Situation Awareness and Impact Assessment for Cyber Network Defense

The Secure Decisions division of Applied Visions, Inc. proposes to fill a technology gap in determining how mission and client/host configurations can be analyzed and used to identify the impact of cyber attacks. We will develop an asset-to-mission model that represents the complex relationships that exist between network nodes, network services, mission-critical cyber capabilities, and organizational missions. The model will include how factors such as redundancies among network assets and timing of mission tasks affect the operational impact of cyber attacks. Because populating such a model with real enterprise data is a laborious process, we also propose to identify methods to automatically collect network data to estimate critical dependencies between nodes, services, capabilities and missions. We will develop a conceptual prototype that incorporates the results of a populated model into an information display that maps network nodes to the services they support, maps the services to the mission-relevant capabilities they support, and maps those capabilities to the organizational missions that depends on them. An important part of our proposed work will be our exploration of current network mapping, attacker modeling, and mission planning systems to determine integration opportunities for Phase II development and transition of this research.