Cyber Security Ontology and Cyber Defence Ontology

First I am going to reference some work i found on the internet which offers some interesting insights into the various different views and approaches to developing ontologies for security and cyber security.

The first is a project form 2007 which provides a Cyber Security Ontology developed in OWL – Reference: A. Herzog, N. Shahmehri, C. Duma, ‘An Ontology of Information Security’, International Journal of Information Security and Privacy, 1(4):1-23, 2007. The paper is available here.

The second is a Seventh Framework research programme called PoSecCoPolicy and Security Configuration Management – and is contributing in some part to the Digital Agenda for Europe. One thing in particular which caught my attention is the paper called Security Ontology Definition, which describes in detail the ontologies consider within the project. There are also some interesting videos of the project.

It is interesting reading through the material produced by these projects as it shows the variety of different approaches taken to define and apply the domain of cyber security. It also highlights just how varied this domain is and how much needs to be formalised. The PoSecCo projects also describes a Security Decision Support System (SDSS) which would suggest that the models and data  are being used to infer some outcome to support a decision criteria.

Whilst each of the projects above have covered different areas of  security it may well be that from an ontological perspective that some consolidation of ideas and classifications are required to standardise the domain.  So, and it is just my opinion, there may be two or three key ontology models required – two if cyber defence is considered a subset of cyber security. The first being the enterprise architecture ontology to provide the context for all the entities that comprise the enterprise. The second is the security ontology covering what constitutes security through policy, compliance, threat, risk and vulnerability. The third is the defence ontology which covers the technologies, methods and capabilities to protect the enterprise. Each works in conjunction to provide a range of views to understand the challenges and also to provide sufficient situational awareness to combat the increasing threat. For more information on Situational Awareness there is an excellent website called Military Ontology which whilst specific to military defence has some very thought provoking material and resources. Finally there is a paper on the subject of Situational Awareness Ontology which is well worth reading and i hope to come back to this topic in the future.

Cyber Defence Ontology
Cyber Security Data Architecture


Applying evidence of vulnerabilities to support architectural design and change

To support this post i am going to assume that a vulnerability or weakness is due to a failing of the architectural design and development process to identify or mitigate the chance of exploitation. That failing may be due to lack of experience, legacy practice or an oversight in the evaluation and appraisal of the solution before it is deployed.

Depending upon the size and complexity of your architecture, determining how vulnerable your organisation is without the support of vulnerability scanning technology is difficult. That said, it is not difficult to introduce at various points of the architectural cycle the necessary evidence of known external  or internally discovered vulnerabilities to support new projects or change existing deployed architecture. Using TOGAF as an example, evidence should be included in stages B, C, D and E as well as stage H. All evidence collected should be included in the architectural repository. [From a wider security perspective it is also useful to consider more general application of security to architecture through the benefits of SABSA (Sherwood Applied Business Security Architecture) and TOGAF together.] More information on SABSA.

If we begin with the external evidence research there are numerous good sources of vulnerability information available on the internet. If starting this exercise for the first time i would recommend the Verizon Data Breach Investigation reports. These reports provide some excellent insights into the exploitation of vulnerabilities and attack types. To quote an insight from the Verizon report:

  • Opportunistic attacks: The victim isn’t specifically chosen as a target; they were identified and attacked because they exhibited a weakness the attacker knew how to exploit.
  • Targeted attacks: The victim is specifically chosen as a target; the attacker(s) then determines what weaknesses exist within the target that can be exploited. [Source Verizon]

The latest Verizon report provides more detail on the statistics and background to weaknesses or vulnerabilities exploited by attackers and it also shows that Hackers still very much rely on vulnerabilities as a means to gain access to an organisation’s environment.

A second area of research should focus on the more detailed reporting of vulnerabilities so that the research begins to align to the context or your organisational architecture. I would recommend CERT Division of the Software Engineering Institute (SEI) and Common Vulnerabilities and Exposures (CVE®).

Internally, the common ways to research necessary evidence for architectural change comes from the following operational capabilities:

  • Vulnerability Management
  • Patch Management
  • Intrusion Detection
  • Security Incident Management

What you determine internally will be dependent upon how mature these capabilities are in your organisation and what data or reports you are able to collect.  That is where the rest of the evidence model is able to help with the assessment and development of the material collected and produced. The application of the evidence model is there to help decide what is required to create a report or monograph to support architectural decision making and underpin the strength of the arguments stated in the evidence.

I am going to continue this thread by looking at Risk and Threat information as evidence as the three areas of risk, threat and vulnerability compliment each other. The combination of the three areas should mature the architectural thinking especially around the evaluations  and overall hypotheses made.


Building an Evidence Ontology

I have already highlighted in several earlier posts the aspects and importance of evidence but i am going to revisit particular key messages to explain the benefits from formalising the structure of evidence in order for it to support and improve EA knowledge.

  • The evidence ontology needs to be able to bring together a variety of research to strengthen hypotheses and recommendations in the artefacts and methods used in the architecture development method.
  • The evidence ontology needs to be able to support the internal EA content behind new views and scenarios as well as incorporate evidence from external sources.
  • Finally the evidence ontology needs to be able to support the formation of an evidence knowledge base that is flexible to help the engineering of future organisation models.
  • The evidence ontology needs to be able to enable the cross referencing required to demonstrate the importance of pattern and knowledge rules

You may be asking what is the point of building up a model of evidence to such a degree as an ontology. The main reason is that it is a relatively simple model and by doing so you are able to decide upon what constitutes evidence, how you characterise it and how you build and approve it. Otherwise any supporting evidence looses it importance if it does not have foundation. The reason i choose to use Cyber Defence evidence as an example it that the lessons and knowledge gained from understanding threats, risk and vulnerabilities in your organisation is vital to your architectural development now and in the future. That is not to say that evidence in Marketing, Sales or Product / Service development is less important, it is not, as any evidence used to support decision making is vital to develop and sustain a business.

So back to the Evidence Ontology and a proposed high level structure. at the top level the Evidence Ontology looks as follows:

  • Evidence research
  • Evidence development
  • Evidence synthesis
  • Evidence evaluation
  • Hypothesis
  • Evidence monograph
  • Evidence attributes

Each of these classes is further defined by sub classes as demonstrated in the attached image file. I have collected these classes from various sources of information and they represent my view of the necessary requirements to cover the process, classification, evaluation and provision of evidence material to support any decision based activity such as planning, strategy and enterprise architecture. I will continue in the next post with a look at the properties and relationships to the decision based activities through examples.

Evidence Ontology
Evidence Ontology

Enterprise Architecture and Cyber Defence Ontology

Having not had the opportunity to continue this blog and the theme of using semantics to develop the evidence based enterprise these last few years i am going to begin again with a new area of focus. The focus will be a series of posts and models covering Cyber Defence and Enterprise Architecture, an area i have been working in these last four years. I am going to start with some basic principles to cover what i will exploring:

  • Enterprise Architecture patterns (including conceptual models, building blocks etc) represent the basis for evidence based EA
  • A pattern should have a specification and qualification, at a minimum a metamodel or an ontology to provide that specification and qualification
  • Evidence, broadly construed, is anything presented in support of an assertion. This support may be strong or weak. The strongest type of evidence is that which provides direct proof of the truth of an assertion. (Wikipedia Definition)
  • Evidence should be derived from domains within the organisation through recorded instances and lessons and classified through domain ontologies.
  • EA patterns qualified by ontological models creates an evidential design process

So i am going to use an Enterprise Architecture Ontology, a Cyber Defence Ontology, a Security Ontology and an ITIL Service Management Ontology to provide the qualification and the guidelines for evidence within architectural patterns. So an ontology in the context of an architectural guideline or pattern representation is a specification of conceptualizations (from enterprise architecture and security domains) that constitutes evidence-based architectural practice. The evidence would be drawn from security frameworks or security operations demonstrating where weak or vulnerable architectural solutions have failed to prevent a cyber attack.  For example, an architectural guideline or pattern would define a set of key concepts,  decisions and actions (also concepts), as well as a set of rules (relationships) that relate the evaluation of a security decision criterion to further reasoning steps or to its associated actions. Thus enabling security restrictions or policies to enhance an architectural pattern (through Architectural and Solution Building Blocks) and improve the security aspects of a physical deployment of the future solution.

I have attached to this post a series of high level images of the Ontologies and SKOS models i will be using. The service technology model is an example the integration between the Cyber Defence Ontology, the Enterprise Architecture Ontology and the ITIL Ontology. At a high level it shows the relationships between the controls of the enterprise technology architecture, which defines the product, supplier management with a supporting actor of Security Operations, SOC supplier management and the deployed product used by Security Operations. At a further level of detail the three ontologies are able to show the interfaces between the three distinct business units (Service Management, Security Operations and Enterprise Architecture) thus providing an operating pattern for their interaction, collaboration and in particular the incident and change management processes necessary for in-life support.

Cyber SKOS

ITIL Ontology

Enterprise Architecture Ontology

Srvice Technology Model

Security Framework Ontology

Cyber Defence Ontology Model

Zachman Enterprise Ontology

It was interesting to read today that the Zachman website has now published the Zachman Framework Version 3 and refers to it as an enterprise ontology. Here is a quote from the website:

The Zachman Framework™ is an ontology – a theory of the existence of a structured set of essential components of an object for which explicit expressions is necessary and perhaps even mandatory for creating, operating, and changing the object (the object being an Enterprise, a department, a value chain, a “sliver,” a solution, a project, an airplane, a building, a product, a profession or whatever or whatever).

The Zachman Framework™ IS NOT a methodology for creating the implementation (an instantiation) of the object. The Framework IS the ontology for describing the Enterprise. The Framework(ontology) is a STRUCTURE whereas a methodology is a PROCESS. A Structure is NOT a Process. A Structure establishes definition whereas a Process provides Transformation.

Processes based on ontological structure will be predictable and produce repeatable results (for example, Chemistry, based on the Periodic Table).

It is quite an announcement to make that the framework is an ontology and i hope a formal OWL or Frames based model will follow. For more information visit