The document describes various cybersecurity scenarios detected and responded to by a home security system. In the first scenario, a schoolboy returns home and is recognized by fence cameras through facial recognition as a trusted individual, so no incident report is created. In the second scenario, a mailman drops off a package and is also recognized as trusted, so owners are just notified of his presence. In the third scenario, an untrusted individual scales the fence and is seen as an immediate threat, so the analyst calls in SWAT who arrests the person before they can enter the home.

1. Cyber Defense
Continuum.
Main
Characters.
Supporting
Characters.
Schoolboy
Owners
Gardener
Forensic team
Mailman
Analyst
Thief
SWAT
Lorem ipsum dolor sit amet, consectetur adipiscing
elit, sed do eiusmod tempor incididunt ut labore et
dolore magna aliqua. Ut enim ad minim veniam, quis
nostrud exercitation ullamco laboris nisi ut aliquip ex
ea commodo consequat.
Duis aute irure dolor in reprehenderit in voluptate velit
esse cillum dolore eu fugiat nulla pariatur.
System auto-recognizes trusted insider.
Plot: Schoolboy comes home. Fence camera picks
up via biometrics, e.g. face recognition.
Result: System auto-recognizes him as a trusted
insider. No incident means no response required.
Lorem ipsum dolor sit amet, consectetur adipiscing
elit, sed do eiusmod tempor incididunt ut labore et
dolore magna aliqua.
Ut enim ad minim veniam, quis nostrud exercitation
ullamco laboris nisi ut aliquip ex ea
commodo consequat.
Sources:
1. International Data Corp (IDC), “U.S. Residential Landline Voice Displacement Forecast, 2016–2020, May 2016.
2. Ovum. Market Landscape: Enterprise Mobility Management 2016.
3. Ovum Trends to Watch: Employee Mobility, Feb 2016; Survey results Enterprise Mobility Ovum 2015/16.
4. Smartphone Connections Forecast 2016 – 21, Aug 2019 Ovum-TMT Intelligence, 2016.
5. Abbreviated disclaimer: Results based on third-party study.
6. Network rankings based on RootMetrics® US National and State RootScore® Reports: 2H 2016. Performance rankings of four mobile networks rely on scores calculated from random
samples across all available network types. Your experience may vary. The RootMetrics award is not an endorsement of Verizon. Visit www.rootmetrics.com for more details.
7. Gartner April 11, 2020 “Critical Capabilities for Wireline Telecom Services US”.
2020 North American Frost & Sullivan Award for Market Leadership.
J.D. Power ranks Verizon the top wireless network in five regions in the U.S. Achieved highest score from J.D. Power in all three quality categories: calling, messaging and data. For the seventeenth time in a row, Verizon has received more awards than any other provider in the J.D. Power Wireless Network Quality
Study.
Detection
Network Threat Advanced Analytics
MSS – Analytics
Managed SIEM
Advanced SOC
Analyst has different options to respond:
Data collection &
storage and
intelligence enrichment
Data Intelligence Advanced
analytics
Initial
investigation
Incident
response
Mitigation Emergency
response
Investigative
response
Threat analysis /
incident detection*
USP
(Unified
Security
Portal)
Customer
tools
Security and
end-point
management
Advanced
CERT
“Threat
Intel and
Response”
Incident response
and mitigation
Investigative
response-ProServ
security
Response
Data Raw data enriched Adv. analytics
Analyst
Incident triage
Incident
creation
End-point
Secure house
Notify owners
MSS-prem
(MSS – Premises)
Call CSIRT
Call CERT
Services
Incident workflow
SIEM / SOC
NTAA (Network Threat
Advanced Analytics)
Anomaly-based
monitoring & analytics
of NetFlow traffic on
Verizon platform into USP;
SOC support.
Verizon Platform.
USP (SOC support)
MSSA (MSS Analytics)
Standard monitoring
analytics on Verizon
platform into Verizon
SOC / USP.
Verizon Platform.
Verizon SOC / USP
MSIEM (Managed SIEM)
Monitoring analytics
on customer SIEM into
Verizon SOC / USP.
Customer SIEM
Verizon SOC / USP
ASOC (Advanced SOC)
Tailored monitoring
analytics from customer
SIEM into customer
dedicated
Verizon ASOC / IM mgmt
platform.
Customer SIEM
Cust. dedicated
Verizon ASOC / IM
Summary.
Cyber Defense Continuum.
Contractor.
Trusted actor gone wrong.
Schoolboy.
Trusted actor.
Street camera picks up school bus.1
Fence camera picks up schoolboy
via face recognition.
2
System recognizes schoolboy as trusted
insider and does not create an incident.
3
No incident means
no response required.
3
2
4
1
ResponseDetection
Analyst recognizes trusted 3rd party.
Plot: Mailman drops off a parcel at the mailbox
behind the fence. Analyst recognizes trusted
3rd party.
Result: An incident is identified but initial triage
shows there is no threat. Owners are just notified.
Mailman.
Accept risk.
Detection
Mailman
Boy
Analyst
Owner
Response
1 Street camera picks up postal truck.
Fence camera picks up image of
mailman on the way in - and on the
way out again.
2
3
Camera inside the house does not show
any activity.
4 The system aggregates all information.
5
Analyst evaluates all information,
determines that it is a trusted 3rd party,
and creates an incident (but no threat)
that only requires notification.
2
3
4
6
1
Thief.
Immediate threat.
Untrusted 3rd party triggers incident - SWAT stops
thief before damage.
Plot: Person looking like a thief gets over the fence
using a ladder.
Result: Analyst recognizes the immediate threat
and calls in the SWAT team. The SWAT team
manages to arrest the thief before he can get into
the house.
Trusted 3rd party goes rogue.
Plot: A Gardener was hired to do a
landscaping job around the house (and
behind the fence). He abuses/exceeds his
privileges by breaking into the actual house
where he is looking for jewelry.
Result: Inside camera picks up the
Gardener and analyst remotely looks the
door to the bedroom (with safe inside). At
the same time, he alerts the SWAT team that
manages to arrest the Gardener inside the
house / before he can get away. A breach
has happened but nothing was stolen and
the Owners and Security company do a
forensic investigation as to how to improve
security posture.
Detection
Detection
Thief
Contractor
Owner
Owner
Response
Response
Street camera picks up suspiciously
looking untrusted 3rd party.1
Street camera and fence camera see
Gardener getting onto the premises.1
Fence camera picks up image of thief
getting over the fence.2
2
Gardener breaks into the house and
inside camera monitors this activity.
System aggregates all information.3
3
Ut enim ad minim veniam, quis nostrud
exercitation ullamco laboris nisi ut aliquip.
Analyst escalates and calls in the
SWAT team.
4
6
SWAT team manages
to arrest the thief
before he can get
into the house.
2
3
2
3
4
4
5
1
1
Analyst
Analyst
System
(triggered by
Analyst)
only notifies
the owners.
5
House is secured; no
successful breach.
Security company
and Owners discuss
potential additional
security measures
(e.g. higher fence, a
dog, etc.)
7
Analyst also notifies the owners.
1