Methodology for gathering data concerning incidents in cyberspace

This paper introduces a cyber incident observation sheet. It is meant to support the process of gathering cyber incident data from attacks targeted against military missions. An effective method of gathering factual data is in the authors´ opinion one of the biggest challenge and show-stopper in the process of learning adhering to a lessons learnt paradigm (especially considering negative experiences). While developing Cyber Tool with the aim of cyber threats modeling in the frame of EDA (Europe Defense Agency) ATHENA project authors have identified a serious need to introduce a well shaped and structured observation form in order to enable and foster data analysis and automated processing in subsequent steps. In contrary to civil world cyber incidents against military systems are not reported publically nor traced back to unveil the actual vulnerabilities of underlying systems that has been exploited by an attack. Authors describe a formal point of view in the area of factual data collection in the area of cyber-attacks on communication resources. The proposed method (and recommendations) of collecting information about incidents can be a valuable input into the process of continuous improvement of security level in the cyberspace.