Hwee-Joo Kam, D.Sc., Ferris State University
Shuyuan Mary Ho, Ph.D., Florida State University
Pairin Katerattanakul, Ph.D., Western Michigan University

2. Research Objectives
Investigate the differences in activities, goals, roles, divisions of labor, and rules between system engineers and penetration testers
Develop a behavioral model
Close the gap between Cyber offense and Cyber defense
Contribute viable suggestions and practical implications for securing information

3. Cyber Offense vs. Defense
Penetration testing ascribed to cyber offense
Penetration testers launch tests that emulate the real- life cyberattack
System engineering ascribed to cyber defense
System engineers have to secure IT infrastructure (i.e. web server) in addition to enable system functionalities

4. Activity Theory
Focuses on the interaction among subjects (i.e. actors like pen testers and system engineers) to
Identify important concepts (i.e. behavioral model)
Suggest mechanisms of certain occurrences
Explain how and why system engineers or penetration testers behave in certain ways

5. Research Framework

6. Principles of Activity Theory
Principle 1: Unit of analysis
Activity system with actions, operations and goals
Principle 2: Multi-Voicedness
Multiple perspectives, traditions, and interests in activity systems
Principle 3: History
Past actions taken
Recurring patterns in the past actions

7. Principles of Activity Theory
Principle 4: Contradiction
Structural tensions among activities systems
Cyber offense vs. defense: proactive vs. reactive
Principle 5: Expansive Cycles
Objects are transformed because of a collaborative, deliberate change effort
E.g. a drastic change in system configuration

8. Participants Will involve two groups of students:
Blue team vs. red team
One group will take the role of system engineers
The other will take role of penetration testers.
Each group will consist of 3-5 participants
Senior or graduate students with a major in information security
State University designated as the Center of Excellence in Information Assurance by the NSA and DHS

9. Cybersecurity Laboratory Experiment
Michigan Cyber Range
Sandbox environment
Build a vulnerable server
XSS
SQL Injection
Session hijacking
ARP poisoning

10. Cybersecurity Laboratory Experiment
System Protection
Penetration Testing
Description
Difficulty Level
Difficulty Level
Check for any unused open ports. 1
Scan for all the available ports.
Close the unused open ports.
Exploit the unused open ports using proxy software.
Identify users with administrator privileges. 2
Identify users with administrator privileges.
Reassign the privileges to users in (3) based on the principle of least privilege. 3
Launch dictionary attack and/or brute force attack using the usernames of users found in (3).

11. Matrix for Data Analysis
Principles
Key Areas in Research
Data Collection
Expected Findings
Activity system as unit of analysis
Study how each group achieves its goal
Report, log files
Actions, Operations
Multi- voicedness
System evaluation from each group, motivation factors
Report, interviews
Group motivation
Historicity
Study the pattern of actions taken
Rules and division of labor

12. Matrix for Data Analysis
Principles
Key Areas in Research
Data Collection
Expected Findings
Contradictions
Study the conflicts and between system engineers and pen testers.
Report, interviews
The social norms (rules) and values in each group
Expansive cycles
Study any changes occurred during the collaboration between two groups.
Transformation of Web server and key activities that cause major changes to the Web server