The potential of Cyber Threat Intelligence analytical frameworks in research on information operations and influence operations
cytuj
pobierz pliki
RIS BIB ENDNOTEWybierz format
RIS BIB ENDNOTEData publikacji: 18.12.2024
Przegląd Bezpieczeństwa Wewnętrznego, 2024, Numer 31 (16), s. 279 - 320
https://doi.org/10.4467/20801335PBW.24.027.20804Autorzy
The potential of Cyber Threat Intelligence analytical frameworks in research on information operations and influence operations
The article’s aim is to evaluate the utility of using the Cyber Threat Intelligence (CTI) approach in analysing information and influence operations. The study was carried out by a comparative method based on the technique of desk research. The point of comparison for the CTI methodology were methods originated in communicology, which are relatively popular in the study of propaganda. The authors try to answer the question of what methodological contribute to the study of the discussed phenomena – and thus to the practical potential of the analyst’s workshop – is the adoption of a paradigm for the analysis of information operations and influence operations based on models of tactics, techniques, and procedures (TTPs) recognition and taxonomy of ICT incidents or typification of CTI threat actors. The central focus of the study is a critical analysis of English-language publications discussing the use of CTI in disinformation analysis. The main conclusion from the analysis includes a thesis about the limited methodological benefits of CTI based methods, while using their technical and organisational strengths to research elements of information operations and influence operations in which cyberspace is used.
Bergh A., Understanding Influence Operations in Social Media: A Cyber Kill Chain Approach, “Journal of Information Warfare” 2020, vol. 19, no. 4, pp. 110–131.
Bernays E.L., Propaganda, New York 1928.
Caramancion K.M. et al., The Missing Case of Disinformation from the Cybersecurity Risk Continuum: A Comparative Assessment of Disinformation with Other Cyber Threats, “Data” 2022, vol. 7, no. 4, pp. 1–18. https://doi.org/10.3390/data7040049.
Dijk J. van, Społeczne aspekty nowych mediów (Eng. Social aspects of new media), Warszawa 2010.
Dobek-Ostrowska B., Komunikowanie polityczne i publiczne (Eng. Political and public communication), Warszawa 2007.
Dobek-Ostrowska B., Podstawy komunikowania społecznego (Eng. Fundamentals of social communication), Wrocław 1999.
Dobek-Ostrowska B., Fras J., Ociepka B., Teoria i praktyka propagandy (Eng. Theory and practice of propaganda), Wrocław 1999.
Jowett G.S., O’Donnell V., Propaganda and Persuasion. Fifth Edition, Los Angeles–London– New Delhi–Singapore–Washington 2012.
Kacała T., Tendencje rozwojowe współczesnych działań psychologicznych prowadzonych przez Siły Zbrojne RP (Eng. Developmental trends of contemporary psychological activities carried out by the Polish Armed Forces), in: Innowacja i synergia w Siłach Zbrojnych RP, vol. 1, A. Lis, R. Reczkowski (eds.), Bydgoszcz 2012, pp. 87–118.
Kacała T., Lipińska J., Komunikacja strategiczna i public affairs (Eng. Strategic communication and public affairs), Warszawa 2014.
Larecki J., Wielki leksykon służb specjalnych świata (Eng. Great lexicon of the world’s special services), Warszawa 2007.
Minkina M., Sztuka wywiadu w państwie współczesnym (Eng. The art of intelligence in the modern state), Warszawa 2014.
Modrzejewski Z., Information operations from the Polish point of view, “Obrana a strategie” (Defence and Strategy) 2018, no. 1, pp. 115–132. https://doi.org/10.3849/18027199.18.2018.01.113-130.
Oosthoek K., Doerr Ch., Cyber Threat Intelligence: A Product Without a Process?, “International Journal of Intelligence and Counter Intelligence” 2021, vol. 34, no. 2, pp. 300–315. https://doi.org/10.1080/08850607.2020.1780062.
Rajczyk R., Nowoczesne wojny informacyjne (Eng. Modern information warfare), Warszawa 2016.
Roberts S.J., Brown R., Intelligence-Driven Incident Response. Outwitting the Adversary, Sebastopol 2017.
Świerczek M., Working methods of the Russian secret services in the light of the Oleg Kulinich case, “Internal Security Review” 2023, no. 29, pp. 289–322. https://doi.org/10.4467/20801335PBW.23.031.18773.
Wasilewski J., Zarys definicyjny cyberprzestrzeni (Eng. Definition outline of cyberspace), “Przegląd Bezpieczeństwa Wewnętrznego” 2013, no. 9, pp. 225–234.
Wojnowski M., „Zarządzanie refleksyjne” jako paradygmat rosyjskich operacji informacyjno-psychologicznych w XXI w. (Eng. ‘Reflective management’ as a paradigm for Russian information-psychological operations in the 21st century), “Przegląd Bezpieczeństwa Wewnętrznego” 2015, no. 12, pp. 11–36.
