# Assessing Effectiveness of Cyber Essentials Technical Controls

Priyanka Badva, Partha Das Chowdhury, Kopo M. Ramokapane, Barnaby Craggs,
Awais Rashid

University of Bristol
UK

###### Abstract

Cyber Essentials (CE) comprise a set of controls designed to protect
organisations, irrespective of their size, against cyber attacks. The controls
are _firewalls, secure configuration, user access control, malware protection_
& _security update management_. In this work, we explore the extent to which
CE remains robust against an ever-evolving threat landscape. To that end, we
reconstruct 45 breaches mapped to MiTRE ATT&CK using an Incident Fault Tree
(IFT) approach. Our method reveals the intersections where the placement of
controls could have protected organisations. Then we identify appropriate
Cyber Essential controls and/or Additional Controls for these vulnerable
intersections. Our results show that CE controls can effectively protect
against most attacks during the initial attack phase. However, they may need
to be complemented with Additional Controls if the attack proceeds further
into organisational systems & networks. The Additional Controls (AC) we
identify include back-ups, security awareness, logging and monitoring. Our
analysis brings to the fore a foundational issue as to whether controls should
exclude recovery and focus only on pre-emption. The latter makes the strong
assumption that a prior identification of all controls in a dynamic threat
landscape is indeed possible. Furthermore, any potential broadening of
technical controls entails re-scoping the skills that are required for a Cyber
Essentials (CE) assessor. To that end, we suggest _human factors_ and
_security operations and incident management_ as two potential knowledge areas
from Cyber Security Body of Knowledge (CyBOK) if there is any broadening of CE
based on these findings.

_K_ eywords Cyber attacks $\cdot$ Ransomware $\cdot$ Phishing $\cdot$ Incident
Fault Tree (IFT) $\cdot$ Cyber Essentials (CE) $\cdot$ Inhibit Gate

##  1 Introduction

The Cyber Essentials (CE) technical controls [5] are the UK government
certification scheme to help organisations secure themselves against attacks
on their information systems and processes. The framework comprises a set of
technical controls developed in collaboration with the Information Assurance
for Small and Medium Enterprises (IASME) consortium, the Information Security
Forum (ISF) and the British Standards Institution (BSI). CE certification is a
pre-requisite to bid for UK government contracts, particularly in areas that
involve handling sensitive information. A study [17] conducted in 2015 to
assess the effectiveness of Cyber Essential technical controls investigated
200 vulnerabilities from the CVE list of 2013 and 2014 published by MiTRE. The
study reported that 131 vulnerabilities were mitigated using CE technical
controls. CE controls were also reported to be effective against three high-
profile vulnerabilities of the day, namely Heartbleed, ShellShock and
Superfish.

The landscape of threats and mal-actors has changed over 8 years since that
first systematic evaluation of CE. The proliferation of smartphones and clouds
has increasingly replaced conventional data stores holding sensitive
information. Compromised email accounts cost Yahoo to the tune of $350 million
[2, 1]. WannaCry led to disruptions in the National Health Service (NHS)
information systems [3] and NotPetya spread through an update to the MEDoc tax
accounting software [18]. Cryptocurrencies, along with an illicit market of
exploits, facilitate ransomware as a service [9, 11] to low-skilled criminal
gangs.

Motivated by the previous study [17] and the changing threat landscape, we
explore the extent to which CE controls remain robust as a basic cyber hygiene
mechanism. We do so through a systematic analysis of 45 incident reports
collected through a research agreement with a managed security services
provider. These attacks are mapped to the MiTRE ATT&CK knowledge base and
include a set of ransomware incidents. Our goal was to understand the extent
to which CE controls could have prevented those breaches. The Research
Questions (RQs) we address in this work as follows:

RQ1. Which attack pathways could have been inhibited by CE technical controls
and, to what extent, i.e., whether these controls would completely inhibit
those pathways or whether layering with other controls (multiple CE controls
or a wider set) would have been required?
RQ2. Which controls beyond CE appear frequently as inhibitors of attacks and
how effective are they in inhibiting particular attack pathways (on their own
or in conjunction with other – including CE – controls)?
RQ3. Are there specific patterns of inhibition (whether CE controls or others)
with regards to the subset of ransomware incidents in the corpus?

We used the Incident Fault Tree (IFT) approach [13, 7] to reconstruct the
attacks in terms of events and mitigation mechanisms that could have prevented
them. The method is an adaptation of the method used in our prior work on
analysing data exfiltration attacks [13]. It enables systematic modelling of
attacks and, critically, the points at which specific security controls
provide suitable mitigations against particular attack pathways. In our model
of the attacks, the mitigation mechanisms are expressed as _inhibit gates_.
The presence or absence of _inhibit gates_ in comparison to the previous
reports are analysed to understand the resilience of CE across space (i.e.,
the classes of attacks and types of attack pathways as modelled using MiTRE
ATT&CK) and time (change in malware and attack behaviours since the initial
research in those reports were conducted). For example, prior analysis shows
an overwhelming majority of the breaches (131/200) were completely mitigated
through Cyber Essential controls.

Our analysis shows that CE controls by themselves effectively mitigate most of
the attack scenarios at the initial stages of the attack lifecycle. For
instance, we find from our investigations of the ransomware incidents that CE
controls can stop them at their initial stages. However, in some cases, as the
attacks progress deeper into systems and networks, CE controls must be
complemented with Additional Controls (AC). The pertinent question then is,
whether we should consider incorporating AC controls as part of CE. This
entails broadening the definition of controls to include recovery mechanisms
such as back-ups. Finally, we synthesised our findings with the mapping of the
National Cyber Security Centre (NCSC) Cyber Advisor CE criterion to the Cyber
Security Body of Knowledge (CyBOK) [12]. This mapping shows that the assessors
are expected to have substantial knowledge of _cloud security_ and _applied
cryptography_. This may be an indicator of the changing security needs over
space and time. Expanding on the argument of broadening the scope of
mitigation mechanisms, the AC we find as part of our investigations point
towards the need for assessors to be conversant in additional knowledge areas
like _Human Factors_ and _Security Operations and Incident Management_.
Synthesising this mapping with the analysis from our IFTs and the cross-
contrast with prior work enables us to build a fuller picture of the
effectiveness of the current controls and also whether AC merit recommendation
for inclusion.

We draw upon related work in Section 2 while discussing our contribution. In
Section 3 we briefly discuss CE controls, the constituent elements and
notations of IFT and MiTRE ATT&CK framework. This is followed by an overview
of the dataset of the attacks in Section 4. Section 5 details the methods we
use to analyse and arrive at the mitigation mechanisms. In Section 6, we
outline the _edge_ , _level_ , _phase_ and _level+phase_ analysis we use on
the dataset which is followed by our findings in Section 7. We discuss some of
the key findings like AC, situation of the controls and compare with prior
validation exercises in Section 8 which is followed by conclusion in Section
9.

##  2 Related Work

Such et al. discuss the effectiveness of basic cyber hygiene practices in
preventing cyber attacks [16]. The term “basic cyber hygiene" refers to a set
of fundamental security practices recommended by many experts as a starting
point for organisations to improve their cyber security posture. The paper
reviews several studies and surveys that have examined the impact of basic
cyber hygiene practices on cyber security outcomes. The studies suggest that
organisations that implement basic cyber hygiene practices, such as keeping
software up to date, using strong passwords, and regularly backing up data,
are less likely to experience cyber attacks and data breaches. The authors
also note that, while basic cyber hygiene practices can be effective, they are
not a silver bullet solution for cyber security. Sophisticated attackers can
still find ways to bypass these controls, and organisations should not rely
solely on basic cyber hygiene practices to protect themselves.

The article published by Lancaster University “Cyber Security Controls
Effectiveness: A Qualitative Assessment of Cyber Essentials" discusses the
effectiveness of the CE controls [17]. The authors conducted a qualitative
assessment of CE by interviewing cyber security experts and practitioners from
a range of industries. They asked the participants to rate the effectiveness
of the CE controls in preventing various types of cyber attacks, such as
phishing, malware, and insider threats. The study found that while the CE
controls were generally effective at preventing common cyber threats, there
were some limitations to their effectiveness. The authors also identified
several factors that could impact the effectiveness of the CE controls, such
as the size and complexity of an organisation’s IT environment, the skill and
expertise of its IT staff, and the level of employee awareness and training.
Overall, the study suggests that organisations should view CE as a starting
point for improving their cyber security and should continue to assess and
improve their security posture over time.

The findings of [16] and [17] both point towards the need for AC in light of
the changing threat landscape. For example [17], highlights the need for
awareness and monitoring among others. We contribute to this existing body of
work as:

  * •

In relation to prior studies, we find that CE controls are effective against a
wide range of cyber attacks as has been reported in [16] & [17]. We find that
patch management is not as prominent as a control in our study compared to
prior evaluations [16]. Similar to prior evaluations we identify the need for
AC. Some of the AC controls we propose are the same as [17] while we find the
need for _back up_ and _encryption_ to mitigate some of the attack pathways in
our corpus of incidents. In addition to the secure design defaults as noted by
[17] we identify the need for secure deployment defaults to mitigate many
attack pathways at their initial stages.

  * •

Compared to prior studies [16] & [17], we additionally focussed on ransomware
attacks from our corpus of incidents. In these cases, CE controls by
themselves can be applied to mitigate most of the attack pathways, however
they need support of AC in many instances.

  * •

Beyond recommending AC, we raise an issue which is fairly foundational to the
purpose of CE. Should controls only be preventive in nature or also pre-
emptive? The former requires a complete understanding of all the possible
threats well ahead of time. For business continuity it is important that
systems respond to attacks as they happen or are imminent. To that end we
suggest AC such as _back up_ that can pre-empt imminent or in progress
attacks, for example, ransomware attacks.

##  3 Background

###  3.1 Cyber Essentials Technical Controls

There are five technical controls organised under Cyber Essentials requirement
for IT infrastructures111We use Version 3.0 as that was the current version at
the time of the analysis. [5]:

  * •

Firewall: Firewalls mediate between traffic that leaves and enters a network
through policies. The policies protect against unauthorised users getting
inside a network and such policies can be specified in terms of source (who
can access the network), destination (where users within the network can
visit) and the type of services that are allowed in a network.

  * •

Secure Configuration: Systems come with a default configuration, for example,
default admin user name and passwords which, if not changed, can allow
attackers to exploit the system to harm the legitimate users.

  * •

User Access Control: Organisations should link the stable identity of their
legitimate users to resources to prevent unauthorised access to the resources.
The legitimate users would in turn prove their right to access such resources
through something they know or they possess. This control mandates
organisations should carefully onboard users, securely maintain their user
list and remove users once they leave the organisation. This has implications
on the security of other controls. Moreover, an organisation should also
implement Two-Factor Authentication (2FA) as an additional layer of security,
which helps in reducing the risk of unauthorised user access and enhances the
overall security of access control systems.

  * •

Malware Protection: Systems inside an organisation’s network should not be
readily susceptible to malicious pieces of code. The malicious code can come
from trusted sources as well. So there need to be protections to mitigate
malware entering the organisation’s systems and propagating.

  * •

Security Update Management: Bugs do emerge in software systems much later than
they are released and vendors provide updates to the existing insecure
version. While the internet makes it easier to remotely patch insecure
software, organisations need the discipline to apply such updates regularly.

###  3.2 Incident Fault Tree

An Incident Fault Tree IFT [7] is a modelling approach to explain incidents in
terms of various causes and events. The method proposed in [13] involves
modelling each security incident as an IFT. An IFT is a modelling tool for the
retrospective documentation and analysis of an incident. It is used to explain
the incident in terms of the various causes that contributed to it. An IFT is
based on, and thus uses, the graphical symbols of the Fault Tree Analysis
(FTA) method. It comprises two broad types of notations, namely _events_ and
_gates_. _Events_ are specific discrete events or other conditions that
precipitate an incident. _Gates_ are used to represent multiple scenarios.
They can be used to represent the various ways in which _events_ combine in
order to cause another event. The mitigating factors that can prevent an
exploitable event are also represented as _inhibit gates_. The IFT symbols are
shown in Figure 1 and are as follows:

Figure 1: IFT Symbols

  * •

Basic Event: cannot be explained in terms of other causal events, or has no
known causes;

  * •

Intermediate Event: can be explained in terms of other causal events, or there
are known causes;

  * •

Undeveloped Event: can be explained in terms of other causal events but we
have chosen not to do so because such causal elaboration serves no analytical
purpose;

  * •

AND Gate and OR Gate: respectively represent the conjunction or disjunction of
causal events;

  * •

Inhibit Gate: is placed between an event and its causes to stop an event from
occurring unless the condition in the Conditioning Event is satisfied. The
Inhibit Gate is a critical part of the modelling and analysis as it makes it
possible to model the mitigating or remedial actions that may act as barriers
to the progress towards a security breach. In this project, we use it to model
where CE Controls would have inhibited an attack and where other controls
beyond CE were required.

###  3.3 MiTRE ATT&CK

The behaviour and attack paths of an adversary for known attacks are
documented in the Adversarial Tactics Techniques & Common Knowledge (ATT&CK)
framework [15]. The project started with documenting the Tactic Techniques and
Procedures (TTP) of adversaries attacking Microsoft Windows systems which
gradually expanded to a general record of adversarial behaviour on other
platforms such as Linux, macOS, mobile devices and industrial control systems.
This body of knowledge details pre & post compromise behaviour and is a useful
tool for organisations to understand the potential vulnerable elements in
their information and communication infrastructure.

At its core, ATT&CK is a behavioural model that consists of multiple core
components:

  * •

Firstly, tactics refer to the short-term tactical goals adversaries aim to
achieve during an attack.

  * •

Secondly, techniques describe the methods that adversaries use to achieve
their tactical goals. These methods may include exploiting vulnerabilities,
social engineering, or malicious software.

  * •

Thirdly, sub-techniques provide more specific details on the means by which
adversaries achieve their tactical goals. These sub-techniques provide a more
granular understanding of the techniques used by adversaries.

  * •

Finally, documented adversary usage of techniques, procedures, and other
metadata provides context around how adversaries use specific tactics and
techniques. This metadata helps security professionals to identify patterns in
adversary behaviour and develop more effective defence strategies.

By incorporating these components into its framework, MiTRE ATT&CK enables
security teams to gain a deeper understanding of how cyber adversaries
operate. This understanding helps security professionals to develop proactive
defence strategies that can identify and mitigate potential threats before
they result in a security incident.

##  4 Dataset

The data was provided by an organisation that delivers managed security
services. They provided us with incident reports from real breaches; hence we
keep their and their clients’ identities confidential. We received a total of
50 real-life incidents, out of which we were able to use 45 for modelling; the
remaining five (5) were not usable due to lack of detail. As depicted in
Figure 2, the majority of incidents were related to Phishing and Vulnerability
Exploitation (VE). Phishing incidents were further categorised into Cobalt
Strike & QakBot Malware Execution, Cryptominer, and Social Engineering
Attacks. On the other hand, the VE category included Unpatched Software/Device
Exploitation, Log4j Exploitation, ProxyShell Vulnerability Exploitation, SQL
Injection & Brute Force, and Other CVEs Exploitation. Ransomware originated
from both phishing and VE. The severity of the incidents varied and caused
different impacts as shown in Figure 2, such as ransomware attacks caused data
encryption, data exfiltration, unauthorised data deletion and data
destruction. A different range of colours have been used to segregate the
incidents that are associated with multiple impacts.

Figure 2: Type of Incidents and its Impacts

##  5 Method

Our research methodology involved a multi-stage process that included the
independent modelling of IFTs by the primary researcher, followed by review
and feedback from a second researcher, and a subsequent collaborative
discussion resulting in updates to the IFT models.

During the first stage, the primary researcher worked independently to create
an IFT model for each incident under investigation. The IFT model provides a
graphical representation of the various events and factors that contributed to
the incident, helping to identify its root causes and contributing factors.

In the second stage, the IFT models were handed over to the second researcher
for review. The second researcher carefully reviewed the IFT models to
identify any discrepancies or omissions and suggested necessary improvements
(i.e., arguing to consensus [8]). In case of disagreements, they were referred
to a third researcher to resolve them through discussion and brainstorming.
This process ensured that the IFT models were as comprehensive and accurate as
possible.

Figure 3: IFT Model for Black Basta Ransomware Attack

###  5.1 IFT Modelling

The IFT modelling usually began by first reading the incident reports. The
incident data were mapped to MiTRE ATT&CK TTPs. These reports include a
timeline, executive summary, and remediation actions for each incident. We
first started reading the executive summary to identify the type of incident
and its impacts. The report began with initial access, which was usually the
first stage in ATT&CK. From there, the report detailed the steps taken by the
attacker to carry out their attack.

Based on the information in the incident report, the first intermediate event
was identified, which usually involved a network intrusion. This was followed
by network infection and a third intermediate event based on the impact of the
attack. The report was then studied in detail to identify each of the leaf
nodes, which are the basic events that lead to the top intermediate events.

We have shown one of the IFT models from the dataset in Figure 3. The incident
is about the Black Basta ransomware attack that resulted in data exfiltration
and server shutdown in an organisation. IFTs help identify the confluence of
sub-trees that facilitate an attack. In this case _network intrusion_ ,
_network infection_ and _data encryption & server shutdown_ sub-trees
contribute to the success of the attack. In our diagram we denote them as 1, 2
and 3 respectively. If we drill down into each of them we identify the _basic
events_ , _intermediate events_ and _inhibit gates_ that form the individual
sub-trees. They are numbered accordingly; for example, an _intermediate event_
for 1 will be numbered as 1.x, so on and so forth for each of the other sub-
trees.

For _network intrusion_ , the attacker exploited legitimate Windows command
line utility and the ability to execute services on a remote host. We classify
them as _basic events_ as they are the core enablers and form the leaf nodes
for _network intrusion_. The inhibit gate identifies the mitigation for the
leaf nodes in _network intrusion_ , which is a secure configuration. The
absence of secure configuration allows the execution of Qakbot PowerShell
payload and Cobalt Strike beacon as 1.1.1 and 1.1.2 of Figure 3. While the IFT
reconstructs the path, it also identifies the intersection where mitigation
could have helped and, in turn, the Cyber Essential control and/or AC. The
separation between the enabler and the consequent action enables a nuanced
understanding of incidents and corresponding mitigations. The other _inhibit
gates_ in this sub-tree, such as malware protection and security update
management, protect against malware and PowerShell vulnerabilities,
respectively. There is an additional control of user education which can
potentially prevent users from clicking links in suspicious emails. The
incident report does not conclusively note the cause of the _network
intrusion_ and points to either relevant CVEs related to PowerShell or malware
downloaded through a phishing email. We represent this using an _OR gate_.
Finally, _network intrusion_ could have been prevented through user access
control and/or secure configuration.

Similarly, for _network infection_ , creation of accounts, disabling windows
defender and scheduling a task form the basic enablers and are the _basic
events_. The _inhibit gate_ points to access control which could have
prevented the malware from creating user accounts bypassing the privilege
management infrastructure. A firewall is identified as a control at the
_inhibit gate_ which could have prevented inbound connection to a remote
desktop along with remote desktop hardening. PsExec and Qakbot exploited SMB
shares to enable lateral movement. Privilege escalation, persistence, access
to a remote desktop and lateral movement led to _network infection_. This
attack sub-tree could have been prevented through secure configuration.

Finally, _data encryption & server shutdown_ were enabled by encrypting the
virtual machines hosted on Hyper-V servers and files on domain controllers.
They are classified as _basic events_ along with the attacker’s ability to
push out ransomware on end user devices in the estate. The intermediate
events, such as gathering IP addresses, targeting internal IP addresses and
preventing backups led to _data encryption & server shutdown_. These actions
could have been prevented with an appropriately configured firewall since the
attacker executed the attack remotely.

###  5.2 Identifying Security Controls

In the IFTs, we employed three different kinds of controls: CE Controls,
controls provided in the incident reports and controls we identified as
relevant. After the completion of the model, we initiated an analysis of the
potential intermediate events or basic events that CE can prevent. The
security measures described in the incident report were also used for this
purpose. Several of the suggested controls from the reports were already
present in CE. We then proceeded to look for events that needed AC (either
recommended in the reports or ones we identified from the literature). Once we
identified controls for all the inhibit gates, two researchers discussed the
best way to finalise the controls and concluded the process. As illustrated in
Figure 3, inhibit gates with text inside are Cyber Essential controls and
inhibit gates with shield symbol inside are AC.

##  6 Analysis

#### Analysis by Edges

To determine the effectiveness of CE, we counted the number of edges that
could have been prevented by CE in each IFT. Our definition of _edge_ involves
linking two nodes by an inhibit gate. So we consider each instance of the
inhibit gate in the IFT model as a single edge as shown in Figure 4 (a). If
there are several inhibit gates connecting the source and destination node, we
also treat them as a single edge (Figure 4 (b)). In every case, the source
node is an AND/OR gate, and the destination node is an intermediate event.

Figure 4: Single Edge between And Gate and Intermediate Event

#### Analysis by Level

For this type of analysis, we first examine the inhibit gates at the lowest
_level_ within each tree. As illustrated in Figure 5, a three-level tree
structure is depicted, with levels denoted as L1, L2 and L3. The first two
layers, L1 and L2, have two edges and three inhibit gates each. The top layer,
L3, has only one edge and one inhibit gate. We focus on L1 of each tree and
identify which paths are restricted by CE. By examining the lowest level, we
can determine the effectiveness of the CE controls in preventing an attack
from going further in the tree. If the CE controls prove inadequate, we then
proceed to examine AC controls, as well as potential combinations of both.

Figure 5: Three Level IFT

#### Analysis by Phase

In the phase-wise analysis, we divide the IFT model into distinct phases
representing intermediate events occurring after the top-level event. Figure 6
illustrates a three-phase structure consisting of Phase 1 (P1), Phase 2 (P2),
and Phase 3 (P3). P1 is the initial phase, the first intermediate event
following the top level event. We analyse attack mitigation by CE in its
initial phase P1. This allows us to determine the level of protection provided
by CE in preventing attacks during the initial phase. Additionally, we examine
the use of other controls, such as AC and combinations of CE and AC that are
employed in P1.

Figure 6: Three Phase IFT

#### Analysis by Level+Phase

In this analysis, we integrated both level-wise and phase-wise analysis as
illustrated in Figure 7. To begin with, we focused on examining the attack
paths at the lowest level (L1) during the initial phase (P1), which we
referred to as L1P1. Subsequently we analysed the security controls
implemented at the corresponding L1P1. By combining these two insights, we
delved deeper into assessing the effectiveness of both CE and AC controls.
This comprehensive analysis allowed us to gain a more thorough understanding
of the overall effectiveness of these controls to stop an attack during the
initial stages.

