Computer Network Defence Situational Awareness Information Requirements

Military forces are employing network-centric operations as a force multiplier, which comes with increased vulnerability to attack given the growing complexity of information technology (IT). Computer network defence (CND) focuses on managing the vulnerabilities and risk inherent in all computer networks. Current research in the field of CND situational awareness (SA) is focusing on a bottom-up approach of how to define meaning out of the abundance of sensor information. This paper focusses on defining the information requirements for CND SA from a top-down approach by analysing the larger mission questions asked by a network command coupled with existing work in SA. This paper asserts that force commands must define their operational capability requirements in terms of distributed IT services qualified in terms of confidentiality, integrity, and availability. Likewise, CND SA must provide feedback to the command concerning defensive posture, risk, and impact using statements of potential and real reductions in these IT services