Active defense
Active defense can refer to a defensive strategy in the military or cybersecurity arena.
In the cybersecurity arena, active defense may mean "asymmetric defenses," namely defenses that increase costs to cyber-adversaries by reducing costs to cyber-defenders.[1] For example, an active defense data protection strategy leverages dynamic data movement, distribution, and re-encryption to make data harder to attack, steal, or destroy.[2] Prior data protection approaches relied on encryption of data at rest, which leaves data vulnerable to attacks including stealing of ciphertext, cryptographic attack, attacks on encryption keys, destruction of encrypted data, ransomware attacks, insider attacks, and others. Three ACM computing conferences have explored Moving Target Defense as a strategy for network and application-level security as well, for instance by rotating IP addresses or dynamically changing network topologies.[3] Production implementations of MTD are provided by companies for applications including legacy systems, communications, and election security.[4] Additionally, "active defense measures" are often another term used to define and refer to offensive cyber operations (OCOs) or computer network attacks (CNAs).
Some have defined active defenses as including of deception or honeypots, which seek to confuse attackers with traps and advanced forensics.[5] Examples of such honeypot technologies include Illusive Networks,[6] TrapX,[7] Cymmetria,[8] Attivo,[9] and others. Other types of active defenses might include automated incident response, which attempts to tie together different response strategies in order to increase work for attackers and decrease work for defenders.[10]
National Contexts
[edit]USA
[edit]The Department of Defense defines active defense as: "The employment of limited offensive action and counterattacks to deny a contested area or position to the enemy."[11] This definition does not specify whether it refers to physical actions, or cyber-related actions. Recently, the Department of Homeland Security and financial institutions have identified Active Defense as a top priority for security industrial infrastructure systems.[12] As part of a broader push for greater resiliency, the National Institute of Standards and Technology 800-160 Volume 2 framework has gone further, providing guidance on standardization for active defense.[13] [14]
China
[edit]China describes its military posture as active defense, defined in a 2015 state white paper as "We will not attack unless we are attacked, but we will surely counterattack if attacked."[15]
See also
[edit]- Moving Target Defense
- Proactive cyber defence
- Software-defined networking
- The Concept of Active Defence in China's Military Strategy
References
[edit]- ^ Burshteyn, Mike (2016-12-22). "What does 'Active Defense' mean?". CryptoMove. Retrieved 2016-12-24.[permanent dead link]
- ^ CryptoMove Archived 2021-02-06 at the Wayback Machine invented such technology that protects data by constantly moving, distributing, mutating, and re-encrypting it.
- ^ "Second ACM Workshop on Moving Target Defense (MTD 2015)". mtd.mobicloud.asu.edu. Retrieved 2016-12-25.
- ^ "Dispel Launches Election Security Platform". securityweek.com. 15 February 2018. Retrieved 2018-06-15.
- ^ "Implementing Active Defense Systems". SANS White Paper.
- ^ "illusive networks: The Leader In Deception Technology". www.illusivenetworks.com. Retrieved 2016-12-24.
- ^ "TrapX Security". trapx.com. Retrieved 2016-12-24.
- ^ "Home - Cymmetria". Cymmetria | Cyber deception. Retrieved 2016-12-24.
- ^ "Deception-Based Threat Detection - Attivo Networks". Attivo Networks. Retrieved 2016-12-24.
- ^ SANS WhitePaper on Incident Response and Active Defense, https://www.sans.org/reading-room/whitepapers/detection/implementing-active-defense-systems-private-networks-34312
- ^ "U.S. DoD Terminology: active defense". Retrieved 2016-12-24.
- ^ "Financial Services Cyber Security Active Defense (FSCSAD) - Federal Business Opportunities: Opportunities". www.fbo.gov. Retrieved 2016-12-25.
- ^ "Systems Security Engineering: Cyber Resiliency Considerations for the Engineering of Trustworthy Secure Systems" (PDF). www.nist.gov. Retrieved 2018-06-15.
- ^ Woods, Dan. "5 Ways to Fight Back Against Cybersecurity Attacks: The Power of Active Defense". Forbes.
- ^ Garlick, Jeremy (2024). Advantage China: Agent of Change in an Era of Global Disruption. Bloomsbury Academic. p. 41. ISBN 978-1-350-25231-8.
 | This computer security article is a stub. You can help Wikipedia by expanding it. |