Kybersuojajoukkojen puolustukselliset kyberoperaatiot - Oksala, Eero Antti (2024)
Finland's geopolitical position, in particular its NATO membership and tensions with Russia, have, according to several authorities and public reports, increased the threat level of intelligence and influence operations on critical infrastructure in the cyber domain. Increased threats to the vital functions of societies have also been highlighted by multiple global security and intelligence organisations. NATO allies and partners have responded to the increased threat level and the cyber attacks that have occurred by conducting Defensive Cyber Operations by national or multinational Cyber Protection Teams on state networks in order to protect and secure the critical networks and to analyse cyber attacks that have already occurred. This study examined Defensive Cyber Operations conducted by the Cyber Protection Teams from the perspective of protecting and securing the energy sector. The key objective of the study was to build on previous literature and research to generate research evidence on the interconnections between energy industry actors and Cyber Protection Teams operations. Expert interviews were used to verify the reliability of the research data. The research problem was to establish an operational and technical-tactical level Standard Operational Procedure in the framework of planning and execution of Defensive Cyber Operations by Cyber Protection Teams. To solve the problem, Design Science Research methodology was used to identify the actors at the levels described, the phases of the operation and the required actions. The study started with a baseline and operational-level description of the actors in the environment of the critical infrastructure and energy sector. This was followed by an introduction to the US, European Union and NATO Cyber Protection Teams and their operational procedures. Based on the described overviews, a Standard Operational Procedure was created at the operational and technical-tactical levels, based on the research and literature identified through a qualitative material-based content analysis. A semi-structured interview was then conducted with seven operational and technical experts to improve the developed Standard Operational Procedures. The research resulted in a generic operational and technical-tactical level Standard Operational Procedure, based on previous research and the experts' suggestions for the development of the procedures various levels of entities. The main value of the procedure developed was considered to be its simplicity, which was seen to introduce a basis for further research and development. In addition, the phasing of the developed procedure and the identification of measures and actors were considered to contribute to the situational awareness and preparedness of the government and society in case of national or international emergencies.