Figure 7: Level 1 (L1) + Phase 1 (P1) Analysis

##  7 Findings

###  7.1 RQ1: Effectiveness of CE in inhibiting attack pathways.

The data presented in Figure 8 indicates the attacks inhibited by CE controls.
Firewall and Secure Configuration were applicable in 39 out of 45 incidents,
making them the most effective security measures in blocking malicious traffic
and preventing unauthorised access. This is a promising indication that the
attack pathways can be inhibited by proper configuration to minimise the risk
of cyber attacks. User Access Control was suitable in 22 out of 45 incidents.
Malware Protection was applicable in 25 out of the 45 incidents. Lastly,
Security Update Management, which involves regularly updating systems and
software to address security vulnerabilities, was only applicable in 19 out of
the 45 incidents.

$0$$10$$20$$30$$40$FirewallSecure ConfigurationUser Access ControlMalware ProtectionSecurity Update$39$$39$$22$$25$$19$ Figure 8: Inhibitors of attacks by CE controls Cases |  Total Edges |  CE Edges |  AC Edges |  CE+AC Edges |  CE at L1 |  AC at L1 |  CE+AC at L1 |  CE at P1 |  AC at P1 |  CE+AC at P1 |  CE at L1P1 |  AC at L1P1 |  CE+AC at L1P1
---|---|---|---|---|---|---|---|---|---|---|---|---|---
01(Ransomware) |  11 |  6 |  3 |  2 |  1 |  2 |  0 |  2 |  0 |  2 |  1 |  0 |  0
02(Phishing) |  5 |  1 |  3 |  1 |  0 |  1 |  0 |  0 |  1 |  1 |  0 |  1 |  0
03(Malware Execution) |  7 |  3 |  3 |  1 |  0 |  1 |  1 |  1 |  1 |  1 |  0 |  1 |  1
04(Malware Execution) |  11 |  8 |  1 |  2 |  1 |  0 |  1 |  1 |  0 |  1 |  1 |  0 |  0
05(Malware Execution) |  8 |  5 |  1 |  2 |  4 |  0 |  0 |  1 |  0 |  1 |  1 |  0 |  0
06(Phishing) |  4 |  2 |  1 |  1 |  1 |  0 |  0 |  0 |  0 |  1 |  0 |  0 |  1
07(Ransomware) |  10 |  4 |  4 |  2 |  0 |  1 |  0 |  2 |  1 |  0 |  1 |  1 |  0
08(Phishing) |  3 |  0 |  2 |  1 |  0 |  2 |  1 |  0 |  0 |  1 |  0 |  0 |  1
09(Malware Execution) |  4 |  2 |  0 |  2 |  2 |  0 |  1 |  1 |  0 |  0 |  1 |  0 |  0
10(Malware Execution) |  4 |  4 |  0 |  0 |  4 |  0 |  0 |  1 |  0 |  0 |  1 |  0 |  0
11(CV Exploitation) |  4 |  3 |  1 |  0 |  1 |  0 |  0 |  2 |  0 |  0 |  1 |  0 |  0
12(CV Exploitation) |  3 |  2 |  1 |  0 |  1 |  1 |  0 |  1 |  0 |  0 |  1 |  0 |  0
13(CV Exploitation) |  2 |  1 |  1 |  0 |  1 |  1 |  0 |  1 |  0 |  0 |  1 |  0 |  0
14(Phishing) |  4 |  2 |  1 |  1 |  1 |  0 |  1 |  0 |  0 |  1 |  0 |  0 |  1
15(Phishing) |  2 |  0 |  0 |  2 |  0 |  0 |  2 |  0 |  0 |  1 |  0 |  0 |  1
16(CV Exploitation) |  3 |  2 |  0 |  1 |  1 |  0 |  1 |  1 |  0 |  0 |  1 |  0 |  0
17(CV Exploitation) |  4 |  2 |  1 |  1 |  1 |  1 |  1 |  1 |  0 |  0 |  1 |  0 |  0
18(CV Exploitation) |  4 |  1 |  1 |  2 |  0 |  1 |  0 |  0 |  0 |  1 |  0 |  0 |  1
19(CV Exploitation) |  2 |  1 |  1 |  0 |  1 |  1 |  0 |  1 |  0 |  0 |  1 |  0 |  0
20(Phishing) |  3 |  1 |  0 |  2 |  0 |  0 |  2 |  0 |  0 |  1 |  0 |  0 |  1
21(CV Exploitation) |  3 |  2 |  0 |  1 |  1 |  0 |  1 |  1 |  0 |  0 |  1 |  0 |  0
22(Phishing) |  3 |  2 |  0 |  1 |  1 |  0 |  1 |  0 |  0 |  1 |  0 |  0 |  1
23(Malware Execution) |  3 |  1 |  0 |  2 |  1 |  0 |  1 |  0 |  0 |  1 |  0 |  0 |  1
24(Phishing) |  2 |  0 |  0 |  1 |  0 |  0 |  1 |  0 |  0 |  1 |  0 |  0 |  1
25(Ransomware) |  6 |  2 |  1 |  3 |  1 |  1 |  0 |  1 |  0 |  1 |  1 |  0 |  0
26(Phishing) |  3 |  2 |  0 |  1 |  1 |  0 |  1 |  0 |  0 |  1 |  0 |  0 |  1
27(CV Exploitation) |  3 |  2 |  1 |  0 |  1 |  1 |  0 |  1 |  0 |  0 |  1 |  0 |  0
28(Ransomware) |  7 |  3 |  2 |  2 |  2 |  1 |  0 |  1 |  0 |  1 |  1 |  0 |  0
29(CV Exploitation) |  3 |  2 |  0 |  1 |  1 |  0 |  1 |  1 |  0 |  0 |  1 |  0 |  0
30(Malware Execution) |  4 |  1 |  1 |  2 |  0 |  1 |  0 |  0 |  0 |  1 |  0 |  0 |  1
31(Ransomware) |  6 |  3 |  1 |  2 |  1 |  1 |  0 |  2 |  0 |  0 |  1 |  0 |  0
32(Phishing) |  3 |  3 |  0 |  0 |  2 |  0 |  0 |  1 |  0 |  0 |  1 |  0 |  0
33(Ransomware) |  3 |  2 |  0 |  1 |  1 |  0 |  1 |  0 |  0 |  1 |  0 |  0 |  1
34(CV Exploitation) |  3 |  2 |  0 |  1 |  1 |  0 |  1 |  1 |  0 |  0 |  1 |  0 |  0
35(Phishing) |  3 |  1 |  0 |  2 |  0 |  0 |  2 |  0 |  0 |  1 |  0 |  0 |  1
36(Malware Execution) |  6 |  4 |  2 |  0 |  1 |  1 |  0 |  2 |  0 |  0 |  1 |  0 |  0
37(CV Exploitation) |  6 |  3 |  3 |  0 |  0 |  2 |  0 |  1 |  0 |  0 |  1 |  0 |  0
38(Ransomware) |  8 |  3 |  2 |  3 |  2 |  2 |  0 |  1 |  0 |  1 |  1 |  0 |  0
39(Ransomware) |  6 |  3 |  2 |  1 |  1 |  2 |  0 |  1 |  0 |  0 |  1 |  0 |  0
40(Ransomware) |  9 |  5 |  2 |  2 |  3 |  2 |  1 |  2 |  0 |  1 |  1 |  0 |  1
41(CV Exploitation) |  3 |  2 |  0 |  1 |  1 |  0 |  1 |  1 |  0 |  0 |  1 |  0 |  0
42(Phishing) |  5 |  2 |  2 |  1 |  1 |  1 |  0 |  0 |  0 |  1 |  0 |  0 |  1
43(Phishing) |  5 |  2 |  2 |  1 |  1 |  1 |  0 |  0 |  0 |  1 |  0 |  0 |  1
44(Phishing) |  4 |  3 |  0 |  1 |  1 |  0 |  0 |  0 |  0 |  1 |  0 |  0 |  1
45(Phishing) |  3 |  2 |  0 |  1 |  1 |  0 |  1 |  0 |  0 |  1 |  0 |  0 |  1
Table 1: Attack Pathways Stopped by Cyber Essentials (CE), Additional Controls
(AC) and Combination of Both (CE+AC)

We present our findings in Table 1. As noted above, we took a holistic
approach to answering this research question by evaluating each component of
the attack tree under four distinct analytical outcomes: analysis-by-edge,
analysis-by-level, analysis-by-phase and analysis-by-level+phase.

#### Analysis by Edge

The mitigation of attack pathways in the analysis-by-edge approach are
represented in the three columns of the Table 1 starting from third column,
i.e., CE Edges. The Case 01 in Table 1 has 11 edges, of which 6 edges are
inhibited by CE controls, 3 through AC and 2 edges are inhibited by a
combination of both CE and AC. Case 04 too has 11 edges, where 8 edges are
mitigated through CE controls, 1 edge through AC and 2 edges through a
combination of both CE and AC. These two incidents have the maximum coverage
of CE controls, yet AC are required for comprehensive mitigation of the
threats.

There are 18 cases where only 2 edges are inhibited by CE controls alone.
However, the total number of edges for these 18 cases ranges from 3 to 6. This
means there remains the need for at least one AC along with the relevant CE
control to mitigate each of the 18 incidents.

Case 07 has 10 edges, where 4 edges can be prevented through AC \- which is
the highest among all the cases requiring AC. There are 17 cases where a
combination of CE and AC controls mitigate threats, but these cases do not
have independent AC edges. So AC on their own cannot be effective without the
relevant CE controls. Only two cases, namely 25 and 38, have the highest
combinations of CE and AC edges, amounting to 3. Again, this shows that
neither CE nor AC are effective on their own. There are 20 cases which have
only 1 combined edge each. This indicates that a significant proportion of our
cases require some combination of CE and AC (in this case, at least 1) to
prevent attacks.

####  Analysis by Level

The analysis-by-level also highlights the need for a combination of CE and AC.
CE controls can only mitigate 4 edges from 2 of the 45 incidents at level 1.
AC can prevent at most 2 edges at level 1, and they appear in 6 cases. A
combination of both AC and CE prevent 2 edges at level 1 from 2 of 45 cases.

####  Analysis by Phase

During the phase-wise analysis, we focused on Phase 1 (P1) and examined the
edges of the IFT that are mitigated by CE, AC and CE+AC. The analysis of this
method is depicted in the Table 1 column named _CE at P1_ , _AC at P1_ and
_CE+AC at P1_. When we examined the attack paths mitigated by use of CE in P1,
our analysis revealed that there were 6 cases where 2 edges were inhibited, 21
cases where 1 edge was inhibited, and 18 cases where no edges were inhibited.
Regarding the use of AC in P1, there were 42 cases where no AC was required
and 3 cases where 1 edge was inhibited by AC. The combination of controls in
P1 showed that there were 19 cases where no edges were inhibited, 25 cases
where 1 edge was inhibited, and 1 case where both controls stopped 2 edges.

The analysis highlights that CE played a crucial role in stopping attacks
during the initial stage in most cases. However, layering with AC in some
instances could further enhance the security posture by inhibiting attack
pathways.

#### Analysis by L1P1

The combination of level-wise and phase-wise analysis revealed that CE plays a
major role in stopping the malicious edges. The findings are presented in the
last three columns in Table 1. There are no more than two edges appearing in
the L1P1 of IFT. The majority of 1’s are occupied by CE alone, and there are
only three cases - 02, 03 and 07 - where AC alone are used. This shows that CE
alone is very effective in stopping the threats at an early stage. However,
the number of edges in CE+AC should also be taken into account, and a total of
19 cases are observed to be mitigated by combined controls. This analysis
shows that even though CE plays a major role as a standalone control, a
combined approach provides further defence.

