Cyber Warfare

Identify the information, services, and relationships that could make the organization relevant to a state-linked actor. Consider operational dependencies, government work, sensitive research, executive access, and suppliers. Prioritize plausible access paths rather than treating every news event as an immediate threat.

Pulse can support intelligence prioritization, and Librarian can help relate reporting to actual assets. Distinguish an advisory, an indicator match, a suspected compromise, and a confirmed intrusion. Attribution requires corroboration and expertise; public claims should not be made solely because an observed technique resembles a published campaign.

• Track the source, date, confidence, and relevance of intelligence.
• Review the assumptions behind high-impact threat scenarios.

Review edge appliances, privileged identities, remote support, software delivery, and supplier connections. Investigate unusual administrative behavior, new persistence mechanisms, and unexplained configuration changes. Maintain enough logging to reconstruct activity even when an attacker uses legitimate tools.

Argus and Psycher can support credential and personnel-targeting reviews. Sleight may support approved deception work in suitable environments, but its deployment requires clear scope and protection of real operations. Supply-chain assessment should include provenance, access, and change controls; no platform should be described as proving all hardware or software is free of compromise.

• Restrict standing supplier privileges and shared administrative credentials.
• Give targeted employees a safe route to report suspicious approaches.

Prepare for disruption to communications, identity services, and recovery infrastructure. Exercises should involve operational leadership, counsel, communications, and appropriate external partners. Define evidence-preservation procedures and criteria for escalating uncertain findings.

Growler can support evidence handling and Dewey can assist with response coordination. All consequential actions require authorized human approval. Verification & Response, Lancer, and 00x work must remain explicitly authorized and scoped to permitted systems; defensive urgency does not authorize retaliation, unauthorized access, or actions against suspected adversaries.

• Protect independent recovery and communications channels.
• Document the legal authority, operational impact, and approval for significant response actions.