Trusted Autonomous Cyber Robots for Multi-Stage Cyber Attack Investigation

Method Security proposes adapting and extending its commercial product for the purpose of automated attack path enumeration and hardening in the support of Department of the Navy’s (DON) missions. Method Security builds autonomous security robots that can conduct the work of expert security engineers, pen testers, and red teamers 24/7. The outcome is an enumeration of every attack path and automatic hardening within your security stack. All of this happens within your rules of engagement. Method Security deploys on-prem, in the cloud, at the edge, or fully air gapped to protect the most critical environments and mission systems. This proposed Phase 1 Technical Effort involves taking the Method Security product that has already developed, and conceptually adapting and extending it to  DON-specific connectivity-disadvantaged tactical environments, DON-specific data signals, and DON security objectives. Cyber attacks are about to undergo a great acceleration primarily due to advances in Artificial Intelligence (AI). In the same way that AI developer co-pilots have democratized better coding skills to more novice developers, AI will do the same for hackers. Soon thereafter, malware and other cyber weapons will become partially or completely autonomous. This presents a challenge for Defensive Cyber Operations (DCO) in commercial, government, and military environments alike. Traditional security tooling that is often slow, non-interoperable, and requires significant human operator expertise, already can’t keep up with traditional threats, and stands incapable of a more capable adversary. These more capable adversaries will easily throttle between sophisticated attack techniques vs. trivial attack techniques and fast drive by operations vs. low-and-slow operations. DCO has to outmatch this new adversary, and to do that new autonomous defensive cyber solutions are needed that can predict, preempt, and identify threats at machine-speed. In tactical environments, where data may be unique, the bandwidth is Denied, Degraded, Intermittent, or Limited (DDIL), and compute is constrained, even greater challenges are faced for DCO. The luxury of clean environments and abundance of processing resources is thrown out, forcing operations at the tactical edge to be smarter and self-sufficient. Nation State attackers know of this capability gap at the edge, and will seek to exploit these weaknesses until superior DCO capability at the edge is deployed. We propose building a technical conceptual architecture to deploy Method Security’s autonomous defensive cyber product in DON’s tactical environments to enable a multi-stage forensics approach to cyber event analysis and investigation, with the goal of rapidly predicting and preempting threats. This effort would involve a conceptual software architecture to command and control multiple instances of Method Security in edge environments, and multiple scoped security workflows to be automated in a production environment.