The Role of Situational Awareness in Cyber Security and Cyber Defense Strategy

Maintaining consistently high-level situation awareness over hundreds or thousands of ICT objects, such as systems, infrastructure and applications can be challenging. Unfortunately, enterprise networks comprise hundreds or thousands of business objects, such as firewalls, IDSs, routers, switches, services, BYODs & mobile and privileged user community that need to be monitored and protected for safe and secure business operations. To ensure services and operations are safe and secure, operators (analysts and administers) of these systems should be able to identify adversaries (threats and threat actors), detect attacks in realtime, or at least near realtime, estimate impact of attacks when a compromise or security breach occurs, evaluate risks, understand situations and make informed and risk-based decisions on how best to protect these business objects and the services they protect swiftly and accurately. Maintaining such levels of situational awareness over critical business services not only requires fusion of a number of technologies but also health and cognitive building blocks (training, skills, workload and experience) of the operators of the systems and services.