Homodyne detection = method of detecting a weak frequency-modulated signal through mixing with a strong reference frequency-modulated signal (so-called local oscillator).

See attachment 👇.

MITRE D3FEND is a knowledge base — more precisely a knowledge graph — of cybersecurity countermeasures/techniques, created with the primary goal of helping standardise the vocabulary used to describe defensive cybersecurity functions/technologies.

• It serves as a catalogue of defensive cybersecurity techniques and their relationships to offensive/adversarial techniques.

The D3FEND knowledge graph was designed to map MITRE ATT&CK techniques (or sub-techniques) through digital artefacts to defensive techniques; see Fig. 1.

• Any digital trail left by an adversary, such as Internet search, software exploit and phishing email, is a digital artefact [KS21, Sec. IVE].

Operationally speaking, the D3FEND knowledge graph allows looking up of defence techniques against specific MITRE ATT&CK techniques.

• For example, looking up Data Obfuscation (T1001) returns this knowledge graph.

Watch an overview of the D3FEND knowledge graph from MITRE on YouTube:

NIST provides guidelines on engineering trustworthy (see Definition 1) and cyber-resilient (see Definition 2) systems through NIST SP 800-160 volumes 1 and 2 [RWM22, RPG+21], to be used in conjunction with

• ISO/IEC/IEEEE International Standard 15288:2015 [ISO15],
• NIST SP 800-37 [Joi18] and
• NIST SP 800-53 [Joi20].

A primary objective of NIST SP 800-160 volume 1 is to provide a basis for establishing a discipline for systems security engineering as part of systems engineering in terms of its principles, concepts, activities and tasks.

• Systems engineering is a transdisciplinary and integrative approach to enabling the successful realisation, use, and retirement of engineered systems [RWM22, Sec. 2.2].
• Systems security engineering is meant to provide complementary engineering capabilities that extend the concept of trustworthiness to deliver trustworthy systems [RWM22, p. 2].
• Without going into details, Fig. 1 captures the workflow in the prescribed Systems Security Engineering Framework [RWM22, Sec. 4].

A primary objective of NIST SP 800-160 volume 2 is to provide guidance on how to apply cyber resilience concepts, constructs and engineering practices to systems security engineering and risk management for systems (e.g., enterprise IT, industrial control systems, Internet of Things) and organisations.

The National Institute of Standards and Technology (NIST) has an essential role in identifying and developing cybersecurity risk frameworks for voluntary use by owners and operators of critical infrastructure (see Definition 1) [NIS18, Executive Summary].

Framework Core

This is a set of cybersecurity activities, desired outcomes and applicable references (industry standards, guidelines and practices) that are common across critical infrastructure sectors [NIS18, Sec. 1.1].

The Framework Core consists of five concurrent and continuous Functions that provide a high-level strategic view of the lifecycle of an organisation’s management of cybersecurity risks:

1. Identify: Develop an organisational understanding to manage cybersecurity risks to systems, people, assets, data and capabilities [NIS18, p. 7].

   Applicable activities include [MMQT21]:

   • identifying critical enterprise processes and assets;
   • documenting information flows (how information is collected, stored, updated and used);
   • maintaining hardware and software inventories;
   • establishing cybersecurity policies specifying roles, responsibilities and procedures in integration with enterprise risk considerations;
   • identifying and assessing vulnerabilities and threats;
   • identifying, prioritising, executing and tracking risk responses.

2. Protect: Develop and implement appropriate safeguards to ensure delivery of critical services [NIS18, p. 7].

   Applicable activities include [MMQT21]:

   • managing access to assets and information;
   • safeguarding sensitive data, including applying authenticated encryption and deleting data that are no longer needed;
   • making regular backups and storing backups offline;
   • deploying firewalls and other security products, with configuration management, to protect devices;
   • keeping device firmware and software updated, while regularly scanning for vulnerabilities;
   • training and regularly retraining users to maintain cybersecurity hygiene.

3. Detect: Develop and implement appropriate activities to identify the occurrence of a cybersecurity event [NIS18, p. 7].

   Applicable activities include [MMQT21]:

   • developing, testing and updating processes and procedures for detecting unauthorised entities and actions in the cyber and physical environments;
   • maintaining logs and monitoring them for anomalies, including unexpected changes to systems or accounts, illegitimate communication channels and data flows.

4. Respond: Develop and implement appropriate activities to take action regarding a detected cybersecurity incident [NIS18, p. 8].

   Applicable activities include [MMQT21]:

   • making, testing and updating response plans, including legal reporting requirements, to ensure each personnel is aware of their responsibilities;
   • coordinating response plans and updates with all key internal and external stakeholders.

5. Recover: Develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired by a cybersecurity incident [NIS18, p. 8].

   Applicable activities include [MMQT21]:

   • making, testing and updating recovery plans;
   • coordinating recovery plans and updates with all key internal and external stakeholders, paying attention to what, how and when information is shared;
   • managing public relations and company reputation.

Each Function comprises Categories, and each Category comprises Subcategories, and for each Subcategory, Informative References are provided [NIS18, Sec. 2.1].

• A Category is a cybersecurity outcome closely tied to programmatic needs and particular activities.
• A Subcategory is an outcome of technical and/or management activities for supporting achievement of the outcomes in each Category.
• An Informative Reference is a specific part of a standard, guideline and practice common among critical infrastructure sectors that illustrates a method to achieve the outcomes associated with each Subcategory.

Fig. 1 shows Categories, and the Subcategories under the Category “Business Environment”, and furthermore the Informative References for each of these Subcategories.

Implementation Tiers

The four tiers in Table 1 provide context on how an organisation views cybersecurity risks and the processes in place to manage those risks [NIS18, p. 8].

