Skip to main content
Log in

A survey and characterization of Close Access Cyberspace Operations

  • Regular Contribution
  • Published:
International Journal of Information Security Aims and scope Submit manuscript

Abstract

Close Access Cyberspace Operations pose a significant threat to targets that cannot be easily compromised through remote access mechanisms, such as isolated Industrial Control Systems or air gapped classified networks. Despite their importance, close access operations are less common and receive less analysis compared to remote access ones. As a result, most organizations do not adequately consider countermeasures to address these threats. This lack of evaluation and mitigation introduces an underestimated risk. The main contribution of this paper is to provide a comprehensive survey of Close Access Cyberspace Operations and propose a classification approach for them. This survey analyzes close access studies, capabilities and operations, which are associated with classical SIGINT acquisition. Upon examining these elements, our work identifies the relevant entities and features crucial to Close Access Cyberspace Operations. These key entities and features form a comprehensive taxonomy for such operations, enabling organizations to enhance controls and better prevent, detect, and neutralize close access actions.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5

Similar content being viewed by others

Data Availability

Data sharing is not applicable to this article as no datasets were generated or analyzed during the current study.

References

  1. Joint Chiefs of Staff: Joint publication 3–12. Cyberspace Operations (2018)

  2. NATO: Allied Joint Publication-3.20. Allied Joint Doctrine for Cyberspace Operations. Technical report (2020)

  3. Joint Chiefs of Staff: Joint Publication 3–13. Information Operations, Department of Defense (2012)

  4. Murphy, D.M.: Information operations primer. fundamentals of information operations. Technical Report AY12, U.S. Army War College, Department of Military Strategy, Planning, and Operations (2011)

  5. Schmitt, M.N.: Tallinn Manual on the International Law Applicable to Cyber Warfare. Cambridge University Press, Cambridge (2013)

    Book  Google Scholar 

  6. Palbo, H., Kronborg, L.: Joint doctrine for military cyberspace operations. Technical report, Royal Danish Defence College (2019)

  7. UK Ministry of Defence: Cyber primer. Technical report, UK Ministry of Defence (2022)

  8. Maurer, T.: Cyber Mercenaries. Cambridge University Press, Cambridge (2018)

    Book  Google Scholar 

  9. Strom, B.E., Battaglia, J.A., Kemmerer, M.S., Kupersanin, W., Miller, D.P., Wampler, C., Whitley, S.M., Wolf, R.D.: Finding cyber threats with ATT &CK™-based analytics. Technical report, MITRE Technical Report MTR170202. The MITRE Corporation (2017)

  10. Joint Chiefs of Staff: Joint Publication 1–02. Department of Defense Dictionary of Military and Associated Terms, Department of Defense (2010)

  11. Johnson, C., Badger, L., Waltermire, D., Snyder, L., Skrorupka, C.: NIST SP 800–150. Guide to Cyber Threat Information Sharing, National Institute of Standards and Technology (2016)

  12. Lefebvre, S.: Cuban intelligence activities directed at the United States, 1959–2007. Int. J. Intell. Counter Intell. 22(3), 452–469 (2009)

    Google Scholar 

  13. Storey, I., Thayer, C.A.: Cam ranh bay: past imperfect, future conditional. Contemporary Southeast Asia, pages 452–473, 2001

  14. Cocroft, W.D., Schofield, J.: Archaeology of the Teufelsberg: Exploring Western Electronic Intelligence Gathering in Cold War Berlin. Routledge, 2019

  15. Kris, D.S.: The NSA’s new sigint annex. Journal of National Security Law & Policy, 2021

  16. Chabinsky, S.R.: Cybersecurity strategy: a primer for policy makers and those on the front line. J. Nat’l Sec. L. Pol’y 4, 27 (2010)

    Google Scholar 

  17. Long, J.: No tech hacking: a guide to social engineering, dumpster diving, and shoulder surfing. Syngress, 2011

  18. Kwon, T., Shin, S., Na, S.: Covert attentional shoulder surfing: Human adversaries are more powerful than expected. IEEE Trans. Syst. Man Cybern. Syst. 44(6), 716–727 (2013)

