TABLE OF CONTENTS Sergio Caltagirone
University of Idaho
scaltagi@acm.org
Deborah Frincke
Universityof Idaho
frincke@csds.uidaho.edu
Defense strategies should provide more benefit than cost. However,deciding what a defensive action might cost is not a simple matter, particularly when consideringactive defense techniques that may involve external stakeholders and resources. In this paperfactors are identified that are useful in assessing potential costs associated with an activedefense. The model presented here begins with the development of an active defense policy based onlocal priorities and sensitivity to risk, as well as escalation ladder for selecting among responseoptions. These, taken in combination, allow selection of actions to be taken as well asjustifications for those actions once they have been initiated. By investing in this model, anorganization frees itself to pursue active defense as a legitimate security (and protection) toolwhile limiting the associated risks.
Security against defeat implies defensive tactics; ability to defeat the enemy means takingthe offensive.
[4:5] Sun Tzu, The Art of War
Active defense is, as Sun Tzu so eloquently phrased it, the ability to defeat the enemy [by]taking the offensive. There are many possible interpretations of this remark, from a belief thatit advocates disabling the enemy through attack, to a milder approach that emphasizes pre-emptivereduction of the enemy s ability to perform attacks. While neither may be an accurate reflection ofSun Tzu s...
