Bringing knowledge to network defense

Security managers must scan through multiple continuous data streams issuing from diverse sources in an effort to defend computer networks from attack. However, manual aggregation of this information is not achievable for vital decision-making within a narrow timeframe if security managers are not well-educated in current attack vectors. Thus, extensive and periodic training in attack methods, situation awareness and decision-making strategy should be required. However, it is challenging to provide training environments that can properly simulate multi-stage attacks effectively. Security managers are also impeded by the lack of dynamic feedback afforded by traditional training. This can result in false positive or negative readings of their preparedness. In this paper we discuss strategies to provide effective simulation and training of computer network defense for security managers through the integration of knowledge, intelligent agents, and proven network defense technologies.