    Article  Google Scholar 

  19. Manske, K.: An introduction to social engineering. Inf. Secur. J. A Glob. Perspect. 9(5), 1–7 (2000)

    Google Scholar 

  20. Thornburgh, T.: Social engineering: the “dark art”. In: Proceedings of the 1st annual conference on Information security curriculum development, pp. 133–135, 2004

  21. Koyun, A., Janabi, E.A.: Social engineering attacks. J. Multidiscipl. Eng. Sci. Technol. (JMEST) 4(6), 7533–7538 (2017)

    Google Scholar 

  22. Workman, M.: Gaining access with social engineering: an empirical study of the threat. Inf. Syst. Secur. 16(6), 315–331 (2007)

    Google Scholar 

  23. Ivaturi, K., Janczewski, L.: A taxonomy for social engineering attacks. In International Conference on Information Resources Management (CONF–IRM) 2011 Proceedings (2011)

  24. Theohary, C. Hoehn, J.: Convergence of cyberspace operations and electronic warfare. Technical report, Congressional Research Service (2019)

  25. Haig, Z.: Electronic warfare in cyberspace. Secur. Defence Quart. 7(2), 22–35 (2015)

    Article  Google Scholar 

  26. Clark, R.M.: Perspectives on intelligence collection. J. US Intell. Collect. 20, 47–52 (2013)

    Google Scholar 

  27. Richards, J.: The cyber challenge for intelligence. In Intelligence in the knowledge society. In: Proceedings of the XIXth International Conference, pp. 97–108, 2014

  28. Loleski, S.: From cold to cyber warriors: the origins and expansion of NSA’s tailored access operations (TAO) to shadow brokers. Intell. Natl. Secur. 34(1), 112–128 (2019)

    Article  Google Scholar 

  29. Aldrich, R.J.: From sigint to cyber: a hundred years of Britain’s biggest intelligence agency. Intell. Natl. Secur. 36(6), 910–917 (2021)

    Article  MathSciNet  Google Scholar 

  30. Cordey, S.: The Israeli unit 8200-an OSINT-based study: Trend analysis. Technical report, ETH Zurich (2019)

  31. Boeke, S.: National cyber crisis management: different European approaches. Governance 31(3), 449–464 (2018)

    Article  Google Scholar 

  32. Moses, B.D.: Intelligence collection: supporting full spectrum dominance and network centric warfare? Technical report, School of Advanced Military Studies. United States Army Command and General Staff College (2004)

  33. Gudgeon, J.: Looking towards the future: the changing nature of intrusive surveillance and technical attacks against high-profile targets. PhD thesis, Imperial College London (2019)

  34. Larsen, D.: Intelligence in the first world war: the state of the field. Intell. Natl. Secur. 29(2), 282–302 (2014)

    Article  Google Scholar 

  35. Bruton, E., Coleman, P.: Listening in the dark: audio surveillance, communication technologies, and the submarine threat during the first world war. Hist. Technol. 32(3), 245–268 (2016)

    Article  Google Scholar 

  36. West, N.: The SIGINT Secrets: The Signals Intelligence War, 1900 to Today: Including the Persecution of Gordon Welchman. Quill, 1988

  37. Andrew, C.: Codebreaking and signals intelligence. Intell. Natl. Secur. 1(1), 1–5 (1986)

    Article  Google Scholar 

  38. Aid, M.D., Wiebes, C.: Secrets of Signals Intelligence During the Cold War: From Cold War to Globalization. Routledge, Boca Raton (2013)

    Book  Google Scholar 

  39. Sexton, D.J.: Signals Intelligence in World War II: a Research Guide, number 18. Greenwood Publishing Group, Westport (1996)

    Book  Google Scholar 

  40. Matthews, P.: SIGINT: The Secret History of Signals Intelligence in the World Wars. The History Press, Cheltenham (2013)

    Google Scholar 

  41. Aid, M.M., Wiebes, C.: Secrets of Signals Intelligence During the Cold War and Beyond. Psychology Press, London (2001)

    Google Scholar 

  42. Aid, M.M., Wiebes, C.: Introduction on the importance of signals intelligence in the Cold War. Intell. Natl. Secur. 16(1), 1–26 (2001)

