CND Equities Strategy

The goal of computer network defense (CND) is to protect the system and ensure the organization operates resiliently under strain [1]. To succeed, the CND strategy must plan for adversary response to defensive measures. Part of this planning is strategic management of equities. In the security field, the word equities has a special meaning: information assets that provide an advantage over the adversary, especially where the owner is confident the adversary does not know of those assets. Examples of equities include a clandestine informant or details of adversary tools, tactics, or procedures (TTPs) that facilitate attribution [2], detection, or prevention [3]. To destroy or burn equities is to render information assets useless by disclosure to the adversary. To defend a network, the CND operator must reveal some information. When an operator blocks a command and control (C2) domain name or IP address, the adversary will almost certainly notice that their tool stops communicating. Likewise with cleaning an infected system. So the question is not whether to reveal equities, but which equities to reveal and which to hold in reserve at what times to gain maximum advantage. We can use game theory to model this via information states [4], but this short paper will stick to a more friendly and informal discussion. CND methods can leverage either robust or fragile equities. Whether an equity is robust or fragile is based on a simple question: