The magic of sophisticated cyber attacks

The term ‘sophistication’ is not new to cyber operations. It appears in media reports, victims’ testimonies, and commercial threat intelligence analyses. However, it is ill-defined and regularly misused. Even when basic security flaws and generic threats are behind a compromise, victim organisations will often describe it as a ‘sophisticated’ attack.

Nevertheless, its frequent use is not completely unfounded. Using the term ‘sophistication’ allows us to put cyber strategies in context, both offensive and defensive. It shapes our perceptions about the resources used, the intent behind attacks, and the anticipated outcomes. It is therefore important to get the concept right.

A technical term

Although attempts to understand the essence of cyber sophistication abound, they often oversimplify complexity by focusing only on technical metrics and disregarding the underlying operational activity and its nuances.

An influential post by Dave Aitel, a former US National Security Agency operator and cybersecurity expert, parses the sophistication of cyber operations into different components. He distinguishes between sourcing, usage, network, testing persistence, and operational security to shed light on the necessary tooling for cyber operations.

He argues that if an attacker develops their own customised tools instead of purchasing or using open-source ones, they are likely more sophisticated. Also, tools that are not tested or tested against third parties show less sophistication than those that are tested on cyber ranges, simulation platforms for cyberattacks. Furthermore, if attackers use a tightly connected toolset to hide their tracks well, they are likely more skilled than someone using just one toolset.

Ben Buchanan expands on Aitel’s methodology, adding to tools and procedures operational factors such as speed. Speed not only refers to the rapidity of an attack but also its timing and precision. Buchanan also points out that the intended scope of a mission is an indicator of sophistication. A complex mission, like disabling a power grid, would inherently require greater sophistication than a simple, short-term computer lockout.

Magic tricks

Although these frameworks provide a structured approach, they also have limitations. They ignore a core aspect of sophisticated cyber operations: the need to trick your opponent. As Jon Lindsay astutely notes, cyber operations pivot on deception. There is no “forced entry” in cyberspace. “If someone has gained access into a system from the outside, it is because that someone has persuaded the system to do what its users did not really want done and what its designers believed they had built the system to prevent,” describes Martin Libicki. The essence is to outwit and deceive the opponent.

A helpful analogy to help us understand sophistication is likening cyber operations to magic tricks (Herb Lin has explored this affinity extensively). Both rely heavily on the art of deception. Magic aims to “create illusions of the impossible.” Consider this: is a magic trick repeated hundreds of times as striking as the first time? The impressiveness and element of surprise diminish. Many magicians can replicate another’s tricks, but there is a vast difference between mere replication and original invention.

In the realm of cyber operations, repetition also dilutes sophistication. The technical frameworks in popular use today, though insightful, often miss this dynamic. Relying solely on technical metrics undervalues the critical role of creativity in cyber operations.

The analogy with magic also highlights that operational difficulty is just one facet of sophistication. Elements such as surprise, likelihood of success, and innovative tactics play equally important roles. Sometimes sophistication lies in the simplicity of deception.

More than novelty

This does not mean that novelty is the only thing that counts. The brilliance often lies in the judicious blend of old and new. Just as a magician might choose a classic trick because it fits the act, a cyber operator might lean on an older, proven technique because it is appropriate for the situation. For instance, if a simple phishing email grants an attacker access to a corporate network, there is no need to use more complex zero-day exploits.

The artistry in both domains lies in the practitioner’s discernment. Knowing when to ‘dial up’ and unveil a new trick or advanced technique is as important as recognising the moments when the old ways will shine. Success does not rely solely on the act; it also involves having a good strategy, knowing the intended audience (or victim), and seizing the opportune moment. The cyber operator must possess a deep understanding of the networks they are targeting.

The balancing act

Cyber sophistication is about balancing the bold with the subtle, the new with the old, and the seen with the unseen. The true mastery in cyber operations lies in this equilibrium – the seamless integration of technological skill with the art of illusion.