Woolley S.C., Howard P.N., Introduction: Computational Propaganda Worldwide, in: Computational Propaganda: Political Parties, Politicians, and Political Manipulation on Social Media, S.C. Woolley, P.N. Howard (eds.), Oxford 2018, pp. 3–18. https://doi.org/10.1093/oso/9780190931407.001.0001.
About Strategic Communications, NATO Strategic Communications Centre of Excellence, https://stratcomcoe.org/about_us/about-strategic-communications/1 [accessed: 10 VII 2024].
Acquire Infrastructure: Domains, Attack. Mitre, https://attack.mitre.org/techniques/T1583/001/ [accessed: 24 VIII 2024].
Allied Joint Doctrine for Information Operations (AJP-10.1), UK Ministry of Defence, https://www.gov.uk/government/publications/allied-joint-doctrine-for-information-operations-ajp-101 [accessed: 28 XII 2023].
Allied Joint Doctrine for Psychological Operations (AJP-3.10.1), UK Ministry of Defence, https://www.gov.uk/government/publications/ajp-3101-allied-joint-doctrine-for-psychological-operations [accessed: 5 VII 2024].
An introduction to threat intelligence, CERT-UK, https://www.ncsc.gov.uk/files/An-introduction-to-threat-intelligence.pdf [accessed: 10 IX 2024].
APT29, Attack. Mitre, https://attack.mitre.org/groups/G0016/ [accessed: 24 VIII 2024].
ATT&CK Matrix for Enterprise, Attack. Mitre, https://attack.mitre.org/ [accessed: 24 VIII 2024].
Brangetto P., Veenendaal M.A., Influence Cyber Operations: The Use of Cyberattacks in Support of Cyberattacks in Support of Influence Operations, in: 8th International Conference on Cyber Conflict. Proceedings 2016, N. Pissanidis et al. (sci. ed.), https://ccdcoe.org/uploads/2018/10/Art-08-Influence-Cyber-Operations-The-Use-of-Cyberattacks-in-Support-of-Influence-Operations.pdf, pp. 113–126 [accessed: 10 VII 2024].
Caltagirone S., Pendergast A., Betz Ch., The Diamond Model of Intrusion Analysis, https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf [accessed: 24 VIII 2024].
Cambridge Dictionary, https://dictionary.cambridge.org/dictionary/english/operation [accessed: 28 XII 2023].
Collier J., Ronis S., Navigating the Trade-Offs of Cyber Attribution, https://cloud.google.com/blog/topics/threat-intelligence/trade-offs-attribution/ [accessed: 22 VIII 2024].
Combating Foreign Influence, FBI, https://www.fbi.gov/investigate/counterintelligence/foreign-influence [accessed: 2 XI 2024].
Cybersecurity and Foreign Interference in the EU Information Ecosystem, ENISA, 8 XII 2022, https://www.enisa.europa.eu/news/cybersecurity-foreign-interference-in-the-eu-information-ecosystem [accessed: 20 IX 2024].
Cyber Influence Operations, https://www.microsoft.com/en-us/security/business/microsoft-digital-defense-report-2022-cyber-influence-operations [accessed: 10 VII 2024].
DeBolt M. et al., CTI-CMM Cyber Threat Intelligence Capability Maturity Model, Version 1.0, https://d39ec1uo9ktrut.cloudfront.net/Datasheets/CTI-CMM-Cyber-Threat-Intelligence-Capability-Maturity-Model.pdf [accessed: 22 VIII 2024].
DISARM Disinformation TTP (Tactics, Techniques and Procedures) Framework, GitHub, https://github.com/DISARMFoundation/DISARMframeworks/ [accessed: 5 VIII 2024].
DISARM Foundation, https://www.disarm.foundation/about-us [accessed: 5 VIII 2024].
DISARM Frameworks – incidents, GitHub, https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/incidents_index.md [accessed: 31 VIII 2024].
DISARM Frameworks – phases, GitHub, https://github.com/DISARMFoundation/DISARMframeworks/tree/main/generated_pages/phases [accessed: 31 VIII 2024].
DISARM Frameworks – techniques, GitHub, https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques_index.md [accessed: 31 VIII 2024].
Facebook. Threat research, GitHub, https://github.com/facebook/threat-research [accessed: 11 VIII 2024].
Ferazza F.M., Cyber Kill Chain, MITRE ATT&CK, and the Diamond Model: a comparison of cyber intrusion analysis models, https://www.royalholloway.ac.uk/media/20188/techreport-2022-5.pdf.pdf [accessed: 25 VIII 2024].
Foreign Information Manipulation and Interference (FIMI) and Cybersecurity – Threat Landscape, ENISA, 8 XII 2022, https://www.enisa.europa.eu/publications/foreign-information-manipulation-interference-fimi-and-cybersecurity-threat-landscape [accessed: 20 IX 2024].