    Article  Google Scholar 

  43. de Jong, B.: Intelligence and the cold war. In: The Routledge Handbook of the Cold War, pp. 305–319. Routledge, Boca Raton (2014)

    Google Scholar 

  44. Ball, D. et al.: Soviet signals intelligence (SIGINT). Strategic and Defence Studies Centre, Research School of Pacific, Canberra (1989)

  45. Ball, D., Windrem, R.: Soviet signals intelligence (SIGINT): organization and management. Intell. Natl. Secur. 4(4), 621–659 (1989)

    Article  Google Scholar 

  46. Ball, D.: Soviet SIGINT: Hawaii Operation. Strategic and Defence Studies Centre, Research School of Pacific (1991)

  47. Glantz, C.D.M.: Soviet Military Intelligence in War. Routledge, Boca Raton (2013)

    Book  Google Scholar 

  48. Widman, K.-O., Wik, A.: Swedish cryptology II. Proc. IEEE 109(12), 1942–1951 (2021)

    Article  Google Scholar 

  49. Aid, M.M.: Eavesdroppers of the Kremlin: KGB SIGINT during the cold war. In: The History of Information Security, pp. 497–522. Elsevier, New York (2007)

    Chapter  Google Scholar 

  50. Proctor, E.W.: The history of SIGINT in the Central Intelligence Agency, 1947–70. Technical report, CIA Historical Staff, 1971

  51. Faligot, R.: France, Sigint and the cold war. Intell. Natl. Secur. 16(1), 177–208 (2001)

    Article  Google Scholar 

  52. Hayez, P.: “renseignement’’: The new french intelligence policy. Int. J. Intell. Counterintell. 23(3), 474–486 (2010)

    Article  Google Scholar 

  53. Rudner, M.: Britain betwixt and between: UK Sigint alliance strategy’s transatlantic and European connections. Intell. Natl. Secur. 19(4), 571–609 (2004)

    Article  Google Scholar 

  54. Pepper, S.D.: The business of Sigint: the role of modern management in the transformation of GCHQ. Public Policy Admin. 25(1), 85–97 (2010)

    Google Scholar 

  55. West, N.: GCHQ: The Secret Wireless War, 1900–1986. Pen and Sword, Barnsley (2020)

    Google Scholar 

  56. Moran, C.R.: The pursuit of intelligence history: methods, sources, and trajectories in the united kingdom. Stud. Intell. 55(2), 33–55 (2011)

    Google Scholar 

  57. Rudner, M.: The historical evolution of Canada’s foreign intelligence capability: cold war Sigint strategy and its legacy. J. Intell. Hist. 6(1), 67–83 (2006)

    Article  Google Scholar 

  58. Rudner, M.: Canada’s communications security establishment, signals intelligence and counter-terrorism. Intell. Natl. Secur. 22(4), 473–490 (2007)

    Article  Google Scholar 

  59. Chambers, D.I.: A ‘lantern in the dark night’: the origins and early development of China’s Sigint service. J. Intell. Hist. 13(2), 204–222 (2014)

    Article  MathSciNet  Google Scholar 

  60. Ball, D. et al.: Signals Intelligence (SIGINT) in South Asia: India, Pakistan, Sri Lanka. Strategic and Defence Studies Centre, Research School of Pacific, Canberra (1996)

  61. Ball, D.: Signals intelligence in India. Intell. Natl. Secur. 10(3), 377–407 (1995)

    Article  Google Scholar 

  62. Ball, D. et al.: Signals Intelligence (SIGINT) in South Korea. Strategic and Defence Studies Centre, Research School of Pacific, Canberra (1995)

  63. Lasoen, K.L.: Belgian intelligence SIGINT operations. Int. J. Intell. Counterintell. 32(1), 1–29 (2019)

    Article  Google Scholar 

  64. Fischer, B.B.: “One of the biggest ears in the world:’’ East German Sigint operations. Int. J. Intell. Counterintell. 11(2), 142–153 (1998)

    Article  Google Scholar 

  65. Bury, J.: Pinpointing the mark: on the Cold War SIGINT capability. Cryptologia 38(2), 147–151 (2014)

    Article  Google Scholar 

  66. Ball, D., Robinson, B., Tanter, R.: Management of operations at pine gap. Technical report, Nautilus Institute for Security and Sustainability (2015)