Method | Total attack pathways |  Inhibited by CE | Inhibited by AC |  Inhibited by CE+AC
---|---|---|---|---
Edge Analysis | 209 |  108 | 46 |  55
Level Analysis | 98 |  46 | 28 |  24
Method | Total Cases |  Mitigated by CE | Mitigated by AC |  Mitigated by CE+AC
Phase Analysis | 45 |  17 | 0 |  28
Level+Phase Analysis | 45 |  25 | 1 |  19
Table 2: Overall Summary of attacks inhibited by CE & AC controls in each
analysis approach

The summarised findings are presented in Table 2, encapsulating the key
insights from the analysis. It is evident that in the Edge and Level analysis,
the majority of attack pathways are effectively inhibited by the
implementation of CE controls alone. However, it should be noted that AC
measures also play a vital role in completely halting the attacks. In the
Phase analysis, 17 out of 45 cases were successfully stopped solely by CE
controls, while 28 cases required a layered approach incorporating both CE and
AC controls. Particularly noteworthy is the effectiveness of CE controls in
the L1P1 analysis, where 25 out of the 45 attacks were exclusively prevented
by CE measures. This analysis underscores the significance of deploying CE
controls at the lower levels of attacks during their initial phases, as it can
effectively impede the spread of attacks further.

###  7.2 RQ2: Which AC appear frequently and how effective are they as
inhibitors of attack pathways.

After conducting a thorough analysis of the data, we have identified five AC,
on top of CE, that are frequently used to prevent attacks from succeeding.
These controls include Encryption, Backup, Policy, Education, and Logging &
Monitoring.

  * •

Education: This control refers to education and training for users on cyber
security best practices. By providing employees with regular cyber security
training, organisations can reduce the risk of human error and strengthen
their overall security posture. From the analysis of the 45 cyber incidents,
several pathways were successfully inhibited by implementing AC. As
illustrated in Figure 9, education was effective in 23 out of 45 incidents.
This suggests that educating employees about cyber security best practices and
potential threats is crucial in reducing the likelihood of successful cyber
attacks, such as phishing.

  * •

Logging & Monitoring: Logging & Monitoring involves collecting and analysing
network activities and security events. These activities include monitoring
network traffic, log files and end-user activities. This control is important
for identifying security incidents and minimising the damage caused. Logging &
Monitoring was found to be effective in 26 out of 45 incidents in inhibiting
attack edges. This indicates that closely monitoring system logs and network
activities can effectively detect and prevent cyber attacks.

  * •

Policy: Cyber security policies are rules and guidelines that outline an
organisation’s approach to cyber security. By establishing and implementing
clear policies and procedures, organisations can ensure that their security
measures are consistently applied across the organisation. Configuring an
appropriate execution policy was another control that proved effective in
inhibiting attack pathways, being utilised in 20 out of the 45 incidents.

  * •

Encryption: Encryption involves encoding data so that it can only be read by
authorised parties. The implementation of encryption can help the organisation
to secure sensitive data and prevent unauthorised access. Encryption was used
in 9 out of 45 incidents, highlighting the effectiveness of strong encryption
measures to prevent unauthorised access to sensitive data.

  * •

Backup: Backup refers to making regular replicas of data and storing them in a
secure location. This is a crucial security measure in the case of ransomware,
or other incidents where data may be damaged or deleted. By establishing a
backup(s), organisations can ensure that data is accessible even in the case
of disaster. We reconstructed 9 cases of ransomware, where backup, as a
control, can support organisations to recover from such cyber attacks and
minimise the impact of data loss.

Overall, these findings suggest that implementing AC with CE can be a
practical approach to reducing the attack surface and consequently the blast
radius.

$0$$5$$10$$15$$20$$25$EducationLogging&MonitoringPolicyBackupEncryption$23$$26$$20$$8$$9$
Figure 9: Inhibitors of attacks by Additional Controls

###  7.3 RQ3: Identify specific inhibition patterns (CE or AC) with regards to
ransomware incidents in the corpus.

We investigated 9 cases of ransomware attacks, where the variants included
Black Basta, Conti, Lockbit among others. Our analysis was conducted in two
phases. The first phase involved determining the overall controls employed,
including both CE and AC, as well as the combination of both, to prevent the
attacks going further in a tree. In the second phase, we performed detailed
analysis and examined the controls at L1, P1 and L1P1 to determine which
controls were effective in halting the progression of events in the IFT. Our
findings are presented in Figure 10. The blue, red and yellow bar represents
the CE controls, AC and combination of both controls respectively.

Figure 10 (a) displays the distribution of controls utilised in the different
ransomware incidents. In cases 1 and 9 it is observed that CE controls alone
mitigate the majority of attack pathways. The phenomenon is the same for cases
4, 5, 6, 7 & 8 where CE controls by themselves are appropriate to mitigate
most attack pathways, however AC and combination of AC & CE controls are
applicable to mitigate the remaining attack pathways. On the other hand, for
case 2, CE & AC controls are independently applicable to mitigate an equal
number of attack pathways. Case 3 is an exception, where our findings show
that a combination of CE & AC are suitable to mitigate more attack pathways
than they do when applied independently.

Figure 10 (b) presents the effectiveness of controls from preventing an attack
if proceed beyond L1; we find that CE controls can be applied to stop a
ransomware attack in cases 4 & 9\. In our investigations we find the
applicability of a combination of CE & AC in case 6 only to prevent an attack
at L1. However, for all the other instances of ransomware attack we find that
application of AC to be effective at L1.

The phase analysis as presented in Figure 10 (c) shows that CE by themselves
are appropriate to prevent more attack pathways at the initial phase but they
need to be supported with a combination of CE & AC controls. For cases 1, 3,
4, & 7, CE controls and a combination of CE & AC are evenly poised in their
ability to prevent attack pathways at the initial phase.

Somewhat of a contrast emerges when we combine L1 and P1. Figure 10 (d) shows
that CE controls by themselves can be applied to prevent all the attack
pathways in 6 of the 9 incidents of ransomware attack. Case 6 is a departure,
where AC are applicable to prevent all the attack pathways and for cases 2 &
9, we need to apply AC and a combination of CE & AC respectively.

While looking at specific controls (Table 3), we find that CE controls such as
Firewall and Secure Configuration were overwhelmingly applicable. For all the
ransomware incidents Secure Configuration was the most commonly applicable CE
control, followed by Malware Protection. So far as the AC, we find Encryption
and Backup were widely applicable.

$0$$2$$4$$6$Case1Case2Case3Case4Case5Case6Case7Case8Case9$6$$4$$2$$3$$3$$3$$3$$3$$5$$3$$4$$1$$2$$1$$0$$2$$2$$2$$2$$2$$3$$2$$2$$1$$3$$1$$2$(a)

$0$$1$$2$$3$Case1Case2Case3Case4Case5Case6Case7Case8Case9$1$$0$$1$$2$$1$$1$$2$$1$$3$$2$$1$$1$$1$$1$$0$$2$$2$$2$$0$$0$$0$$0$$0$$1$$0$$0$$0$(b)CEACCE+AC

$0$$0.5$$1$$1.5$$2$Case1Case2Case3Case4Case5Case6Case7Case8Case9$2$$2$$1$$1$$2$$0$$1$$1$$2$$0$$1$$0$$0$$0$$0$$0$$0$$0$$2$$0$$1$$1$$0$$1$$1$$0$$1$(c)

$0$$0.5$$1$Case1Case2Case3Case4Case5Case6Case7Case8Case9$1$$1$$1$$1$$1$$0$$1$$1$$1$$0$$1$$0$$0$$0$$0$$0$$0$$0$$0$$0$$0$$0$$0$$1$$1$(d)

Figure 10: Security Controls Inhibition Pattern for Ransomware Cases – (a) Security Controls appeared in all level of IFT, (b) Security Controls at bottom level (L1) of IFT, (c) Security Controls at Phase1 (P1) of IFT, (d) Security Controls at L1P1 of IFT Ransomware Variant |  Most Used CE |  Most Used AC |  Combination Controls
---|---|---|---
Black Basta |  -Firewall |  -Education |  -Malware Protection + Education
|  -Secure Configuration (L1) |  -Encryption |
|  |  -Backup (L1) |
Conti |  -Secure Configuration (L1) |  -Education |  -Secure Configuration + Education
|  -Security Update Management |  -Backup |  -Backup + Firewall
|  -Malware Protection |  -Encryption (L1) |
LockBit |  -Security Update Management (L1) |  -Backup (L1) |  -Secure Configuration + Policy
|  -Malware Protection (L1) |  -Encryption |  -Logging & Monitoring + User Access Control
|  |  -Policy |
Others |  -Secure Configuration |  -Backup (L1) |  -Secure Configuration + Logging & Monitoring
|  -User Access Control (L1) |  -Logging & Monitoring |  -Secure Update Management + Education
|  |  -Policy (L1) |
Table 3: Inhibit Pattern in Ransomware Attacks. L1 represent the layer1
controls

##  8 Discussion

###  8.1 Need for Additional Controls

CE were designed as a set of usable & affordable controls intended to be used
by organisations. They focus on patch management, access control, malware
protection, firewall and secure configuration. The proposed controls point to
basic hygiene that an organisation should practice to prevent security
breaches. The assumption is that attackers are opportunistic, and all
attackers do not come with formidable expertise.

We studied the attack scenarios by phases, levels, and a combination of the
two, along with an overall analysis of the entire attack lifecycle. While CE
controls seem to be effective in preventing many malicious attack pathways
from propagating beyond the initial phases & levels, there remains a need for
AC to mitigate the attacks when they progress further into the systems and
networks. Furthermore, the need for AC cannot be completely ruled out even at
the initial stages. We identify some AC \- encryption, backup, policy,
education, logging & monitoring. Consequently, we see two distinct lines of
deliberations here. One is on the need for AC; the other being, should there
be a need for AC, then deliberating on the underpinning knowledge for a CE
assessor.

Considering AC includes a fundamental debate as to whether controls should
only be preventive and not include mechanisms that help in recovery. On the
other hand, our results show that while attacks propagate beyond the initial
levels and phases there is indeed a need for AC. The argument for AC can be
grounded upon the idea that it is difficult to anticipate all possible attack
pathways and harden systems such that attacks can be prevented from
progressing beyond the initial stages. With respect to the need for recovery
mechanisms, there are applications where recovery is integral to intrusion and
fault tolerance [4] and an important ingredient of cyber resilience [19].
Protection mechanisms need to evolve across space and time [6].

Should there be AC as part of CE, the other pertinent question is redesigning
the syllabus for a CE assessor. Prior research conducted a systematic mapping
with CyBOK and found that _cloud security_ and _applied cryptography_ covers
the skills that an assessor needs. Based on our analysis, a further expansion
of the syllabus could include the _human factors_ and _security operations and
incident management_ Knowledge Areas (these are already partly covered in the
syllabus, albeit not extensively). Future research could consider mapping the
ingredients of the AC to elicit relevant Knowledge Areas.

Take Away. CE controls are effective in preventing attacks at their inception,
but need the support of Additional Controls if attacks penetrate further into
an organisation’s systems & networks. Deliberations on AC spawn a foundational
debate as to whether controls should only be pre-emptive and exclude recovery
from breaches. Should there be recognition of AC as essential then CE
assessors need to be skilled in _human factors_ and _security operations and
incident management_.

###  8.2 Deployment of the controls

The _inhibit gates_ indicate controls that can protect against breaches
expanding within an organisation. Our investigations reveal that the
deployment of controls needs to be contextualised. To that we propose two
possibilities for effective deployment of controls.

