C4I Center at GMU - 2015 STIDS Conference Tutorial

Mission and Purpose of the Threat and Risk Specification

Any organization (commercial, not-for-profit, or government) conducts operations and considers various threats and risks that may disrupt these operations. Threats and risks are increasingly multi-dimensional in nature - spanning physical space and cyber space. Due to the complexity, connectivity and global nature of threats faced by modern organizations, effective risk management and situational awareness depends on collaboration, information sharing and analytics. The mission of this specification is to substantially reduce the time, cost risks and overhead of independent entities communicating risk and threat information and of federating, simulating and analyzing that information.

Only by federating information across multiple domains such as cyber, physical, critical infrastructure, criminal, intelligence, health and defense, irrespective of technical and political boundaries, can we effectively counter multi-dimensional intentional threats, natural events and system failures. The situation prior to this specification and subsequent implementations is that there are multiple risk and threat sharing and analytics capabilities in different domains, supporting different disciplines and using different data schema and technologies. While each of these provides value for its purpose, the community has been missing the capability to consider information in context, in combination and with the added value of information from other domains and disciplines. The essential value of information dramatically increases as it is rubbed together with other information. What is not needed is yet another data structure that intends to be the one ring that binds them all, what is needed is the capability to federate and translate between different data structures, technologies, terminologies and human languages relating to risks and threats. Of particular interest is the integration and mapping of NIEM (National Information Exchange Model), STIX (Structured Threat Information Exchange), the NIST cyber security framework and other standards, technologies and products for threat and risk information sharing or analytics.

To meet these goals we seek to define the semantics of risk and threat information, as well as the semantics of the more general concepts from which risk and threat builds, as a conceptual model (Ontology) that is then mapped to and between multiple data sharing formats. Implementations will then be able to map between and federate information from any of these data formats. It is further the goal of the community to then build and deploy capabilities that are able to leverage these models to provide advanced analytics, intelligent simulation and dynamic information sharing.

While this specification is international in scope, statements at the highest levels of the U.S. government are informative. As stated in the recent executive order 3 of the President of the United States: In order to address cyber threats to public health and safety, national security, and economic security of the United States, private companies, nonprofit organizations, executive departments and agencies (agencies), and other entities must be able to share information related to cybersecurity risks and incidents and collaborate to respond in as close to real time as possible. The threat/risk specification provides the fundamental semantic underpinnings of this capability. It does so based on open standards and an open community of interest. The Threat and Risk Specification was developed by a consortium of seventeen major industry and government organizations.