Research Questions and Method

This conceptual research article develops a normative and operational model by synthesizing established cybersecurity guidance, cyber-resilience engineering, defensive deception scholarship, forensic evidence practice, and legal commentary on active cyber defense. The purpose is to clarify what defenders may do during an active intrusion without collapsing into unauthorized retaliation.

• RQ1: How can organizations define cyber self-defense during active intrusion without authorizing hack-back or extra-perimeter retaliation?
• RQ2: How can defensive deception improve detection, containment, and attribution while remaining ethical, privacy-aware, and legally reviewable?
• RQ3: What governance controls and operational metrics are needed to make active defense auditable and suitable for organizational adoption?

The Bounded Cyber Self-Defense Model

The paper defines cyber self-defense as a disciplined, evidence-centered, and legally bounded posture. It rejects hack-back and retaliation, emphasizing instead a structured defensive window triggered by confirmed unauthorized activity. Within this window, defenders may execute pre-authorized containment, deception, evidence preservation, and recovery actions inside systems they own or are authorized to protect.

1. Govern: establish authority, legal review, ethics guardrails, executive accountability, and response thresholds before active intrusion.
2. Prevent: establish governance, identity controls, segmentation, backups, and pre-authorized response pathways before intrusion.
3. Detect: monitor identity abuse, lateral movement, cloud control-plane activity, and evidence of unauthorized persistence.
4. Contain: isolate hosts, revoke credentials, restrict egress, reroute suspicious sessions, and preserve volatile evidence.
5. Attribute: build evidence-based confidence using technical artifacts, timelines, infrastructure relationships, and provider coordination.
6. Recover: restore trustworthy operations, verify backups, remove persistence, and feed lessons back into system design.
7. Improve: convert lessons learned into updated controls, playbooks, resilience tests, and governance decisions.

Defensive Deception as Lawful Self-Defense

Defensive deception can be legitimate when it protects users and systems, detects unauthorized access, delays adversary progress, and preserves evidence. It becomes problematic when it seeks humiliation, intimidation, unauthorized tracking, false threats, or manipulation outside the defender's authority. The framework treats deception as a controlled defensive instrument, not a punitive or retaliatory practice.

Ethics and Authority Boundaries

The model asks whether each defensive action is authorized, proportionate, reversible where feasible, auditable, privacy-aware, and aligned to harm reduction. It explicitly rejects revenge, doxing, harassment, unauthorized surveillance, malware deployment outside the defender's environment, and punitive engagement after the intrusion is over.

Contents

1. Introduction
2. Research Questions and Method
3. Literature Review
4. The Bounded Cyber Self-Defense Model
5. Defensive Deception as Lawful Self-Defense
6. Governance, Ethics, Evidence, and Validation Criteria