#### Sequential Controls

Inhibit gates refer to the controls that must be activated in a specific order
to mitigate the particular event effectively. These controls should be
implemented in a specific sequence, where each inhibit gate depends on the
previous one to work successfully. For example, in a phishing attack which is
trying to perform privilege escalation, the inhibit gates involve User
Education (m1), Multi-factor Authentication (m2) and Monitoring the logging
attempts (m3). These three controls should be in the sequence (m1-m2-m3) as
shown in Figure 11 and executed correctly; otherwise, overall cyber controls
could fail.

Figure 11: Sequential Controls

#### Parallel controls

Parallel inhibit gates work independently and ensure that if one control
fails, other controls are in place and sufficient to prevent the attack
(Figure 12). For example, in the case of unauthorised access to an account,
the most common used security controls, such as user access control (m1),
multi-factor Authentication (m2) and firewall (m3), can be used in parallel
(m1 $\parallel$ m2 $\parallel$ m3) for attack mitigation. If one of the
controls fails, the other can still provide some level of protection.

Figure 12: Parallel Controls

Take Away. Our analyses show that CE controls, when deployed in conjunction
with other controls for certain contexts, can provide improved deterrence and
defence. This means controls can be sequentially placed or placed in parallel
to another. Should one of them fail the other can still mitigate against
certain attacks. For example, we can situate difficult to measure Additional
Controls such as _awareness & education_ along with multi-factor
authentication to protect against certain types of phishing attacks.

###  8.3 Comparative understanding with previous work

There are prior investigations into the effectiveness of Cyber Essential
controls. The corpus of attacks we investigated is smaller than [17]. However,
the cases we investigate are detailed incidents that provide an in-depth view
of the controls needed to prevent attacks. Our analysis shows that CE controls
are effective in preventing most of the attacks in our dataset at the initial
stages. However, a comparative understanding of the incident reports between
[17] and ours reveals that while Cyber Essential controls are robust against
malicious remote access, like establishing command & control channels and
remote desktops, they do not mitigate against human factors, especially during
attack staging. The impact of the latter is pronounced, as we see in our
corpus that includes ransomware incidents. If attacks progress beyond the
initial stages there is a more pronounced need for AC, and CE controls by
themselves are not enough to protect against them. There is a synergy between
the additional socio-technical & technical controls suggested by prior work
[17] and our work. Table 4 presents the suggested AC across prior reports and
our findings. Logging & monitoring, as a technical control is suggested by the
prior studies [17], a control suggested by our investigations as well.
Awareness & education is a socio-technical control suggested by the previous
reports as well as in our work.

A contrasting case is of patch management between the previous study and ours.
We identify patch management as an effective control for 19 of the 45
incidents which is roughly $42\%$ compared to $87.5\%$ in the previous study.
Firewalls, on the other hand, are identified in $90\%$ of the incidents we
investigated in our report. We do not see emphasis on back-ups in the previous
report which we identify as an additional control - this might be due to both
the increase in ransomware since 2015 and our specific focus on ransomware
incidents as an element of our investigation.

The previous study reports that CE technical controls cannot mitigate threats
which are due to design decisions (they articulate as hard coded flaws) in the
hardware and software. A scrutiny of our findings reveals that attackers take
advantage of the enablers which we indicate through _basic gates_. These
enablers reflect the manner in which systems are configured, for example,
PowerShell permissions. While the fundamentals of protection mechanisms are
there [14], developers come with diverse security understandings. Conventional
recommendations point towards designing software with security in mind [10].
Future research could explore the extent to which security can be woven into
deployment practices, with explicit focus on better observance of the
principles.

Take Away. A comparative understanding with prior work shows that CE controls
remain resilient against many attacks. However, our analysis and prior work
points to the need for additional controls for improved mitigation. Controls
around _human factors_ and _logging & monitoring_ are found by both the
studies. While prior work argues for safe design defaults in software &
hardware, we make a case for safe software deployment defaults.

Sociotechnical Controls
---
Additional Controls |  Findings in our Report |  Findings in CyBoK Report |  Findings in Lancaster Report
Awareness & Education |  ✓ |  ✓ |  ✓
Policy |  ✓ |  ✓ |  -
Technical Controls
Logging & Monitoring |  ✓ |  ✓ |  ✓
Backup |  ✓ |  ✓ |  -
Encryption |  ✓ |  ✓ |  -
Table 4: Mapping Findings with Previous Research

##  9 Conclusion

Security is a property of technology with a defined objective. CE controls
come with defined objectives of preventing commodity attacks and are meant for
a wide range of users. We explore the effectiveness of CE controls using 45
incident reports, which includes 9 incidents of ransomware. IFT allow us the
granularity to break incidents into non-reducible events and build upon them
to construct the attack pathways across levels and phases. The nuance offered
by the method allows us to explore if attacks can be prevented right at their
incursion. For example, our level and phase analysis shows that CE alone can
completely mitigate 25 out of the 45 incidents at their initial phases, while
using a combination of CE and Additional Controls can mitigate another 19
incidents. The additional controls we propose as part of this work are
_education, logging & monitoring, policy, encryption_ & _back up_. The
insights from our overall study can be summarised as:

  * •

CE controls by themselves are effective against the majority of commodity
attacks, however, they need to be complemented with additional controls for
complete mitigation of all the attacks we studied. A combination of both,
reduces the attack surface and consequently the blast radius. For example, the
combined effectiveness of CE and AC prevent 44 of 45 attacks at their initial
phases thus confining the blast radius, if any.

  * •

Security ought to expand beyond the paradigm of prevention to recovery. This
is more attuned to the ever-evolving dynamic threat landscape. The need to do
so has been recognised earlier as well. For example, _back-up_ is recommended
as a complementary good practice in CE guidance to small businesses.

  * •

We find synergy between our recommendations with those from prior work in this
area. Logging & monitoring and human factors are among the common
recommendations. Our results show the importance safe software deployment
defaults along with safe design defaults.

  * •

Security controls around human factors are difficult to measure and thus
difficult to include as CE controls. We would like to build upon insights from
human centered security research over the last few decades. Systems that fail
to evolve with human needs are not only difficult to use but fail to meet the
legitimate security expectations of their users.

## References

  * [1] R Anderson, C Barton, R Bohme, R Clayton, C Gañán, T Grasso, Michael Levi, T Moore, and Marie Vasek.  Measuring the changing cost of cybercrime.  01 2019.
  * [2] Ross Anderson, Chris Barton, Rainer Böhme, Richard Clayton, Michel J. G. van Eeten, Michael Levi, Tyler Moore, and Stefan Savage.  Measuring the Cost of Cybercrime.  2013\.
  * [3] Bill Brenner.  Wannacry: the ransomware worm that didn’t arrive on a phishing hook, 2017.  Accessed 30th March 2023.
  * [4] Miguel Castro and Barbara Liskov.  Practical byzantine fault tolerance and proactive recovery.  ACM Transactions on Computer Systems (TOCS), 20(4):398–461, 2002.
  * [5] National Cyber Security Centre.  Cyber Essentials: Requirements for IT infrastructure V3.0.  https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-for-Infrastructure-v3-0-January-2022.pdf, 2022.
  * [6] Partha Das Chowdhury, Maria Sameen, Jenny Blessing, Nicholas Boucher, Joseph Gardiner, Tom Burrows, Ross Anderson, and Awais Rashid.  Threat models over space and time: A case study of e2ee messaging applications.  arXiv preprint arXiv:2301.05653, 2023.
  * [7] CW Johnson.  A handbook of incident and accident reporting.  Cité dans la, 115, 2003.
  * [8] Barbara Johnstone.  Discourse analysis.  John Wiley & Sons, 2017.
  * [9] Christos Karapapas, Iakovos Pittaras, Nikos Fotiou, and George C Polyzos.  Ransomware as a service using smart contracts and ipfs.  In 2020 IEEE International Conference on Blockchain and Cryptocurrency (ICBC), pages 1–5. IEEE, 2020.
  * [10] Gary McGraw.  Software assurance for security.  Computer, 32(4):103–105, 1999.
  * [11] Sergio Pastrana and Guillermo Suarez-Tangil.  A first look at the crypto-mining malware ecosystem: A decade of unrestricted wealth.  In Proceedings of the Internet Measurement Conference, pages 73–86, 2019.
  * [12] Awais Rashid, Howard Chivers, Emil Lupu, Andrew Martin, and Steve Schneider (eds.).  Cyber Security Body of Knowledge Version 1.1.0, 2021.
  * [13] Awais Rashid, Syed Asad Ali Naqvi, Rajiv Ramdhany, Matthew Edwards, Ruzanna Chitchyan, and M. Ali Babar.  Discovering "Unknown Known" Security Requirements.  In Proceedings of the 38th International Conference on Software Engineering, ICSE ’16, page 866–876. Association for Computing Machinery, 2016.
  * [14] Jerome H Saltzer and Michael D Schroeder.  The protection of information in computer systems.  Proceedings of the IEEE, 63(9):1278–1308, 1975.
  * [15] Blake E Strom, Andy Applebaum, Doug P Miller, Kathryn C Nickels, Adam G Pennington, and Cody B Thomas.  Mitre att&ck: Design and philosophy.  In Technical report. The MITRE Corporation, 2018.
  * [16] Jose M. Such, Pierre Ciholas, Awais Rashid, John Vidler, and Timothy Seabrook.  Basic cyber hygiene: Does it work?  Computer, 52(4):21–31, 2019.
  * [17] Jose M. Such, John Vidler, T. Seabrook, and Awais Rashid.  Cyber security controls effectiveness:a qualitative assessment of cyber essentials.  Lancaster University, 2015.
  * [18] Microsoft Defender Security Research Team.  New ransomware, old techniques: Petya adds worm capabilities.  https://www.microsoft.com/en-us/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/?source=mmpc, 2017.
  * [19] Faheem Ullah, Matthew Edwards, Rajiv Ramdhany, Ruzanna Chitchyan, M Ali Babar, and Awais Rashid.  Data exfiltration: A review of external attack vectors and countermeasures.  Journal of Network and Computer Applications, 101:18–54, 2018.

##  Appendix A Over Controls Utilised to Inhibit Attack Pathways of an IFT for
Each Cases

Figure 13: Overall CE and AC Controls utilised in all 45 corpus of cyber
incidents

  *[IFT]: Incident Fault Tree
  *[CE]: Cyber Essentials
  *[AC]: Additional Controls
  *[TTP]: Tactic Techniques and Procedures
  *[VE]: Vulnerability Exploitation
  *[IFTs]: Incident Fault Tree


# Tractor beams with optimal pulling force using structured waves

Michael Horodynski<EMAIL_ADDRESS>Tobias Reiter  Matthias
Kühmayer  Stefan Rotter  Institute for Theoretical Physics, Vienna University
of Technology (TU Wien), A-1040 Vienna, Austria

###### Abstract

Moving objects with optical or acoustical waves is a topic both of fundamental
interest and of importance for a range of practical applications. One
particularly intriguing example is the tractor beam, which pulls an object
toward the wave’s source, in opposition to the wave’s momentum. In this study,
we introduce a protocol that enables the identification of wave states that
produce the optimal tractor force for arbitrary objects. Our method relies
solely on the solution of a simple eigenvalue problem involving the system’s
measurable scattering matrix. Using numerical simulations, we demonstrate the
efficacy of this wavefront shaping protocol for a representative set of
different targets. Moreover, we show that the diffractive nature of waves
enables the possibility of a tractor beam, that works even for targets where a
geometric optics approach fails to explain the pulling forces.