Glossary of Intelligence Terms and Definitions, https://www.cia.gov/readingroom/docs/CIA-RDP80M00596A000500020003-7.pdf [accessed: 28 XII 2023].
Headquarters Department of the Army, FM 100-6, Information Operations, Washington 1996, https://www.hsdl.org/?view&did=437397 [accessed: 28 XII 2023].
Hutchins E.M., Cloppert M.J., Amin R.M., Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains, https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf [accessed: 24 VIII 2024].
Information Operations, http://web.archive.org/web/20201226185947/https://transparency.twitter.com/en/reports/information-operations.html [accessed: 11 VIII 2024].
Information Operations. Joint Publication 3-13, https://defenseinnovationmarketplace.dtic.mil/wp-content/uploads/2018/02/12102012_io1.pdf [accessed: 30 I 2023].
Information Sharing and Analysis Centres (ISACs). Cooperative models, ENISA, 2017, https://www.enisa.europa.eu/publications/information-sharing-and-analysis-center-isacs-cooperative-models/@@download/fullReport [accessed: 24 VIII 2024].
Introduction to STIX, https://oasis-open.github.io/cti-documentation/stix/intro.html [accessed: 24 VIII 2024].
IO-Campaign-Collections, GitHub, https://github.com/tripkrant/IO-Campaign-Collections [accessed: 31 VIII 2024].
Joint Doctrine for Command and Control Warfare (C2W), https://apps.dtic.mil/sti/pdfs/ADA357635.pdf [accessed: 28 XII 2023].
Larson E.V. et al., Foundations of Effective Influence Operations. A Framework for Enhancing Army Capabilities, Rand Corporation, 2009, https://www.rand.org/pubs/monographs/ MG654.html [accessed: 18 XI 2024].
Mavroeidis V., Bromander S., Cyber Threat Intelligence Model: An Evaluation of Taxonomies, Sharing Standards, and Ontologies within Cyber Threat Intelligence, https://arxiv.org/ pdf/2103.03530 [accessed: 24 VIII 2024].
Microsoft Digital Defence Report 2022, https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/microsoft-digital-defense-report-2022.pdf?culture=en-us&country=us [accessed: 11 VIII 2024].
MISP. Threat Sharing, https://www.misp-project.org/ [accessed: 24 VIII 2024].
Niedzielski D., Wojskowa doktryna komunikacji strategicznej NATO i jej znaczenie dla Polski (Eng. NATO’s Military strategic communications doctrine and its relevance to Poland), “Akademickie Centrum Komunikacji Strategicznej” 2022, no. 3, https://www.wojsko-polskie.pl/aszwoj/u/af/14/af143adc-70e6-463a-8448-faaf0df61e9a/biuletyn_nr_3.pdf, pp. 46–53 [accessed: 10 VII 2024].
OpenCTI, https://filigran.io/solutions/open-cti/ [accessed: 24 VIII 2024].
Oxford English Dictionary, https://www.oed.com/dictionary/operation_n?tab=factsheet&tl=true#33665121 [accessed: 28 XII 2023].
Pamment J., Smith V., Attributing Information Influence Operations: Identifying those Responsible for Malicious Behaviour Online, https://stratcomcoe.org/publications/download/Nato-Attributing-Information-Influence-Operations-DIGITAL-v4.pdf [accessed: 18 VIII 2024].
Pols P., The Unified Kill Chain. Raising resilience against advanced cyber attacks, https://www.unifiedkillchain.com/assets/The-Unified-Kill-Chain.pdf [accessed: 24 VIII 2024].
Porche I.R. et al., Redefining Information Warfare Boundaries for an Army in Wireless World, https://www.rand.org/content/dam/rand/pubs/monographs/MG1100/MG1113/RAND_ MG1113.pdf [accessed: 28 XII 2023].
Preparing for and Mitigating Foreign Influence Operations Targeting Critical Infrastructure, https://www.cisa.gov/sites/default/files/2023-01/cisa_insight_mitigating_foreign_influence_508.pdf [accessed: 29 XII 2023].
Raport o stanie bezpieczeństwa cyberprzestrzeni RP w 2023 roku (Eng. Report on the state of Poland’s cybersecurity in 2023), CSIRT GOV, https://csirt.gov.pl/cer/publikacje/raporty-o-stanie-bezpi/980,Raport-o-staniebezpieczenstwa-cyberprzestrzeni-RP-w2023-roku.html, p. 20 [accessed: 31 VIII 2024].
Shires J., Hack-and-leak operations and U.S. cyber policy, War on the Rocks, 14 VIII 2020, https://warontherocks.com/2020/08/the-simulation-of-scandal/ [accessed: 10 VII 2024].
