TABLE OF CONTENTS The Adversary Object Matrix
Adversary Property Relationships
The Adversary Model Adversary Environment Properties
The Adversary Model Attacker Properties
As previously stated, cyber adversary characterizations can be divided up into two categories:
Those that are of an entirely theoretical nature (such as characterizations of the risk that a specific, theoretical adversary subset may pose to a given asset)
Post-incident or forensic characterizations, where the threat that a real, characterized individual may pose to a given asset, using information available only after an incident has occurred (such as intrusion detection data)
Although this definition may seem fairly clear cut, the moment you begin to put either type of characterization into practice, the line between the two becomes somewhat blurred.
This is primarily due to capability characterizations of actual (living, breathing) cyber adversaries often being heavily reliant upon projected (assumed) data variables and therefore theoretical metrics. This is the case because more often than not, collating sufficient data to satisfy all characterization metrics and form a clear picture of what your adversary really looks like is just not practicable.
By a similar token, theoretical characterization metrics, which largely rely upon quantitative data, can never be accurate without first considering real case studies (of actual cyber adversaries), from which the quantitative data must be derived.
A large part of adversary characterization theory is therefore dependent upon the following:
Making accurate projections regarding what the values of unobservable variables might be, using vectors derived from available/observable data.
Being able to corroborate the...