The widespread implementation of wave shaping tools in optics and acoustics
has allowed researchers to create waves with a diverse set of interesting and
often counter-intuitive properties [1, 2, 3, 4, 5]. These properties include
propagation through complex media [6, 7] and focusing inside and behind
disordered materials [8, 9], self-bending-airy beams [10], optical tweezers
[11, 12, 13] and radiation pressure cooling [14, 15], to name just a few.
Especially in the field of micromanipulation, the controlled movement of
objects has been implemented with a remarkable level of efficiency. One
particular example of this is the demonstration of a volumetric display using
acoustic trapping [16]. Another is a study in which the authors demonstrate
ultrasound beams that can levitate and steer solid objects in the urinary
bladders of live pigs [17]. A special class of wave-states that has received
significant attention in this regard are the so-called tractor beams, which
pull objects towards their source despite the wave’s momentum being oriented
in the opposite direction [18, 19, 20, 21].

These tractor beams have meanwhile been studied theoretically and
experimentally both in the acoustic and optical domains. In the Rayleigh
regime of scattering (target much smaller than the wavelength), studies were
carried out that identify wave-states that pull particles towards their source
by carefully balancing the intensity gradient and phase gradient force [22,
23]. So far, however, tractor beams for extended objects have only been
generated through numerical optimization of the wavefront [24], heuristic
design of the object and the wavefront [25, 26, 27], and by exploiting
chirality [28, 29]. The most difficult situation is when the object has
Dirichlet boundary conditions since then waves perfectly bounce off it. So far
this has been avoided by, e.g., including absorptive elements in the target
[25]. Recently, evidence has emerged that not the design of the object but
optimization of the incoming wavefront is the larger lever in light-matter
interaction [30]. This is especially important since restricting tractor beams
to only a small subset of engineered objects would be a considerable
limitation. Thus, to fully unlock the power of tractor beams, an operational
and practically implementable procedure is required to identify the optimal
wavefront for pulling any given object to the wave source.

Figure 1: Illustration of the concept. In the circular scattering region of
radius $R=20\lambda$, we place the object on which to exert pulling forces at
a distance $d$ to the wave source. We restrict the corresponding region from
which we generate waves to one-quarter of the circular boundary. Outgoing
boundary conditions are implemented by a perfectly matched layer surrounding
the scattering region (not pictured).

In this paper, we present such an approach that allows us to find tailor-made
optimal wavefronts providing the best possible pulling force. Generally
speaking, we compute the applied force on a target by considering an operator
that maps the incoming wave field (typically given as a vector of modal
amplitudes) to the applied force [31, 30]. This approach has the advantage
that the optimal wavefront for maximal pulling (or pushing) is simply the
eigenvector of this operator associated with the largest (or smallest)
eigenvalue of the operator. The operator we use here is the generalized
Wigner-Smith (GWS) operator, which has been introduced for optimal focusing
[32] and has meanwhile been applied for micromanipulation [33, 34],
information retrieval [35] and inverse design [36]. For the case at hand,
where we are interested in moving an object towards the wave source (chosen
here to coincide with the positive $x$-direction), this operator $Q_{x}$,
evaluated in an appropriately chosen basis of in- and outgoing far-field
modes, satisfies the following eigenvalue equation

$\displaystyle
Q_{x}\ket{u}=\left(K^{\mathrm{in}}_{x}-S^{\dagger}K^{\mathrm{out}}_{x}S\right)\ket{u}=\theta_{x}\ket{u},$
(1)

where $S$ is the system’s scattering matrix (in our case describing the
scattering off a target in free space) and $K^{\mathrm{in}}_{x}$
($K^{\mathrm{out}}_{x}$) is the operator that allows for the computation of
the incoming (outgoing) wavefront’s momentum in $x$-direction (the direction
in which we want to push/pull). It is then easy to see that $Q_{x}$ measures
the difference between the incoming and outgoing momentum of the wave. Due to
momentum conservation, this difference is then applied to the target [32, 37].
The advantage of using the GWS operator instead of other approaches like the
optical eigenmode approach [38] is, that it only requires far-field
information (the $S$-matrix), while the optical eigenmodes need a relation
between far-field and near field in the target plane. We can understand Eq.
(1) not only as the difference between incoming and outgoing momenta as
measured by $K_{x}^{\mathrm{in}}$ and $K_{x}^{\mathrm{out}}$, but also as an
infinitesimal shift of the scattering matrix (since
$Q_{x}=-\mathrm{i}S^{\dagger}\partial_{x}S$) [32]. This has the consequence
that $Q_{x}$ can not only be evaluated by shifting the target (to determine
the derivative $\partial_{x}$) but also by shifting the spatial light
modulator (SLM) or transducer array used to shape the incoming wave (akin to
the equivalence between active and passive transformations).

To demonstrate our approach for constructing optimal tractor beam states, we
first compute a unitary scattering matrix (for which the GWS operator is
Hermitian, hence the eigenstate corresponding to the most positive eigenvalue
then describes the input field of the optimal tractor beam). Since procedures
for how to set up this scattering matrix in an appropriate basis (in free
space) don’t seem to be available in the literature, we present a
comprehensive description of our solution in the following, with the details
being available in Appendix A and the code being published alongside this work
[39]. Restricting our analysis to two spatial dimensions, our starting point
is the scalar Helmholtz equation in polar coordinates,
$[\Delta+k^{2}\varepsilon(\vec{r})]\psi(\vec{r})=0$, in a circular region (see
Fig. 1), which we solve numerically using an open-source finite-element method
(NGSolve) [40, 41]. Here $\Delta$ is the Laplacian in polar coordinates, $k$
is the wavenumber, $\varepsilon(\vec{r})$ is the spatially varying dielectric
constant, $\psi(\vec{r})$ is the scalar wave and $\vec{r}=(\rho,\varphi)^{T}$
is the position vector.

Figure 2: (a) Sketches of the targets used, which are a dielectric triangle
(green) and 2 targets with Dirichlet boundary conditions: a triangle (blue)
and a rectangle (orange). The black arrows mark the momentum of the incoming
and scattered waves and the gray arrow is the resulting momentum transfer onto
the target. Both the width of the triangles as well as their height measure
$2\lambda$. The height of the rectangle is equal to $1\lambda$ and the width
is $2\lambda$. The incoming waves impinge onto the targets from the right
(yellow arrow). (b) Intensity distribution of the optimal tractor beam for the
dielectric triangle (left) and the triangle with hard walls (right) at a
distance of $d=20\lambda$ to the source. (c) The pulling force resulting from
the optimal wave state for each distance over the distance from the source for
the targets depicted in (a). Additionally, we also consider a rectangle with a
width of $12\lambda$ (dashed violet line). The inset details the results at
large distances from the source (marked by the dashed black line). Figure 3:
Diffraction forces on a rectangle. (a) Distribution of the pulling force
around the rectangle with Dirichlet boundary conditions at a distance of
$d=8\lambda$ to the source. (1) and (3) are the sides orthogonal to the
pulling direction while (2) is facing towards and (4) is facing away from the
source. The force, mainly located on the corners of side (4), is stronger
there, resulting in a tractor beam. (b) Pulling force depending on the
rounding radius for different distances from the source. The pulling force is
normalized for each distance separately by its value at a rounding radius of
zero.

The fundamental solutions of the Helmholtz equation in the radial direction
are Bessel functions of the first and second kind. From them, we can form by
linear combination the Hankel functions of the first and second kind,
representing outgoing and incoming waves in polar coordinates. The
contribution of the angular variable $\varphi$ is given by $e^{im\varphi}$,
where $m$ numbers the mode. The unitary scattering matrix of the system is
then computed by the following integral containing the numerical solution of
the Helmholtz equation ($\psi_{n}$) resulting from a given input mode:
$S_{mn}=\int_{0}^{2\pi}\frac{e^{\mathrm{i}m\varphi}\psi_{n}}{2\pi
H^{(1)}_{m}(kR)}\mathrm{d}\varphi-\frac{H^{(2)}_{n}(kR)}{H^{(1)}_{n}(kR)}\delta_{m,-n}$.
The fundamental solution of the Helmholtz equation also allows us to construct
the incoming modes of this geometry as
$\chi^{\mathrm{in}}_{n}=e^{\mathrm{i}n\varphi}H^{(2)}_{n}(k\rho)/(\sqrt{2\pi}|H^{(2)}_{n}(kR)|)$.
Equipped with this basis we compute the elements of $K^{\mathrm{in}}_{x}$ by
$[K^{\mathrm{in}}_{x}]_{mn}=-i\int_{0}^{2\pi}\mathrm{d}\varphi(\chi^{\mathrm{in}}_{m})^{*}\partial_{x}\chi^{\mathrm{in}}_{n}$
and we note that $K^{\mathrm{out}}_{x}=K^{\mathrm{in}}_{x}$.

In the rest of the paper, we fix the wavelength to $\lambda=R/20$, where $R$
is the radius of the scattering region. We also restrict the region from which
we can send waves onto the target to a quarter of the scattering boundary
(corresponding to a solid angle of $\pi/2$) so that all incoming waves have
momentum directed opposite to the direction in which we want to pull the
target. We do this by first transforming the GWS operator from the modal basis
into the eigenbasis of the angle $\varphi$, which we get by solving the
eigenvalue problem of the corresponding operator:
$[\phi]_{mn}=\int_{0}^{2\pi}\mathrm{d}\varphi(\chi^{\mathrm{in}}_{m})^{*}\varphi\chi^{\mathrm{in}}_{n}$.
The eigenstates of $\phi$ are incoming waves that best approximate a point
source at some location on the boundary, while also providing an orthogonal
and complete basis. Expressing any state in this angular eigenbasis of this
operator thus gives us the angular distribution of the state along the
boundary of the scattering region. In this basis, we then only select
contributions that lie within the allowed input aperture. We note here, that
this only limits the angle in which we send waves into the system, but we
still record all scattered waves. This procedure keeps the hermiticity of
$Q_{x}$ such that we find the globally optimal tractor beam for a restricted
input angle.

To show the power of the presented tool, we consider a representative set of
targets: First, a dielectric triangle (refractive index $n=1.44$), where our
calculations show that a focus on the target’s front will execute an efficient
pulling force by drawing the target to regions with higher intensity (see Fig.
2a for an illustration of the concept and Fig. 2b for the intensity
distribution of the optimal tractor beam). Second, the already more
challenging case of a triangle with fully reflecting boundary conditions
(“hard walls”) is considered. Here, an intuitive ray optics picture suggests
that optical pulling forces can be implemented by rays bouncing off the
slanted sides of the triangle, such that their redirection results in a
momentum transfer that pulls the target to the rays’ source [42, 25] (see Fig.
2a for an illustration of the concept and Fig. 2b for the intensity
distribution of the optimal tractor beam, which shows an appropriate
redirection of the beams). Third, we consider the case of rectangles with hard
walls of varying widths which presents a counter-intuitive scenario in the
sense that optical pulling forces cannot be understood through ray optics.
This is because all rays that are reflected from those sides of the rectangle,
which are in a line of sight with the SLM or transducer array, can only result
in pushing the rectangle away or in causing lateral displacement.
Nevertheless, leveraging the full interferometric nature, e.g., of
electromagnetic or acoustic waves, our approach still finds the incoming state
that exerts the maximal pulling force by an appropriate redirection of the
incoming wave through diffraction at the rectangle’s corners (see Fig. 2a for
the illustration and Fig. 1 for the intensity distribution which showcases the
redirection of the wave).

