This document summarizes a podcast episode about using vocabulary to describe how cybersecurity decisions may impact adversary behavior. It presents terms to state hypotheses, such as "redirect", "preclude", "impede", "limit", and "expose". Each term is defined by its intended effect, expected result, impact on risk, examples, and potential evidence. The vocabulary can be used to analyze how choices around defender actions, architecture, and technologies may direct, deter, degrade, or delay adversaries.

1. Talking SoS
w/Shawn Riley
Episode 3
Cyber Resiliency Effects On Adversary Activities
Ref: NIST 800-160 Vol 2 App I

2. This video presents a vocabulary for stating claims or hypotheses about
the effects of cyber mission assurance decisions on cyber adversary
behavior. Cyber mission assurance decisions include choices of cyber
defender actions, architectural decisions, and selections and uses of
technologies to improve cyber security, resiliency, and defensibility (i.e.,
the ability to address ongoing adversary activities). The vocabulary
enables claims and hypotheses to be stated clearly, comparably across
different assumed or real-world environments, and in a way that
suggests evidence that might be sought but is independent of how the
claims or hypotheses might be evaluated. The vocabulary can be used
with multiple modeling and analysis techniques, including Red Team
analysis, game-theoretic modeling, attack tree and attack graph
modeling, and analysis based on the cyber attack lifecycle (also referred
to as cyber kill chain analysis or cyber campaign analysis).

3. Redirect – Direct adversary activities away from defender
chosen targets
Preclude – Ensure that specific threat events do not have an
effect.
Impede – Make it more difficult for threat events to cause
adverse impacts or consequences.
Limit – Restrict the consequences of threat events by limiting
the damage or effects they cause in terms of time, system
resources, and/or mission or business impacts.
Expose – Reduce risk due to ignorance of threat events and
possible replicated or similar threat events in the same or
similar environments.
Defender
Goals

4. Defender’s Goal: Redirect – Direct adversary activities away
from defender chosen targets
Redirect
Deter
Divert
Deceive

5. Defender Goal –
Deter
• Intended Effect - Discourage the adversary from
undertaking further activities, by instilling fear (e.g., of
attribution or retribution) or doubt that those activities
would achieve intended effects (e.g., that targets exist).
• Expected Result - The adversary ceases or suspends
activities.
• Effect on Risk - Reduce likelihood of occurrence.
• Evidence - Activities attributable to the adversary are no
longer observed by the organization. Activities
attributable to the adversary are no longer observed by
other organizations and this fact is made known via
threat intelligence information sharing.
• Example - The defender uses disinformation to make it
appear that the organization is better able to detect
attacks than it is, and is willing to launch major counter
strikes. The result is that the adversary chooses to not
launch attack due to fear of detection and reprisal.

6. Defender Goal –
Divert
• Intended Effect - Lead the adversary to direct activities
away from defender chosen targets.
• Expected Result - The adversary refocuses activities on
different targets (e.g., other organizations, defender-
chosen alternate targets). The adversary’s efforts are
wasted.
• Effect on Risk - Reduce likelihood of occurrence.
• Example - The defender uses selectively planted false
information (disinformation) and honeynets
(misdirection) to cause an adversary to focus its
malware at virtual sandboxes, while at the same time
employing obfuscation to hide the actual resources. The
result is that the adversary’s attacks are directed away
from critical resources.
• Evidence - Adversary activities are directed towards
defender-chosen alternate targets (e.g., to a special
enclave). Activities attributable to the adversary are
observed by other organizations and made known via
threat intelligence information sharing.

7. Defender Goal –
Deceive
• Intended Effect - Lead the adversary to believe false
information about defended systems, missions, or
organizations, or about defender capabilities or TTPs.
• Expected Result - The adversary’s efforts are wasted, as
the assumptions on which the adversary bases attacks
are false.
• Effect on Risk - Reduce likelihood of occurrence and/or
reduce likelihood of impact.
• Example - The defender strategically places false
information (disinformation) about the cybersecurity
investments that it plans to make. As a result, the
adversary’s malware development is wasted by being
focused on countering nonexistent cybersecurity
protections.
• Evidence - Adversary activities reveal that the adversary
is relying on false information (e.g., a dummy account is
spear phished, delivered malware is tailored to a
simulated environment).

