Foreword

Cyber conflicts are increasingly moving towards an operational theatre, where physical and cyber space are becoming hardly distinguishable, where the surrounding cyber ecosystem is global, dynamic and involves tens of thousands networks, and where the sheer volume of cyber security incidents data that needs to be collected, analyzed and acted upon is staggering. In this ecosystem we are talking about monitoring tens of thousands of networks that connect hundreds of thousands, if not millions of devices. Consequently, it is becoming evident that we have to move from passive perimeter-bound cyber defense, where we have spent tremendous amounts of effort, time and money in protecting every single item along the perimeter of the cyber ecosystem, towards active cyber defense and offensive actions that secure resiliency of our cyber-kinetic operations, even in the presence of adversary attacks. Not less importantly, the paradigm of perimeter cyber defense leaves our cyber-kinetic operations vulnerable to insider attacks. The models of achieving resiliency of cyber-kinetic operations are still at active research and development stage, but several of them have proven their value, including self-organization and adaptation to evolving cyber security situations, prediction of potential adversary cyber attacks and other disruptive events before their occur, and recovery and restoration of operational capacities after the attacks. Whatever the future technology of resilient cyber-kinetic operations will emerge, it is undisputable fact that the center piece of this technology is automation of cyber security data analysis and decision-making processes that underlay defensive and offensive actions in cyber conflict.