Figure 4: Performance of a static tractor beam for different maximal distances
of the object (color scale). Depicted is the potential as a function of the
distance $d$. In all cases, $d_{\mathrm{min}}=2\lambda$ and the distance
between two evaluation points of $Q_{x}$ is $\lambda/2$, i.e.
$d_{i+1}-d_{i}=\lambda/2$. The insets enlarge the area marked by the dashed
rectangle and show local minima of the potential in which targets could get
stuck.

To elucidate this behavior, we first look at the force density over the
boundary of the rectangle. Fig. 3a clearly shows that the majority of the
force is applied very close to the rectangle’s corners, suggesting that
diffraction at these corners is responsible for the emergence of optical
pulling forces. To further corroborate this statement, we show in Fig. 3b the
strength of the optical pulling force as a function of how much we round the
sharp corners of a rectangle. We discover that at short distances to the
source, rectangles with a large rounding radius allow for a stronger pulling
force than rectangles with sharp corners, while for long distances this effect
is reversed, i.e., sharp corners allow the largest pulling forces. We
attribute this behavior to the ease with which waves can focus at short
distances at the corners’ backside allowing us to employ the intuitive picture
of specularly reflected rays at the corners on the distal end of the
rectangle, instead of a more complicated wave-based explanation relying on
diffraction. For longer distances, such a focus is harder to achieve and in
this case, the pulling force is induced by wave diffraction – which is more
pronounced at sharp corners of the rectangle’s corners.

In Fig. 2c we show the maximal pulling force for all of the individual
targets, evaluated at different distances to the origin. The depicted
simulation results confirm our intuition from above in the sense that the
pulling force for the dielectric target decays the slowest with increasing
distance. For the targets with hard walls, the slowest decay is observed for
the triangle, while the wider rectangle shows the fastest decay –
demonstrating at the same time that a narrowing numerical aperture is
detrimental to the strength of optical pulling forces.

So far we have discussed tractor beams optimized for each distance of the
object to the source individually. Thus, to pull a target closer to the
source, the incoming wave has to continuously change. This is akin to optical
conveyor beams, which can not only trap an object but also pull them in by
changing the phase of the beam [43]. In the following, we also demonstrate
that wavefront shaping allows for the creation of a “static” tractor beam,
which exerts a pulling force on the target irrespective of its current
distance from the source. This static tractor beam only requires a single
unchanging pattern on the SLM. We find this wavefront by considering the
eigenstates of the following operator

$Q_{x}^{\mathrm{cont}}=\sum_{d_{\mathrm{min}}}^{d_{\mathrm{max}}}\frac{1}{\theta_{\mathrm{max}}\left(d_{i}\right)}Q_{x}\left(d_{i}\right),$
(2)

which is the sum of all GWS operators, spaced by some distance along the way,
weighted with their maximal eigenvalues (i.e., the one that indicates the
maximal strength of the pulling force). By $d_{\mathrm{min}}$
($d_{\mathrm{max}}$) we denote the minimal (maximal) distance to the source we
consider. We also note here that the distance between the points in space at
which two adjacent GWS operators are evaluated is evenly spaced. The weighted
sum is used because otherwise, the GWS operators at short distances would
dominate since at short distances the applied pushing and pulling forces are
much stronger (see Fig. 2c). In Fig. 4 we show the performance of the static
tractor beam found by solving the eigenvalue problem of
$Q_{x}^{\mathrm{cont}}$. We see that with this protocol it is indeed possible
to construct a static tractor beam for different targets (such as for the
triangle and rectangle with hard walls as well as for the dielectric
triangle). We note that the potential created by the static tractor beam can
feature shallow local minima, in which that target could get trapped. However,
in the case of the rectangle, if it starts at an appropriate distance it can
garner enough energy to just roll over such a potential well.

We also compare different $d_{\mathrm{max}}$ to investigate how the
performance of a static tractor beam is affected by the maximal distance we
demand from it. Our simulations uncover that depending on which target we
consider, there is a different maximal distance for which our protocol finds a
static tractor beam. The best performance is found when considering the
dielectric triangle and the worst is when considering the triangle with hard
walls. This result is surprising since the triangle with hard walls exhibits a
greater range at which it is possible to engineer a tractor beam state
compared to the rectangle (see Fig. 2c).

We note here that Eq. (2) is not the only choice to find a static tractor beam
and we, therefore, tried two alternatives, which, however, did not surpass the
presented method in their performance: The first is to replace the division by
the extremal eigenvalue with a division by the trace of $Q_{x}$, which would
then give the optimal state for this particular weighted sum. The second is
formulating a (constrained) numerical optimization problem and solving it with
an appropriate numerical library. This gives us greater freedom in fixing the
properties of the wave state at the prize that the optimization problem will
be non-convex (because $Q_{x}$ is not positive definite) and thus the solution
will not be guaranteed to converge to the global optimum [44].

To conclude, we demonstrate a protocol that finds for arbitrary objects a
wavefront that exerts the optimal pulling force. We also uncover the
mechanisms responsible for the transfer of the tractor force and show in which
way they depend on the shape of the target. Furthermore, we propose a scheme
for a static tractor beam, i.e., a wave state resulting from an unchanging SLM
pattern that exerts a pulling force onto the target, irrespective of the
target’s distance from the wave source. An interesting open question building
on the insights presented here is the concurrent optimization of the wavefront
and of the object’s shape. Our approach would be ideally suited to investigate
this since it provides both the optimal wavefront as well as the gradient of
the cost function with respect to changes in the geometry [36].

The computational results were achieved using the Vienna Scientific Cluster
(VSC).

##  Appendix A Details of the numerical implementation

Figure 5: Properties of the $S$ matrix. (a) Spatial intensity distribution of
an incoming field in the fundamental mode ($n=0$) in a geometry consisting of
20 randomly placed Teflon scatterers ($\varepsilon=2.0736$) with radius
$0.33\lambda$. The radius of the scattering region is $R=4\lambda$, which
corresponds to 39 modes. (b) Absolute value of the scattering matrix entries
for the system depicted in (a). (c) Absolute value of the deviation from
unitarity ($S^{\dagger}S-\mathbbm{1}$). (d) Absolute value of the deviation
from transposition symmetry ($S^{T}-S$).

Here, we show how to construct a unitary scattering matrix for an open system
with a circular boundary in the framework of the finite-element tool NGSolve
[40, 41]. Our starting point is the most general solution of the Helmholtz
equation in polar coordinates containing propagating waves:

$\displaystyle\psi=\sum_{n\in\mathbb{Z}}\left[\alpha_{n}H_{n}^{(2)}(k\rho)+\beta_{n}H_{n}^{(1)}(k\rho)\right]\left(\gamma_{n}e^{\mathrm{i}n\varphi}+\delta_{n}e^{-\mathrm{i}n\varphi}\right),$
(3)

where outgoing and incoming waves are represented by the Hankel functions of
the first and second kind ($H^{(1)}_{n}$ and $H^{(2)}_{n}$), respectively,
since

$\displaystyle\Re\left[-\mathrm{i}{H^{(1,2)}_{n}}^{*}(k\rho)\partial_{\rho}H^{(1,2)}_{n}(k\rho)\right]$
$\displaystyle=\pm\frac{2}{\pi\rho}\;\forall n,\;\forall k\rho,$ (4)

where $\Re$ denotes taking the real part and we note here that the radial flux
is independent of $n$. This immediately gives us a complete and orthonormal
basis on which we can construct the scattering matrix. The only remaining task
is then to get every constant pre-factor in the numerical implementation and
computation of the $S$-matrix exactly right in order to have a flux-conserving
and thus unitary $S$-matrix, as well as an $S$-matrix that respects
transposition symmetry.

The first aspect of this task is to carefully look at the source term ($f$,
which we have omitted so far) in the Helmholtz equation:

$[\Delta+k^{2}\varepsilon(\vec{r})]\psi(\vec{r})=-f(\vec{r}).$ (5)

In the concrete implementation of this work $f$ is located along the circular
boundary of the scattering region, i.e.,
$f(\rho,\varphi)=\delta(\rho-R)h(\varphi)=\delta(\rho-R)\sum_{n}c_{n}e^{\mathrm{i}n\varphi}$,
where $c_{n}$ are the entries of a vector of modal amplitudes that describes
the incoming wave. We now want to fix $c_{n}$ to get excitations of the form

$\displaystyle\psi_{I}=$
$\displaystyle\sum_{n}a_{n}H^{(2)}_{n}(k\rho)e^{\mathrm{i}n\varphi}\;\mathrm{for}\;\rho<R,$
(6) $\displaystyle\psi_{O}=$
$\displaystyle\sum_{n}b_{n}H^{(1)}_{n}(k\rho)e^{\mathrm{i}n\varphi}\;\mathrm{for}\;\rho>R,$
(7)

where $\psi_{I}$ and $\psi_{O}$ represent waves inside and outside the
circular boundary that both propagate away from the source. We choose this
particular form of $\psi_{I}$ to have an isotropic source when considering
$|\psi_{I}|$. By demanding that $\psi_{I}(R)=\psi_{O}(R)$ (continuity of the
solution) we find that $a_{n}H^{(2)}_{n}(kR)=b_{n}H^{(1)}_{n}(kR)$. To connect
$a_{n}$ and $b_{n}$ to $c_{n}$ we then plug our particular form of the source
into the (vacuum) Helmholtz equation multiply it by $e^{-\mathrm{i}m\varphi}$
and integrate from $R-\epsilon$ to $R+\epsilon$ ($\epsilon$ being a small
number, which we later take to zero) and from $0$ to $2\pi$. This results in
$c_{n}=-4\mathrm{i}a_{n}/[\pi RH^{(1)}_{n}(kR)]$, which is central to the
computation of a unitary scattering matrix, since for a numerical solution of
Eq. (5) we get excitations of the form (6). There is also a second consequence
of the formula connecting the $a_{n}$’s and $c_{n}$’s: It imposes a
(heuristic) cutoff for the number of modes, since Hankel functions of constant
$kR$ but increasing $n$ increase in absolute value, such that for some $n$,
$c_{n}$ is effectively zero.

Equipped with the necessary knowledge of the source’s exact form, we can
obtain a unitary $S$-matrix from a numerical solution of the Helmholtz
equation ($\psi_{n}$) for an incoming cylindrical wave with amplitude one in
mode $n$:

$S_{mn}=\int_{0}^{2\pi}\frac{e^{\mathrm{i}m\varphi}\psi_{n}}{2\pi
H^{(1)}_{m}(kR)}\mathrm{d}\varphi-\frac{H^{(2)}_{n}(kR)}{H^{(1)}_{n}(kR)}\delta_{m,-n}.$
(8)

In the above formula, we project $\psi_{n}$ onto $e^{\mathrm{i}m\varphi}$,
since the outgoing channels are time-reversed incoming channels, i.e. the
complex conjugate of the incoming mode [31]. In order to correctly project
onto the outgoing channels ($e^{-\mathrm{i}m\varphi}$) we then need to complex
conjugate a second time. The factor in front of the integral in Eq. (8) is
placed to ensure the correct normalization in both phase and amplitude for
each element of $S$. It is, however, not a flux normalization factor, since
every mode we consider carries the same flux [see Eq. (4)]. In other words,
the weighing of different fluxes for different modes is not necessary. To
avoid including the incoming radiation in the computation of $S$, we must also
subtract from each element of the anti-diagonal (which are the elements of
$S_{mn}$ for which $m=-n$) the term $H^{(2)}_{n}(kR)/H^{(1)}_{m}(kR)$.

