155
rIsk AssessMent teChnIques
Network-Centric Compromise Indicators
Assessing reat Agents, Force, and Velocity
In some cases, lists of known bad IP addresses and domains may not
be available for use in seeding perimeter and internal network ele-
ments. In this case, network-centric analysis can also allow for the
quantitative assessment of the IP addresses and geo-locations from
which ICS assets are being probed randomly across a wide range of
networks. e rate, force, and velocity of trac from bad sources,
whether it penetrates or not, is an excellent indicator of current risk.
is approach requires the cooperation of a service provider or carrier.
Most, if not all, large carrier and service provider networks will
employ systems for monitoring ...