The Lesson

As applied to business, warfare, and other areas, the most important aspect of finite and infinite games is that the players know what type of game they are in so they can play to the appropriate motivation. If we look at one of Simon’s examples, in the Vietnam War, the United States was playing a finite strategy, trying to “win,” whereas the local opposition was trying to simply stay in the game long enough for the US to drop out. Similarly, this played out recently and to successful conclusion by the opposition playing the right game and the US playing the wrong game in Afghanistan as well. The US was trying to “win” in Afghanistan, where the Taliban was simply trying to stay in the game until the US dropped out. When a player does not know the type of game they are actually playing, they cannot optimize play or hope to improve their position.

Weaknesses and a Strength

Accepting that cybersecurity is an infinite game where innumerous threats are playing without rules against the defenders our industry supports, we must identify the strengths and weaknesses of our customers and their opponents. For the sake of keeping this discussion to a single chapter, we will primarily focus on three areas where attackers or defenders might have a unique advantage or disadvantage.

Finite Battles in an Infinite War

Some adversaries will set themselves up for finite, win or lose battles in the larger infinite war. This is where cost benefit comes into play. Actors that are financially motivated (APTs, organized crime) are likely to set some bounds on their activity because at a point, their time and money no longer provide a cost benefit based on a given target. For example, in our Transexperiafax target anecdote from previous chapters, an attacker has some very specific metrics they could use to determine the profitability of such a target and leverage that information to bound finite game durations, incorporating profitability as an activity limiter. If profitability starts to diminish due to a shrinking cost benefit, the adversary can simply drop out of the game against that specific defender and move on to another more profitable target.

Defenders can do this too, both by manufacturing finite battles as well or recognizing where finite battles will occur with their organization in a greater infinite conflict. Take, for example, a company that operates a global small-satellite constellation in low earth orbit (LEO). Let’s say the company provides imaging services. Now, the organization itself wants to play the infinite game. Strategically, it wants to continue to operate the satellites and sell imaging services as long as possible. As such, cybersecurity too must be played broadly in an infinite sense by infinite-minded players.

There are aspects of the attack surface, however, that lend themselves to more finite perspectives and can be fought on finite grounds. The operation of the organization may be hopefully unbounded by time, but the lifespan of LEO satellites is decidedly not. They may be operationally capable for only a matter of two or three years. That operational can be leveraged to bound the cybersecurity effort on that portion of the attack surface represented by the system of systems of systems that is a satellite constellation. The defenders can now make cybersecurity and risk decisions that are in a somewhat bounded environment, limited by operational durations. This means that risk mitigation and cost benefit are considerations for a specific timeline and can be tailored toward winning a defined two-to-three-year battle, instead of an endless one.

This example is arguably a gross oversimplification, but I think it does well to highlight that there are certainly aspects of an organization’s strategic operations that can be taken as winnable finite games in the larger accepted infinite game construct that must be acknowledged.

Adversary as a Service (AaaS)

OK, so maybe that was a jab at the preponderance of [insert thing] as a service (*aaS) terms and capabilities being slung around willy-nilly. In all seriousness, this is a concept I have discussed at length with other cybersecurity professionals, and it seems to be focused on the infinite game as well as relying on the one advantage defenders do hold in that game, self-knowledge and access.

Typically, some of the most powerful defensive operations an organization can undertake are robust monitoring capabilities and threat-hunting campaigns. Unfortunately, monitoring, and to a greater degree threat hunting, rely on admittedly outdated and non-standardized intelligence to help them zero in on malicious activity in the network. Even frameworks like MITRE’s ATT&CK are based on often aged, incomplete, and largely open source information. This means that hunting based on these facts is likely to find you someone re-using a capability, forgotten access, or tools or help you walk your way down a false flag operation. This is of course because the bad guys also have access to this framework, so they know how different actions, techniques, and tools are attributed.

What if, instead of heavily relying on threat intelligence, we created our own intelligence as an adversary such as a nation-state might? After all, we have access already, we know our own strategic outcomes and goals and how we are going about them. We know our own IT refresh cycles, upgrade and update schedules, etc. Why not create intelligence about our own organization like a nation-state might and leverage that kind of information to inform things like hunt and monitoring as well.

Performing this type of activity is a sort of pseudo red teaming that, when coupled with proactive assessments afforded by penetration testing and red teaming, can help an organization mitigate risk based on self-knowledge and largely agnostic of threat specificity. By not focusing on individual threats and instead focusing on self-knowledge, informed intelligence defenders might be able to force multiply their ability to combat larger groups of potential threats.

