Cyber Course of Action (COA) Strategies

This chapter examines how decision‐making in cyber defense may benefit from modeling and simulation (M&S). The use of “models”, for cyber decision support spans from longer‐term decision support, in categorizing projected network events, to real‐time visualization of developing threats, and using these models to analyze attack graphs and projected second‐ and third‐order effects for each course of action (COA) candidate. M&S, in decision support systems (DSS), can enhance situational awareness (SA) through training. In addition to analyzing mission impacts of cyber actions, AMICA, MITRE developed “Crown Jewels Analysis” (CJA), a process for identifying the cyber assets most critical to the accomplishment of an organization's mission. In addition to CJA, the cyber mission impact assessment (CMIA) is one approach for performing a cyber mission risk assessment. Visual Analytics (VA) is a way of handling and making sense of massive data sets by using interactive visualization technologies and human cognitive abilities.