  67. Androulidakis, I., Kioupakis, F.-E.: Intercepting ambient conversations. In: Industrial Espionage and Technical Surveillance Counter Measurers, pp. 11–21. Springer, Cham (2016)

    Chapter  Google Scholar 

  68. Russell, E.R.: The capabilities of the US government to collect and analyze economic intelligence. Technical report, United States Army Command and General Staff College (1994)

  69. Segell, G.: The French Intelligence Services, pp. 35–55. Springer, Cham (2009)

    Google Scholar 

  70. Wimmer, B.: Business Espionage: Risks, Threats, and Countermeasures. Butterworth-Heinemann, Oxford (2015)

    Google Scholar 

  71. Miller, G.: The Intelligence Coup of the Century. Washington Post, 11, 2020

  72. Aldrich, R.J., Müller, P.F., Ridd, D., Schmidt-Eenboom, E.: Operation Rubicon: sixty years of German–American success in signals intelligence. Intell. Natl. Secur. 35(5), 603–607 (2020)

    Article  Google Scholar 

  73. Dobson, M.J.: Operation Rubicon: Germany as an intelligence ‘great power’? Intell. Natl. Secur. 35(5), 608–622 (2020)

    Article  MathSciNet  Google Scholar 

  74. Dymydiuk, J.: Rubicon and revelation: the curious robustness of the ‘secret’cia-bnd operation with crypto ag. Intell. Natl. Secur. 35(5), 641–658 (2020)

    Article  Google Scholar 

  75. Hoffman, F.: Industrial internet of things vulnerabilities and threats: What stakeholders need to consider. Issues Inf. Syst. 20(1) (2019)

  76. Dittrich, D.: On the development of computer network attack capabilities. Technical report, National Research Council (2008)

  77. Slavin, J.: Close access information operations. Technical report, US Army War College, Carlisle Barracks, PA, USA (2000)

  78. Edgar, J.L.: The role of special operations forces in information warfare: Enablers, not cyber warriors. Technical report, Naval War College (2000)

  79. Aro, J.: The cyberspace war: propaganda and trolling as warfare tools. Eur. View 15(1), 121–132 (2016)

    Article  Google Scholar 

  80. Murray, H.: Cyber requirements. Technical report, US Army Cyber Center for Excellence, September (2014)

  81. Porche, I. III, Paul, C., Serena, C.C., Clarke, C.P., Johnson, E.-E., Herrick, D.: Tactical cyber: Building a strategy for cyber support to corps and below. Technical report, RAND Corporation (2017)

  82. Rivera, R.: Absence of Tactical Level Cyber Capabilities for the US Army Special Operation Warfighters. PhD thesis, Utica College (2018)

  83. Golding, J.: Byte, with, and through: how special operations and cyber command can support each other. War on the Rocks (2022)

  84. Lin, H.S.: Offensive cyber operations and the use of force. J. Natl. Secur. Law Policy 4, 63 (2010)

    Google Scholar 

  85. Peagler, J.: The stuxnet attack: a new form of warfare and the (in) applicability of current international law. Ariz. J. Int’l & Comp. L. 31, 399 (2014)

    Google Scholar 

  86. Committee on Information Assurance for Network-Centric Naval Forces: Information assurance for network–centric naval forces. National Academies Press (2010)

  87. Lonergan, S.W.: Cyber power and the international system. PhD thesis, Columbia University (2017)

  88. Borghard, E.D., Lonergan, S.W.: Cyber operations as imperfect tools of escalation. Strategic Stud. Quart. 13(3), 122–145 (2019)

    Google Scholar 

  89. Buchanan, B.: The Cybersecurity Dilemma: Hacking, Trust, and Fear Between Nations. Oxford University Press, Oxford (2016)

    Google Scholar 

  90. Mell, P., Spring, J., Dugal, D., Ananthakrishna, S., Casotto, F., Fridley, T., Ganas, C., Kundu, A., Nordwall, P., Pushpanathan, V. et al.: Measuring the common vulnerability scoring system base score equation. Technical report, National Institute of Standards and Technology, Gaithersburg, MD, US (2022)