8. Defender’s Goal: Preclude – Ensure that specific threat events
do not have an effect.
Preclude
Expunge
Preempt
Prevent

9. Defender Goal –
Expunge
• Intended Effect - Remove unsafe, incorrect, or corrupted
resources that could cause damage.
• Expected Result - The adversary loses a capability for
some period, as adversary directed threat mechanisms
(e.g., malicious code) are removed. Adversary-controlled
resources are so badly damaged that they cannot
perform any function or be restored to a usable
condition without being entirely rebuilt.
• Effect on Risk - Reduce likelihood of impact of
subsequent events in the same threat scenario.
• Example - The defender uses virtualization to refresh
critical software (non-persistent services) at random
intervals (temporal unpredictability). As a result, the
adversary’s malware that is implanted in the software is
expunged.
• Evidence - Removal of malware or of privileges from
adversary-controlled resources.

10. Defender Goal –
Preempt
• Intended Effect - Forestall or avoid conditions under
which the threat event could occur or result in an effect.
• Expected Result - The adversary’s resources cannot be
applied and/or the adversary cannot perform activities
(e.g., because resources are destroyed or made
inaccessible).
• Effect on Risk - Reduce likelihood of occurrence and/or
reduce likelihood of impact.
• Example - Critical software is not assembled (adaptive
management) or activated (non-persistent services) until
it is needed. The adversary, therefore, cannot perform
reconnaissance on, and tailor malware targeted to, the
software.
• Evidence - The adversary’s resources are observed to be
denied (e.g., destroyed, made inaccessible or unusable).

11. Defender Goal –
Prevent
• Intended Effect - Create conditions under which the
threat event cannot be expected to result in an effect.
• Expected Result - The adversary’s efforts are wasted, as
the assumptions on which the adversary based its attack
are no longer valid and as a result, the intended effects
cannot be achieved.
• Effect on Risk - Reduce likelihood of impact.
• Example - Subtle variations in critical software are
implemented (synthetic diversity), with the result that
the adversary’s malware is no longer able to
compromise the targeted software.
• Evidence - Logs or other captured data provide evidence
that the activity occurred but had no effects.

12. Defender Goal: Impede – Make it more difficult for threat events
to cause adverse impacts or consequences.
Impede
Contain
Degrade
Delay

13. Defender Goal –
Contain
• Intended Effect - Restrict the effects of the threat event
to a limited set of resources.
• Expected Result - The value of the activity to the
adversary, in terms of achieving the adversary’s goals, is
reduced.
• Effect on Risk - Reduce level of impact.
• Example - The defender organization makes changes to a
combination of internal firewalls and logically separated
networks (dynamic segmentation) to isolate enclaves in
response to detection of malware, with the result that
the effects of the malware is limited to just initially
infected enclaves.
• Evidence - Damage assessment, in terms of
• (Scope) The number of affected resources
• (Impact) A function of
• The number of affected resources and their
value (e.g., criticality)
• Duration and the mission or operational cost per
unit time

14. Defender Goal –
Degrade
• Intended Effect - Decrease the likelihood that a given threat
event will have a given level of effectiveness or impact.
• Expected Result - The adversary achieves some but not all
intended effects. The adversary achieves all intended effects but
only after taking additional actions.
• Effect on Risk - Reduce likelihood of impact and reduce level of
impact.
• Example - The defender uses multiple browsers and operating
systems (architectural diversity) on both end user systems and
some critical servers. The result is that malware that is targeted at
specific software can only compromise a subset of the targeted
systems; a sufficient number continue to operate to keep mission
going, although in degraded mode.
• Evidence - The number of resources affected by the adversary is
lower than for prior instances of the activity. The severity of the
impacts caused by the adversary activity is less than for prior
instances of the activity. Malware or other attack vectors
attributable to the adversary are crafted or tailored, based on
failures of prior activities attributable to the same adversary to
achieve effects. Repeated activities (e.g., to establish information
channels, to start processes) are attributable to the same
adversary.

15. Defender Goal –
Delay
• Intended Effect - Increase the amount of time needed for a
threat event to result in adverse impacts.
• Expected Result - The adversary achieves the intended
effects but may not achieve them within the intended
period. The adversary’s activities may, therefore, be
exposed to greater risk of detection and analysis.
• Effect on Risk - Reduce likelihood of impact and reduce
level of impact.
• Example - The protection measures (e.g., access controls,
encryption) allocated to resources increase in number and
strength based on resource criticality (calibrated defense-
in-depth). The frequency of authentication challenges
varies randomly (temporal unpredictability) and with
increased frequency for more critical resources. The result
is that it takes the attacker more time to successfully
compromise the targeted resources.
• Evidence - The length of time between an initial event and
its effects, as determined by forensic or other analysis, is
increased.

