Cyber Key Terrain: Mission and Dependency Mapping Guide

Use a mission-dependent definition of key terrain

In military usage, key terrain is a feature whose control provides a marked advantage. In cyberspace, the feature may be physical, logical, geographic, supervisory, or tied to a cyber persona. The Army Cyber Institute key-terrain framework emphasizes that key terrain can exist across several planes and can support both offensive and defensive analysis.

The adjective “key” is always followed by an unstated question: key to which mission, actor, time window, and scenario? A federation service may be decisive for remote command but irrelevant to a manual safety process. A backup console may become key only after production systems fail. A supplier portal may be an adversary avenue of approach even though it is not owned by the mission organization.

Write a defensible statement: “Control of feature X during condition Y enables or prevents mission function Z because of dependency A; alternatives B and C provide these limitations.” This forces analysts to name the advantage and test substitutes. A list of crown jewels is useful inventory work, but it becomes cyber key terrain only when connected to mission and adversary reasoning.

Map the mission before mapping technology

Convene the people who operate, secure, restore, supply, and authorize the mission. Describe the essential output in operational language: dispatch ambulances, authenticate command messages, maintain water pressure, clear payments, or publish trusted warnings. Define acceptable degradation, maximum outage, safety limits, manual mode, and the decision owner. Only then trace the enabling information and technology.

Follow each function through data creation, processing, transport, storage, identity, administration, time, name resolution, cloud control, communications, power, facilities, vendors, and workforce. Note trust boundaries and jurisdiction. The CISA Infrastructure Dependency Primer distinguishes physical, geographic, cyber, and logical dependencies and warns that interdependencies can create cascading effects.

Use interviews and observation, not diagrams alone. Ask an operator to perform the task and a recovery lead to explain restoration from a cold start. Compare the answers with architecture, inventories, configuration, contracts, and telemetry. Undocumented spreadsheets, personal devices, shared administrator accounts, licensing services, or vendor remote access often determine real mission performance. Mark every inferred dependency and assign validation.

Score terrain by advantage, dependency, and substitutability

Do not reduce key-terrain analysis to an unexplained risk score. Use structured dimensions: mission consequence if lost or manipulated; advantage gained by an adversary; breadth of downstream dependency; time sensitivity; uniqueness; availability and realism of substitutes; recoverability; observability; and ownership. State whether each value is measured, documented, elicited, or inferred.

Scenario changes the result. During normal operations, the primary identity platform may dominate. During isolation, local credentials, radio communications, paper procedures, and the authority to invoke manual mode may become decisive. During recovery, clean backups, signing keys, golden configurations, vendor expertise, and trusted communications can be more important than the production server itself. Map terrain for steady state, degradation, and restoration.

Validate by exercising loss and manipulation, not only availability. Ask whether the mission detects subtly altered data, forged identity, delayed time, or a configuration that remains syntactically valid but unsafe. Rank terrain only after recording the causal explanation. The score helps allocate attention; the narrative allows a commander, engineer, or auditor to challenge the logic.

Add the adversary and avenues of approach

A defensive dependency map describes what the mission needs. Key-terrain analysis adds what an adversary can exploit, control, observe, deny, or manipulate. Build plausible approaches through internet-facing systems, suppliers, identity federation, remote administration, telecommunications, physical access, insiders, and recovery processes. Include the adversary’s likely constraints and required sequence.

Map observation and concealment. Which sensors can see activity near the terrain? Which legitimate tools or encrypted paths obscure it? Which administrative events lack an accountable person? Identify obstacles such as segmentation, multi-person approval, allowlisting, safety interlocks, and out-of-band verification. Then ask how the adversary might bypass each one and what evidence that attempt would leave.

Cyber pre-positioning is particularly important because an actor may already occupy a useful approach without producing the feared effect. Link known or plausible access to the actual mission graph. This prevents two errors: assuming all access is decisive, and dismissing quiet access because no disruption has occurred. Priority follows from access, mission leverage, and scenario together.

Use the map to prioritize defence and campaign design

Convert each key-terrain judgment into controls and decisions. Assign an owner; strengthen identity and configuration integrity; place telemetry at decisive boundaries; reduce unnecessary paths; protect documentation; test isolation; pre-stage replacement equipment; and rehearse restoration. Where a third party owns the dependency, establish evidence-sharing, emergency contact, service-level, and continuity arrangements before crisis.

For cyber campaign design, the same map supports target-system analysis but does not authorize action. It reveals functions, alternatives, co-use, likely propagation, and intelligence gaps. Legal review, civilian protection, partner caveats, proportionality where applicable, and operational risk remain separate gates. The map should explicitly flag shared civilian services and reverberating effects so apparent technical precision is not mistaken for bounded consequence.

Measure defensive improvement in mission terms. Useful metrics include time to detect change on a key identity, time to isolate a provider path, percentage of decisive dependencies with independent telemetry, restoration time under credential compromise, and proportion of assumptions tested in exercises. Vulnerability counts alone cannot show whether the mission survives.

Produce a versioned key-terrain dossier

The dossier should contain mission statement and tolerance; scenarios and time horizons; dependency graph; key-terrain claims with rationale; owners and jurisdictions; adversary approaches; telemetry and blind spots; protection and recovery controls; shared-service and civilian exposure; assumptions; evidence sources; and update triggers. Give every claim a version and review date because cloud routes, suppliers, identities, and operational procedures change continuously.

Validate the dossier through a tabletop and a technical exercise. Remove a dependency, corrupt an information source, revoke a privileged identity, or make the primary communications channel unavailable. Observe the workaround rather than accepting the planned one. Capture hidden dependencies, decision delays, unsafe improvisation, and external coordination failures. Feed the findings back into architecture, training, intelligence requirements, and continuity planning.

A mature product is deliberately small enough to use during a shift or crisis. Maintain detailed evidence behind it, but provide leaders a view of the essential function, decisive terrain, current threat, protection status, restoration confidence, and unresolved decisions. The goal is shared mission understanding, not a beautiful network diagram.