  91. Houmb, S.H., Franqueira, V.N.L., Engum, E.A.: Quantifying security risk level from CVSS estimates of frequency and impact. J. Syst. Softw. 83(9), 1622–1634 (2010)

    Article  Google Scholar 

  92. Mell, P., Scarfone, K., Romanosky, S. et al.: A complete guide to the Common Vulnerability Scoring System version 2.0. Technical report, Forum of Incident Response and Security Teams (2007)

  93. Buchan, R., Navarrete, I.: Cyber espionage and international law. In: Research Handbook on International Law and Cyberspace. Edward Elgar Publishing, Cheltenham (2021)

    Google Scholar 

  94. Lin, H.: Cyber conflict and international humanitarian law. Int. Rev. Red Cross 94(886), 515–531 (2012)

    Article  Google Scholar 

  95. Jensen, E.T.: The tallinn manual 2.0: highlights and insights. Georgetown J. Int. Law 48, 735 (2016)

    Google Scholar 

  96. Schmitt, M.N.: Grey zones in the international law of cyberspace. Yale J. Int. Law Online (2017)

  97. Roguski, P.: Overcoming the damage of disinformation. New Eastern Europe 01, 69–76 (2019)

    Google Scholar 

  98. Harding, L.: The Snowden Files: The Inside Story of the World’s Most Wanted Man. Guardian Faber Publishing, Bloomsburg (2014)

    Google Scholar 

  99. Lyon, D.: The Snowden stakes: challenges for understanding surveillance today. Surveill. Soc. 13(2), 139–152 (2015)

    Article  Google Scholar 

  100. Margaret, H.: Taxonomy of the Snowden disclosures. Washington Lee Law Rev. 72, 1679 (2015)

    Google Scholar 

  101. Maass, P., Poitras, L.: Core secrets: NSA saboteurs in China and Germany. The Intercept, 11, 2014

  102. Mainwaring, S.: Division D: operation Rubicon and the CIA’s secret SIGINT empire. Intell. Natl. Secur. 35(5), 623–640 (2020)

    Article  Google Scholar 

  103. Arkin, W., Ambinder, M.: The special missions of the electron recon team. the US army technical support squadron and TAREX. The secrets machine, 2022

  104. NSA/CSS: National initiative protection program—sentry eagle. Technical report, National Security Agency/Central Security Service, (2004)

  105. Gellman, B., Soltani, A.: NSA tracking cellphone locations worldwide: snowden documents show. Wash. Post 4, 2013 (2013)

    Google Scholar 

  106. Appelbaum, J.R., Horchert, J., Stöcker, C.: Catalog advertises NSA toolbox. Der Spiegel, Shopping for spy gear (2013)

  107. Guri, M., Monitz, M., Elovici, Y.: Usbee: Air-gap covert-channel via electromagnetic emission from usb. In 2016 14th Annual Conference on Privacy, Security and Trust (PST), pp. 264–268. IEEE (2016)

  108. Harrison, J., Asadizanjani, N., Tehranipoor, M.: On malicious implants in PCBS throughout the supply chain. Integration 79, 12–22 (2021)

    Article  Google Scholar 

  109. Greenwald, G.: No Place to Hide: Edward Snowden, the NSA, and the US Surveillance State. Macmillan, London (2014)

    Google Scholar 

  110. NSA/CSS: Computer network exploitation (CNE) classification guide. Technical report, National Security Agency/Central Security Service, (2010)

  111. NSA/CSS: Classification guide for the NSA/CSS target exploitation (TAREX) program. Technical report, National Security Agency/Central Security Service, (2012)

  112. Steinbeck, R.: CIA & sudan. Technical report, Harvard Model Congress (2020)

  113. Richelson, J.T.: The US Intelligence Community. Routledge, Boca Raton (2018)

    Book  Google Scholar 

  114. Samuel, H.: Chip and pin scam ‘has netted millions from british shoppers,’. The Telegraph (2008)

  115. Clark, D., Berson, T., Lin, H.S.: At the nexus of cybersecurity and public policy. Computer Science and Telecommunications Board. National Research Council. The National Academies Press, Washington (2014)

