Build a cyber defence watch from public sources

Список действий

1. 01

   Set the question

   Choose a region, infrastructure or policy to follow. Set a timeframe, review frequency and the decisions the monitoring should inform. Turn a broad topic into an operational question: which documented dependencies could complicate a sector’s continuity? Specify the recipient, deadline and geographic scope. This determines which documents to collect and which information to exclude.

2. 02

   Collect original documents

   Prioritise national strategies, agency statements, defence publications and research. Record the URL, publication date and access date. Compare the full document with media summaries and retain the consulted version. A draft doctrine, policy announcement and implemented measure have different statuses. Record translated passages and the original language.

3. 03

   Separate evidence levels

   Separate technical observation, claims, public accusations and independent analysis. A statement repeated by several media outlets can still originate from a single source. Infrastructure shared by several groups does not identify a sponsor on its own. Separate confidence in a technical observation from confidence in attribution. Present contradictory evidence alongside supporting indicators.

4. 04

   Read the strategic context

   Connect announcements to publicly documented capabilities, civilian dependencies and international commitments. Do not infer classified capabilities from a single statement. Consider communications, energy, cloud, logistics and navigation where dependencies are documented. Technical disruption does not automatically reveal intent. Describe the observable effect before offering a strategic interpretation.

5. 05

   Produce a traceable brief

   Write what is established, what remains uncertain and what would change your assessment. Keep source links and separate chronology from interpretation. Prepare a short brief covering the question, provisional answer, dated facts, interpretations, uncertainties and next check. Link each decisive claim to a primary document; links support reasoning rather than publication counts.

6. 06

   Keep a defensive approach

   Use only lawfully obtained public information. Focus recommendations on resilience, exercises, continuity and coordination with the relevant organisations. Translate conclusions into continuity questions: a dependency to test, contact to confirm or exercise to organise. Avoid unnecessary identifying information or exploitation details. Distribution should match the recipient’s needs.

   Worked example: several publications describe a network outage. Use the operator for availability facts, the authority for the official position and the technical report for its analytical method. Three articles repeating one statement are not three independent confirmations. The brief should distinguish established facts, source-attributed claims and the next evidence needed.