In Fig. 5 we plot a system of randomly placed scatterers and its associated
scattering matrix. We see that $S$ is unitary (since there is neither loss nor
gain present) and transposition symmetric up to the numerical error. These are
the fundamental symmetries of a scattering matrix [3], indicating that our
computation is correct. Fig. 5b also shows that for some incoming modes, the
non-zero elements of $S$ are located on the anti-diagonal. We also note that
when the system is empty, all non-zero elements of $S$ are located on the
anti-diagonal (not shown). This can be attributed to the fact that in an empty
system, the solution is given by
$\psi_{n}=[H^{(1)}_{n}(k\rho)+H^{(2)}_{n}(k\rho)]e^{\mathrm{i}n\varphi}=2J_{n}(k\rho)e^{\mathrm{i}n\varphi}$,
which cannot be expressed as the sum of the incoming and outgoing modes, as
doing so would violate the conservation of angular momentum.

Lastly, we also discuss the form of the basis state from which we can compute
any operator, like $\phi$ and $K_{x}$. Since the incoming waves are
represented by $e^{\mathrm{i}n\varphi}H^{(2)}_{n}(k\rho)$, the incoming modes
are given by

$\chi_{n}^{\mathrm{in}}=\frac{e^{\mathrm{i}n\varphi}H^{(2)}_{n}(k\rho)}{\sqrt{2\pi}|H^{(2)}_{n}(kR)|},$
(9)

where the terms in the denominator are necessary to have orthonormal modes at
$\rho=R$.

After computing the elements of $K_{x}^{\mathrm{in}}$ using
$\chi_{n}^{\mathrm{in}}$ and in turn constructing the GWS operator with them,
there is also secondary use for them: When we have computed the $S$-matrix for
an arbitrary object at an arbitrary position $x$ within the system we can
calculate the scattering matrix at a position shifted by $\Delta x$ by
considering [32]

$S(x+\Delta x)=e^{-\mathrm{i}K^{\mathrm{in}}_{x}\Delta
x}S(x)e^{\mathrm{i}K^{\mathrm{in}}_{x}\Delta x}.$ (10)

## References

  * Mosk  _et al._ [2012] A. P. Mosk, A. Lagendijk, G. Lerosey, and M. Fink, Nature Photonics 6, 283 (2012).
  * Bliokh  _et al._ [2023] K. Y. Bliokh, E. Karimi, M. J. Padgett, M. A. Alonso, M. R. Dennis, A. Dudley, A. Forbes, S. Zahedpour, S. W. Hancock, H. M. Milchberg, S. Rotter, F. Nori, S. K. Özdemir, N. Bender, H. Cao, P. B. Corkum, C. Hernandez-Garcia, H. Ren, Y. Kivshar, M. G. Silveirinha, N. Engheta, A. Rauschenbeutel, P. Schneeweiss, J. Volz, D. Leykam, D. A. Smirnova, K. Rong, B. Wang, E. Hasman, M. F. Picardi, A. V. Zayats, F. J. Rodriguez-Fortuno, C. Yang, J. Ren, A. B. Khanikaev, A. Alù, E. Brasselet, M. Shats, J. Verbeeck, P. Schattschneider, D. Sarenac, D. G. Cory, D. Pushin, M. Birk, A. Gorlach, I. Kaminer, F. Cardano, L. Marrucci, M. Krenn, and F. Marquardt, Roadmap on structured waves (2023), arXiv:2301.05349 [physics, physics:quant-ph].
  * Rotter and Gigan [2017] S. Rotter and S. Gigan, Reviews of Modern Physics 89, 015005 (2017).
  * Cao  _et al._ [2022] H. Cao, A. P. Mosk, and S. Rotter, Nature Physics 18, 994 (2022).
  * Gigan  _et al._ [2022] S. Gigan, O. Katz, H. B. de Aguiar, E. R. Andresen, A. Aubry, J. Bertolotti, E. Bossy, D. Bouchet, J. Brake, S. Brasselet, Y. Bromberg, H. Cao, T. Chaigne, Z. Cheng, W. Choi, T. Čižmár, M. Cui, V. R. Curtis, H. Defienne, M. Hofer, R. Horisaki, R. Horstmeyer, N. Ji, A. K. LaViolette, J. Mertz, C. Moser, A. P. Mosk, N. C. Pégard, R. Piestun, S. Popoff, D. B. Phillips, D. Psaltis, B. Rahmani, H. Rigneault, S. Rotter, L. Tian, I. M. Vellekoop, L. Waller, L. Wang, T. Weber, S. Xiao, C. Xu, A. Yamilov, C. Yang, and H. Yılmaz, Journal of Physics: Photonics 4, 042501 (2022).
  * Gérardin  _et al._ [2014] B. Gérardin, J. Laurent, A. Derode, C. Prada, and A. Aubry, Physical Review Letters 113, 173901 (2014).
  * Sarma  _et al._ [2016] R. Sarma, A. G. Yamilov, S. Petrenko, Y. Bromberg, and H. Cao, Physical Review Letters 117, 086803 (2016).
  * Horstmeyer  _et al._ [2015] R. Horstmeyer, H. Ruan, and C. Yang, Nature Photonics 9, 563 (2015).
  * Vellekoop and Mosk [2007] I. M. Vellekoop and A. P. Mosk, Optics Letters 32, 2309 (2007).
  * Efremidis and Christodoulides [2010] N. K. Efremidis and D. N. Christodoulides, Optics Letters 35, 4045 (2010).
  * Ashkin  _et al._ [1986] A. Ashkin, J. M. Dziedzic, J. E. Bjorkholm, and S. Chu, Optics Letters 11, 288 (1986).
  * Block  _et al._ [1990] S. M. Block, L. S. B. Goldstein, and B. J. Schnapp, Nature 348, 348 (1990).
  * Būtaitė  _et al._ [2019] U. G. Būtaitė, G. M. Gibson, Y.-L. D. Ho, M. Taverne, J. M. Taylor, and D. B. Phillips, Nature Communications 10, 1215 (2019).
  * Magrini  _et al._ [2021] L. Magrini, P. Rosenzweig, C. Bach, A. Deutschmann-Olek, S. G. Hofer, S. Hong, N. Kiesel, A. Kugi, and M. Aspelmeyer, Nature 595, 373 (2021).
  * Hüpfl  _et al._ [2023] J. Hüpfl, N. Bachelard, M. Kaczvinszki, M. Horodynski, M. Kühmayer, and S. Rotter, Physical Review A 107, 023112 (2023).
  * Hirayama  _et al._ [2019] R. Hirayama, D. Martinez Plasencia, N. Masuda, and S. Subramanian, Nature 575, 320 (2019).
  * Ghanem  _et al._ [2020] M. A. Ghanem, A. D. Maxwell, Y.-N. Wang, B. W. Cunitz, V. A. Khokhlova, O. A. Sapozhnikov, and M. R. Bailey, Proceedings of the National Academy of Sciences 117, 16848 (2020).
  * Chen  _et al._ [2011] J. Chen, J. Ng, Z. Lin, and C. T. Chan, Nature Photonics 5, 531 (2011).
  * Novitsky  _et al._ [2011] A. Novitsky, C.-W. Qiu, and H. Wang, Physical Review Letters 107, 203601 (2011).
  * Brzobohatý  _et al._ [2013] O. Brzobohatý, V. Karásek, M. Šiler, L. Chvátal, T. Čižmár, and P. Zemánek, Nature Photonics 7, 123 (2013).
  * Li  _et al._ [2020] H. Li, Y. Cao, L.-M. Zhou, X. Xu, T. Zhu, Y. Shi, C.-W. Qiu, and W. Ding, Advances in Optics and Photonics 12, 288 (2020).
  * Yevick  _et al._ [2016] A. Yevick, D. B. Ruffner, and D. G. Grier, Physical Review A 93, 043807 (2016).
  * Abdelaziz and Grier [2020] M. A. Abdelaziz and D. G. Grier, Physical Review Research 2, 013172 (2020).
  * Marzo  _et al._ [2015] A. Marzo, S. A. Seah, B. W. Drinkwater, D. R. Sahoo, B. Long, and S. Subramanian, Nature Communications 6, 8661 (2015).
  * Démoré  _et al._ [2014] C. E. Démoré, P. M. Dahl, Z. Yang, P. Glynne-Jones, A. Melzer, S. Cochran, M. MacDonald, and G. C. Spalding, Physical Review Letters 112, 174302 (2014).
  * Shvedov  _et al._ [2014] V. Shvedov, A. R. Davoyan, C. Hnatovsky, N. Engheta, and W. Krolikowski, Nature Photonics 8, 846 (2014).
  * Li  _et al._ [2019] X. Li, J. Chen, Z. Lin, and J. Ng, Science Advances 5, eaau7814 (2019).
  * Ding  _et al._ [2014] K. Ding, J. Ng, L. Zhou, and C. T. Chan, Physical Review A 89, 063825 (2014).
  * Fernandes and Silveirinha [2015] D. E. Fernandes and M. G. Silveirinha, Physical Review A 91, 061801 (2015).
  * Kuang  _et al._ [2020] Z. Kuang, L. Zhang, and O. D. Miller, Optica 7, 1746 (2020).
  * Liu  _et al._ [2019] Y. Liu, L. Fan, Y. E. Lee, N. X. Fang, S. G. Johnson, and O. D. Miller, ACS Photonics 6, 395 (2019).
  * Ambichl  _et al._ [2017] P. Ambichl, A. Brandstötter, J. Böhm, M. Kühmayer, U. Kuhl, and S. Rotter, Physical Review Letters 119, 033903 (2017).
  * Horodynski  _et al._ [2020] M. Horodynski, M. Kühmayer, A. Brandstötter, K. Pichler, Y. V. Fyodorov, U. Kuhl, and S. Rotter, Nature Photonics 14, 149 (2020).
  * Būtaitė  _et al._ [2023] U. G. Būtaitė, C. Sharp, M. Horodynski, G. M. Gibson, M. J. Padgett, S. Rotter, J. M. Taylor, and D. B. Phillips, Photon-efficient optical tweezers via wavefront shaping (2023), arXiv:2304.12848 [physics].
  * Bouchet  _et al._ [2021] D. Bouchet, S. Rotter, and A. P. Mosk, Nature Physics 17, 564 (2021).
  * Horodynski  _et al._ [2022] M. Horodynski, M. Kühmayer, C. Ferise, S. Rotter, and M. Davy, Nature 607, 281 (2022).
  * Strasser  _et al._ [2021] F. Strasser, S. Moser, M. Ritsch-Marte, and G. Thalhammer, Optica 8, 79 (2021).
  * Mazilu  _et al._ [2011] M. Mazilu, J. Baumgartl, S. Kosmeier, and K. Dholakia, Optics Express 19, 933 (2011).
  * Horodynski  _et al._ [2023] M. Horodynski, T. Reiter, M. Kühmayer, and S. Rotter, Open Scattering Systems (2023).
  * Schöberl [1997] J. Schöberl, Computing and Visualization in Science 1, 41 (1997).
  * Schöberl [2014] J. Schöberl,  _C++11 Implementation of Finite Elements in NGSolve_ , ASC Report (Institute for Analysis and Scientific Computing, Vienna University of Technology, 2014).
  * Sukhov and Dogariu [2011] S. Sukhov and A. Dogariu, Physical Review Letters 107, 203602 (2011).
  * Ruffner and Grier [2012] D. B. Ruffner and D. G. Grier, Physical Review Letters 109, 163903 (2012).
  * Boyd and Vandenberghe [2004] S. P. Boyd and L. Vandenberghe,  _Convex optimization_ (Cambridge University Press, Cambridge, UK ; New York, 2004).