  116. Eichelsheim, O.: GRU close access cyber operation against OPCW. Defence Intelligence & Security Service, NL Ministry of Defence, Technical report (2018)

  117. Egloff, F.J., Smeets, M.: Publicly attributing cyber attacks: a framework. J. Strategic Stud. pp. 1–32 (2021)

  118. Sagers, G., Hosack, B., Rowley, R.J., Twitchell, D., Nagaraj, R.: Where’s the security in wifi? An argument for industry awareness. In 2015 48th Hawaii international conference on system sciences, pages 5453–5461. IEEE (2015)

  119. Etta, V.O., Sari, A., Imoize, A.L., Shukla, P.K., Alhassan, M.: Assessment and test-case study of wi-fi security through the wardriving technique. Mobile Inf. Syst. 2022 (2022)

  120. Dorais-Joncas, A., Munõz, F.: Jumping the air gap: 15 years of nation-state effort. Technical report, ESET (2021)

  121. Stevens, M.W., Pope, M.: An implementation of an optical data diode. Citeseer (1999)

  122. Rogowski, D.: Software support for common criteria security development process on the example of a data diode. In Proceedings of the Ninth International Conference on Dependability and Complex Systems DepCoS-RELCOMEX. June 30–July 4, 2014, Brunów, Poland, pp. 363–372. Springer (2014)

  123. Xu, W., Tao, Y., Guan, X.: The landscape of industrial control systems (ICS) devices on the internet. In: 2018 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (Cyber SA), pp. 1–8. IEEE (2018)

  124. Dodson, M., Beresford, A.R., Thomas, D.R.: When will my PLC support mirai? The security economics of large-scale attacks against internet-connected ICS devices. In: 2020 APWG Symposium on Electronic Crime Research (eCrime), pp. 1–14. IEEE (2020)

  125. Langner, R.: Stuxnet: dissecting a cyberwarfare weapon. IEEE Secur. Privacy 9(3), 49–51 (2011)

    Article  Google Scholar 

  126. Kushner, D.: The real story of stuxnet. IEEE Spectr. 50(3), 48–53 (2013)

    Article  Google Scholar 

  127. Moon, D., Im, H., Lee, J.D., Park, J.H.: Mlds: multi-layer defense system for preventing advanced persistent threats. Symmetry 6(4), 997–1010 (2014)

    Article  Google Scholar 

  128. Karnouskos, S.: Stuxnet worm impact on industrial cyber-physical system security. In IECON 2011-37th Annual Conference of the IEEE Industrial Electronics Society, pp. 4490–4494. IEEE (2011)

  129. Jafarnejad, S., Codeca, L., Bronzi, W., Frank, R., Engel, T.: A car hacking experiment: When connectivity meets vulnerability. In 2015 IEEE globecom workshops (GC Wkshps), pp. 1–6. IEEE (2015)

  130. Skorobogatov, S.P.: Semi-invasive attacks—a new approach to hardware security analysis. Technical report, University of Cambridge, Computer Laboratory (2005)

  131. Bhamidipati, P., Achyutha, S.M., Vemur, R.: Security analysis of a system-on-chip using assertion-based verification. In 2021 IEEE International Midwest Symposium on Circuits and Systems (MWSCAS), pp. 826–831. IEEE (2021)

Download references

Author information

Authors and Affiliations

Authors

Contributions

AV-H, IR-R and HM-G contributed to writing—original draft. All authors have read and agreed to the published version of the manuscript.

Corresponding author

Correspondence to Hector Marco-Gisbert.

Ethics declarations

Conflict of interests

The authors declare no conflict of interest.

Additional information

Publisher's Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Rights and permissions

Springer Nature or its licensor (e.g. a society or other partner) holds exclusive rights to this article under a publishing agreement with the author(s) or other rightsholder(s); author self-archiving of the accepted manuscript version of this article is solely governed by the terms of such publishing agreement and applicable law.

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Villalón-Huerta, A., Ripoll-Ripoll, I. & Marco-Gisbert, H. A survey and characterization of Close Access Cyberspace Operations. Int. J. Inf. Secur. 23, 963–980 (2024). https://doi.org/10.1007/s10207-023-00772-1

Download citation

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s10207-023-00772-1

Keywords

Navigation