Table 1: Implementation tiers [NIS18, pp. 9-11].

Tier	Risk management process	Integrated risk management program	External participation
1, Partial	Not formalised, ad hoc and reactive.	Limited cybersecurity awareness. Risk management is irregular and case-by-case.	Organisation does not engage with other entities, and lacks awareness of cyber supply chain risks.
2, Risk-informed	Formalised but not organisation-wide. Prioritisation of cybersecurity objectives and activities is directly informed by organisational risks, business requirements, or the threat environment.	Cybersecurity awareness exists at the organisational level, but risk management is not organisation-wide. Irregular risk assessment of assets.	Organisation receives information from other entities and generates some of its own, but may not share information with others. Organisation is aware of cyber supply chain risks, but does not respond formally to the risks.
3, Repeatable	Formalised and regularly updated based on the application of risk management processes to changes in business requirements and the threat landscape.	Risk management is organisation-wide. Organisation accurately and consistently monitors cybersecurity risks of assets. Organisation responds effectively and consistently to changes in risks. Cybersecurity is considered through all lines of operation.	Organisation receives information from other entities and share its original information with others. Organisation is aware of cyber supply chain risks, and usually responds formally to the risks.
4, Adaptive	Formalised and adaptable to experience and forecast. Continuously improved leveraging advanced cybersecurity technologies and practices, to respond to evolving, sophisticated threats in a timely and effective manner.	Risk management is organisation-wide. Decision making is grounded in clear understanding of the relationship between cybersecurity risks and financial risks / organisational objectives. Risk management is integral to organisational culture and is supported by continuous awareness of activities on systems and networks.	Organisation receives, generates and reviews prioritised information to inform continuous risk assessment. Organisation uses real-time information to respond formally and consistently to cyber supply chain risks.

Implementation tiers do not represent maturity levels; they are meant to support organisational decision making about how to manage cybersecurity risks.

Framework Profiles

A Framework Profile (“Profile”) is a representation of the outcomes that a particular system or organisation has selected from the Framework Categories and Subcategories [NIS18, Appendix B].

A Profile specifies the alignment of the Functions, Categories, and Subcategories with the business requirements, risk tolerance, and resources of an organisation [NIS18, Sec. 2.3].

A Profile enables organisations to establish a roadmap for reducing cybersecurity risks, that 1️⃣ is well aligned with organisational and sector goals, 2️⃣ considers legal/regulatory requirements and industry best practices, and 3️⃣ reflects risk management priorities [NIS18, Sec. 2.3].

For example,

• The NIST Interagency Report 8401 [LSB22] specifies a Profile for securing satellite ground segments.
• A Profile for securing hybrid satellite networks is currently under development.
• More examples of Profiles can be found here.

Watch a more detailed explanation of the Cybersecurity Framework presented at RSA Conference 2018:

First proposed by Canetti [Can01], the paradigm of universally composable security guarantees security even when a secure protocol is composed with an arbitrary set of protocols, or more generally when the protocol is used as a component of an arbitrary system.

• It guarantees security even when an unbounded number of protocol instances are executed concurrently in an adversarially controlled manner.
• It is an essential property for maintaining security of cryptographic protocols in complex and unpredictable environments such as the Internet.

The Cyber Kill Chain® framework/model was developed by Lockheed Martin as part of their Intelligence Driven Defense® model for identification and prevention of cyber intrusions.

The model identifies what an adversary must complete in order to achieve its objectives.

The seven steps of the Cyber Kill Chain sheds light on an adversary’s tactics, techniques and procedures (TTP):

Watch a quick overview of the Cyber Kill Chain on LinkedIn Learning:

Overview of the cyber kill chain from Ethical Hacking with JavaScript by Emmanuel Henri

MITRE Engage (previously MITRE Shield) is a framework for planning and discussing adversary engagement operations.

• It is meant to empower defenders to engage their adversaries and achieve their cybersecurity goals.

Cyber defense has traditionally focussed on applying defence-in-depth to deny adversaries’ access to an organisation’s critical cyber assets.

Increasingly, actively engaging adversaries proves to be more effective defence [MIT22b].

• For example, making adversaries doubt the value of any data/information they stole drives down the value of their operations and up their operating cost.

While MITRE Engage has not been around for long, the practice of cyber deception has a long history; honeypots for example can be traced back to the 1990s [Spi04, Ch. 3].

MITRE Engage prescribes the 10-Step Process, which was adapted from the process of deception in [RW13, Ch. 19], in Fig. 1:

Operationalise the Methodologies

The foundation of an adversary engagement strategy is the Engage Matrix:

The Matrix serves a shared reference that bridges the gap between defenders and decision makers when discussing and planning denial, deception, and adversary engagement activities.

The Matrix allows us to apply the theoretical 10-Step Process (see Fig. 1) to an actual operation.

The top row identifies the goals: Prepare and Understand, as well as the objectives: Expose, Affect and Elicit.

• The Prepare and Understand Goals focus on the inputs and outputs of an operation.
• While the Matrix is linear like the 10-Step Process, it should be viewed as cyclical.

The second row identifies the approaches, which let us make progress towards our selected goal.

The remainder of the Matrix identifies the activities.

• The same activities often appear under one or more approach or goal/objective, e.g., Lures under Expose ▶ Detect, Affect ▶ Direct and Affect ▶ Disrupt, because activities can be adapted to fit multiple use cases.
• An adversary’s action may expose an unintended weakness of the adversary.
• We can look at each MITRE ATT&CK® technique to examine the weaknesses revealed and identify engagement activities to exploit these weaknesses.
• Fig. 3 shows an example of mapping a MITRE ATT&CK technique to an engagement activity.