Towards a Security Impact Analysis Framework: A Risk-Based and MITRE Attack Approach

Abstract

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

A Methodological Approach towards Cyber Risk Management in Land Administrations Systems

“…There are promising avenues for enhancing cyber risk management elicitation processes through a socio-technical approach and fostering a culture of cybersecurity within an organisation supported by a security operational centre (SOC) [79]. Avenues for expansion to international collaboration are essential to develop a common Cyber Threat Intelligence for cadastral data, with medium-term development of tactics, techniques, and procedures (TTP) [88] based on MITRE ATT&CK [89,90] and their sharing between LAS, and with the long-term goal of building dedicated regional and international Computer Security Incident Response Team (CSIRT) Land Administration, as advocated by UNECE [91,92], integrated in multi-stakeholder structure diplomacy for cybersecurity [93].…”

An Integrated Approach to Cyber Risk Management with Cyber Threat Intelligence Framework to Secure Critical Infrastructure

“…However, the described methodology does not account explicitly for cyber threat intelligence information and accounts only for vulnerabilities and threat correlation. In [46], a framework is proposed to utilize the MITRE ATT&CK knowledge base in the risk assessment to provide sufficient evidence during the development lifecycle. The framework describes workflows to create strategic, operational, and technical scenarios based on the EBIOS methodology, with explicit consideration for cyber threat intelligence and its continuous information feeds.…”

“…Moreover, with the scenario-based risk evaluation, it incorporates strategic and operational attack paths, that are identified based on threat actors objectives and the existing scope. These attack paths can be constructed based on threat actors' behaviors, as in [46], by considering threat intelligence information. These enhancements improve accuracy and provide realistic results, enhancing risk assessment scenarios and treatment.…”

“…Although it dynamically considers new technical information, mainly vulnerabilities, to adapt to analyzed risks, it does not account for other types of new threat intelligence information. SAIF [46] and the Unified Approach Model [47] integrate threat intelligence in cyber risk management but without addressing the adaptation of risks based on new threat intelligence. For instance, the approach of SAIF [46] can be used in phases three and four of our proposed framework to ensure the incorporation of the MITRE knowledge base in the definition of scenarios.…”

“…SAIF [46] and the Unified Approach Model [47] integrate threat intelligence in cyber risk management but without addressing the adaptation of risks based on new threat intelligence. For instance, the approach of SAIF [46] can be used in phases three and four of our proposed framework to ensure the incorporation of the MITRE knowledge base in the definition of scenarios. The proposed framework in [48] drives a national risk assessment based on a national vulnerabilities inventory.…”