16. Defender Goal: Limit – Restrict the consequences of threat events
by limiting the damage or effects they cause in terms of time,
system resources, and/or mission or business impacts.
Limit
Shorten
Recover

17. Defender Goal –
Shorten
• Intended Effect - Limit the duration of a threat event or
the conditions caused by a threat event.
• Expected Result - The time period during which the
adversary’s activities have their intended effects is
limited.
• Effect on Risk - Reduce level of impact.
• Example - The defender employs a diverse set of
suppliers (supply chain diversity) for time-critical
components. As a result, when an adversary’s attack on
one supplier causes it to shut down, the defender can
increase its use of the other suppliers, thus shortening
the time when it is without the critical components.
• Evidence - Damage assessment, in terms of (Time). The
duration of an outage or of degraded functionality.

18. Defender Goal –
Recover
• Intended Effect - Roll back the consequences of a threat
event, particularly with respect to mission or business
impairment.
• Expected Result - The adversary fails to retain mission or
business impairment due to recovery of the capability to
perform key missions or business operations.
• Effect on Risk - Reduce level of impact.
• Example - Resources determined to be corrupted or
suspect (integrity checks, behavior validation) are
restored from a clean copy (protected backup and
restore).
• Evidence - Recovery metrics, including
• (Functionality) Level of performance (typically
expressed in terms of Measures of Effectiveness
(MOEs), Measures of Performance (MOPs), or Key
Performance Parameters (KPPs)).
• (Assurance) Degree of trustworthiness or
confidence in restored resources.

19. Defender goal: Expose – Reduce risk due to ignorance of threat
events and possible replicated or similar threat events in the
same or similar environments.
Expose
Detect
Scrutinize
Reveal

20. Defender Goal –
Detect
• Intended Effect - Identify threat events or their effects
by discovering or discerning the fact that an event is
occurring, has occurred, or (based on indicators,
warnings, and precursor activities) is about to occur.
• Expected Result - The adversary’s activities become
susceptible to defensive responses.
• Effect on Risk - Reduce likelihood of impact and reduce
level of impact (depending on responses).
• Example - The defender continually moves its sensors
(functional relocation of sensors), often at random times
(temporal unpredictability), to common points of egress
from the organization. They combine this with the use of
beacon traps (tainting). The result is that the defender
can quickly detect efforts by the adversary to exfiltrate
sensitive information.
• Evidence - Adversary activities are detected, or
indicators, warnings, and/or precursor activities are
observed.

21. Defender Goal –
Scrutinize
• Intended Effect - Analyze threat events and artifacts associated
with threat events, particularly with respect to patterns of
exploiting vulnerabilities, predisposing conditions, and
weaknesses, to inform more effective detection and risk
response.
• Expected Result - The adversary loses the advantages of
uncertainty, confusion, and doubt. The defender understands
the adversary better, based on analysis of adversary activities,
including the artifacts (e.g., malicious code) and effects
associated with those activities and on correlation of activity
specific observations with other activities (as feasible), and thus
can recognize adversary TTPs.
• Effect on Risk - Reduce likelihood of impact.
• Example - The defender deploys honeynets (misdirection),
inviting attacks by the defender, allowing the defender to apply
their TTPs in a safe environment. The defender then analyzes
(malware and forensic analysis) the malware captured in the
honeynet to determine the nature of the attacker’s TTPs,
allowing it to develop appropriate defenses.
• Evidence - Number and quality (e.g., correctness, usefulness) of
malware signatures and characteristics. Number and quality
(e.g., degree of confirmation) of observables and indicators.
Distinct threat actors and/or campaigns being observed.

22. Defender Goal –
Reveal
• Intended Effect - Increase awareness of risk factors and relative
effectiveness of remediation approaches across the stakeholder
community, to support common, joint, or coordinated risk
response.
• Expected Result - The adversary loses the advantage of surprise
and possible deniability. The adversary’s ability to compromise
one organization’s systems to attack another organization is
impaired, as awareness of adversary characteristics and
behavior across the stakeholder community (e.g., across all
computer security incident response teams that support a given
sector, which might be expected to be attacked by the same
actor or actors) is increased.
• Effect on Risk - Reduce likelihood of impact, particularly in the
future.
• Example - The defender participates in threat information
sharing and uses dynamically updated threat intelligence data
feeds (dynamic threat modeling) to inform actions (adaptive
management).
• Evidence - Distinct threat actors, campaigns, and/or TTPs
observed by multiple organizations. Degree of confidence in
attribution of events to threat actors or campaigns.