Chapter 9 - ADAM: Active Defense Algorithm and Model

Abstract

This chapter proposes a model for making decisions about the selection of defensive actions. Active defense is informally defined as any action sequence performed by an individual or organization between the time an attack is detected and the time it is known to be finished, in an automated or non-automated fashion, to mitigate a threat against a particular asset. The assessment strategies for ”cost” and ”benefit” are incorporated in the chapter. Defense strategies should provide more benefit than cost. However, deciding what a defensive action might cost is not a simple matter, particularly when considering active defense techniques that may involve external stakeholders and resources. The chapter identifies the factors that are useful in assessing the potential costs associated with an active defense. The model presented in the chapter begins with the development of an active defense policy based on local priorities and sensitivity to risk, as well as an escalation ladder for selecting among response options.