SJ Terp, https://www.infosecurity-magazine.com/profile/sj-terp/ [accessed: 5 VIII 2024].
Słownik języka polskiego PWN (Eng. PWN Dictionary of the Polish Language), https://sjp.pwn.pl/szukaj/operacja.html [accessed: 3 VII 2024].
SolarWinds Compromise, Attack. Mitre, https://attack.mitre.org/campaigns/C0024/ [accessed: 24 VIII 2024].
Terms & Definitions of Interest for DoD Counterintelligence Professionals, https://www.dni.gov/files/NCSC/documents/ci/CI_Glossary.pdf [accessed: 28 XII 2023].
Terp SJ, Breuer P., DISARM: A Framework for Analysis of Disinformation Campaigns, 2022 IEEE Conference on Cognitive and Computational Aspects of Situation Management (CogSIMA), https://ieeexplore.ieee.org/document/9830669 [accessed: 5 VIII 2024].
Threat Report: Combating Influence Operations, Meta, 26 V 2021, https://about.fb.com/news/2021/05/influence-operations-threat-report/ [accessed: 11 VIII 2024].
Threat Report. The State of Influence Operations 2017–2020, https://about.fb.com/wp-content/uploads/2021/05/IO-Threat-Report-May-20-2021.pdf [accessed: 10 VII 2024].
TTP in cybersecurity, Sekoia, https://www.sekoia.io/en/glossary/ttp-cyber-tactics-techniques-and-procedures/ [accessed: 9 IX 2024].
Updated IC Gray Zone Lexicon: Key Terms and Definitions, https://www.dni.gov/files/ODNI/documents/assessments/NIC-Unclassified-Updated-IC-Gray-Zone-Lexicon-July2024.pdf [accessed: 11 VIII 2024].
Wagner T.D. et al., Cyber Threat Intelligence Sharing: Survey and Research Directions, https://www.open-access.bcu.ac.uk/7852/1/Cyber%20Threat%20Intelligence%20Sharing%20Survey%20and%20Research%20Directions.pdf [accessed: 24 VIII 2024].
Wardle C., Derakhshan H., Information Disorder: Toward an interdisciplinary framework for research and policy making, Council of Europe report DGI(2017)09, https://edoc.coe.int/en/media/7495-information-disorder-toward-an-interdisciplinary-framework-for-research-and-policy-making.html [accessed: 10 VII 2024].
Watling J., Danyluk O., Reynolds N., Preliminary Lessons from Russia’s Unconventional Operations During the Russo-Ukrainian War, February 2022–February 2023, https://static.rusi.org/202303-SR-Unconventional-Operations-Russo-Ukrainian-War-web-final.pdf.pdf [accessed: 10 VII 2024].
Watts C., Advanced Persistent Manipulators, Part One: The Threat to Social Media Industry, Alliance for Securing Democracy, 12 II 2019, https://securingdemocracy.gmfus.org/advanced-persistent-manipulators-part-one-the-threat-to-the-social-media-industry/ [accessed: 18 VIII 2024].
Words of Estimative Probability, Analytic Confidences, and Structured Analytic Techniques, Center for Internet Security, https://www.cisecurity.org/ms-isac/services/words-of-estimative-probability-analytic-confidences-and-structured-analytic-techniques [accessed: 23 VIII 2023].
Wright C., The Diamond Model for Influence Operations Analysis, https://go.recordedfuture.com/hubfs/white-papers/diamond-model-influence-operations-analysis.pdf [accessed: 28 VII 2024].
Act of 17 February 2005 on the computerisation of the activities of entities performing public tasks (Journal of Laws of 2024, item 1557).
Act of 29 August 2002 on martial law and the competences of the Commander-in-Chief of the Armed Forces and the principles of his subordination to the constitutional bodies of the Republic of Poland (Journal of Laws of 2022, item 2091).
Act of 6 June 1997 – Criminal Code (Journal of Laws of 2024, item 17).
Strategia Bezpieczeństwa Narodowego Rzeczypospolitej Polskiej 2020 (Eng. National Security Strategy of the Republic of Poland 2020), https://www.bbn.gov.pl/ftp/dokumenty/Strategia_Bezpieczenstwa_Narodowego_RP_2020.pdf [accessed: 10 VII 2024].
Informacje: Przegląd Bezpieczeństwa Wewnętrznego, 2024, Numer 31 (16), s. 279 - 320
Typ artykułu: Oryginalny artykuł naukowy
Tytuły:
Polskie Towarzystwo Bezpieczeństwa Narodowego
Polska
Publikacja: 18.12.2024
Status artykułu: Otwarte
Licencja: CC-BY-NC-SA
Udział procentowy autorów:
Informacje o autorze:
Korekty artykułu:
-Języki publikacji:
AngielskiLiczba wyświetleń: 10
Liczba pobrań: 7