New Approaches to Cyber Defense

Abstract

As noted in Chap. 3, conventional cyberspace defense technologies focus on bolstering the target system externally and trying to test, discover, and eliminate known threats. In spite of the substantial and fruitful researches in the field of vulnerability detection and backdoor testing, we are still far from the ideal goal of rooting out vulnerabilities and backdoors. Both the academia and the industry have realized that the conventional static or coordinated approaches of defense are not well adept at handling Advanced Persistent Threat (APT). In response, many advanced countries have launched research programs based on new defense approaches (such as moving target defense, or MTD) [1] in an attempt to change the rules of the game. The nature of cyberspace is such that it is easy to attack but difficult to defend. By increasing the dynamism, randomness, and redundancy of the system or network against external attacks, the new defensive technologies render attackers unable to effectively sustain the cognitive advantage over the target system and the available resources over time and space, making it difficult to accumulate information, duplicate the mode of attack, recreate the effect, or continue the method of attack, which significantly increases the cost of the attack and hopefully would change the rules of the game.