In a way, this is a next step to practices like resilience. With resilience, we take an understanding of ourselves and our needs to inform risk-reducing practices aimed at keeping an organization in the game. Having an organic adversary as a service capability allows us to red team our own resilience decision matrix and inform threat-hunting campaigns in a way that supports continued pursuit of strategic goals. Withstand as many threats as possible without trying to fight off specific threats.

Attacking the Curve

A former colleague of mine, contributing author Dr. Sewell, asked an interesting non-cyber question that really got me thinking about how to attack the curve (heavy graphical representation of the curve I am talking about soon to follow). He asked: “How long might it take an adversary to find and weaponize a vulnerability in something like routing infrastructure?”

I was not sure, but that was not the point, I said perhaps three to five years maybe. His next question was: “What if every three years, then, we just switch our routing infrastructure to a new brand entirely, such as from Cisco to Juniper, moving the target on the adversary?”

Now there is a lot to poke at, but broadly, this is a very interesting concept. We can’t have a steeper or continuous curve like some nation-states might in targeting us (if we think our organization is actually the target of such efforts). However, maybe we can attack the adversary’s efficiencies in the aspects of time and resources as they play an infinite game with us.

Before we go through the graphs to follow, I must assert that there is a distinct difference in how you approach attacking the curve when talking about criminal organizations and other lower tier APTs compared to nation-states. As we mentioned, the former has cost benefit in mind, the latter have national security in mind and their curve can be steep and unending if they feel it necessary. For nation-states, cost benefit in this sense is not really a consideration.

Cost Benefit Refined

In Chapter 3, we discussed cost benefit and how the adversary and the organization may have differing opinions on what cost beneficial cybersecurity or cyberattack spending looks like, which affects an organization’s ability to adequately resource its protective strategies. Instead, later on here, we will show how adversaries like criminal organizations might approach their cost benefit line as it pertains to spending time and money before leaving the game if they have not gotten access or information necessary at that point. Figure 8-1 shows an adversary spending personnel hours over time to achieve compromise with a limiting cost benefit line. The adversary is going to spend a lot of hours up front trying to gain access and information, while later spending few hours to siphon out data. They will either abandon the attack if it looks unlikely to have cost benefit or be successful.

On the other hand, the defender will spend personnel hours in a predictable way, their cybersecurity person working forty-hour work weeks over the course of the month as shown in Figure 8-2.

Figure 8-3 shows the two alongside each other.

It is important to accept that the more realistic scenario is probably that the adversary is willing to spend more than 160 hours in a month or have more than one person in the initial phases, which means it could also be as disparate as Figure 8-4, where the adversary has decided it can spend 400 personnel hours and still get a justifiable profit from the compromise.

Figure 8-5 is a different way of portraying Figure 8-3, and Figure 8-6 is a different way of showing Figure 8-4 to highlight the area of the surface between the two curves.

What Figures 8-5 and 8-6 do a good job of showing is the shaded region between the line graphs. This shaded area is essentially a mathematical representation of the disadvantage faced as a surface area. Anything a defender can do to decrease this surface area is a worthwhile approach to cybersecurity. In these examples, our adversary has a bounded finite battle in the greater infinite cybersecurity conflict. If we as defenders can increase the surface area or lower or move the defender’s line of cost benefit, we can successfully impact their ability to win a finite battle and also extend the time we get to play and that they have to play in the infinite game.

So what does it look like when we, instead, graph something like an APT? Well, our one-person cybersecurity department will have the same personnel hour graph, as shown in Figure 8-7.

But now the attacker is a nation-state that feels its national security interests are at stake, its month of personnel hours spent will probably look like this Figure 8-8.

The striking difference in effort and the advantage of the attacker regarding time is shown in Figure 8-9.

Now when we shade in the surface area of disadvantage, we get a stark representation of the imbalance involved, as shown in Figure 8-10.

Graphs for resources or expenditure would look much the same as the ones we have done with time, so I will not repeat them. These graphs represent a surface area of disadvantage that can be attacked by doing things to increase the defenders surface area, decrease the attackers surface area, or shorten the runway for the attacker to run out of cost benefit. All of this is typically only possible in a semi-bounded, finite conflict, where we hope hackers like criminal organizations essentially have a bottom line. The nation-state graph should show the relative hopelessness in altering the cost benefit equation because, to those organizations, there might not be a bottom line.

So how about the one area where defenders do have the advantage? Let’s take a look at graphs representing knowledge and access. Figure 8-11 shows how the defender starts by knowing about 100% of the network and having access to 100% of the machines and the attacker starts at zero, but how, over the course of a month, compromises those numbers change. Ultimately, the attacker has access to half the network and ransoms it to the defenders.

Figure 8-12 shows the shaded surface area advantage that the defender has in regard to knowledge and access. Attempts at continuously maintaining this advantage are our best chance in playing the infinite cybersecurity game for as long as possible.