My Infosec Wish for 2013: A Balanced Cyberwarfare Debate

CybersoldiersI can already hear the chuckling. “Cyber warfare? Balanced? And I’d like partisanship in Washington to end, a double date with Mila Kunis and Scarlett Johansson, and some fries with that!” Yes, my desire is utopian, but the fact that I would have to qualify it with a self-deprecating remark suggests the distance that we have yet to travel before we can get more value out of our present conversation on the topic of cyber warfare.

First, let’s start with the unfortunate fact that little is really new. As CTOVision head honcho Bob Gourley notes, we’ve had so many “cyber wake up calls” as to render the phrase meaningless. If these are wake-up calls, someone keeps hitting the snooze button. We know that our SCADA systems are vulnerable, and have been vulnerable for a while. We know that air-gapping will not protect our systems, and that our systems can be attacked through their subsystems. We also understand that espionage and covert operations pose a fundamental attribution problem worsened by the fact that investigation requires cooperation from governments with something to hide. Anonymous and other decentralized hacking collectives? Predicted and analyzed 20 years ago. Finally, we also (should) get that everything from vendors to human psychology provides a multitude of attack surfaces for a potential attacker. Clearly, we’ve had plenty of forewarning for the calamities we’re suffering and have yet to suffer.

But knowing is unfortunately not, as I learned from watching GI JOE cartoon shows, half the battle. On one hand, much cyber warfare conversation these days boils down to endless repetition of civilization-destroying “cyber-doom” scenarios involving genius hackers that never face intelligence, targeting, and weapon customization problems inherent in any kind of attack capable of causing meaningful kinetic damage. That might be what James Bond faces in Skyfall, but it’s not a realistic idea of the future threat. Cyberhype is endemic, and clouds meaningful assessment of dangers and the resources necessary to combat the problem. Much of what we know in other fields about the dynamics of coercion is completely overlooked in even sound technical assessments that neglect the motives and politics of potential attackers. Attribution, for example, is variable upon an actor’s desire to coerce vs. steal or damage. But while cyber-doom is not on the horizon, attention to the intersecting fields of cyber warfare, cyber conflict, and the broader issues of cyberpower yields some discomforting realizations.

For starters, the line between espionage and warfare is never clear to policymakers in practice. Solar Sunrise occurred in the middle of a standoff between the United States and Iraq, and policymakers faced uncertainty over whether the intrusion was part of the geopolitical drama. Long range cyber-reconnaissance can identify weak points. The ability to cause damage to civilian and military infrastructure may not coerce on its own but can cause cumulative damage when combined with other sources of national power. Zero-day markets and a vigorous underground may not challenge the dominance of custom-designed single shot weapons built by states but add an unstable element to the mix. Knowledge that one’s networks are vulnerable to other powers may help tilt the overall balance in larger peacetime strategic competitions. While no piece of malware has yet killed anyone, military cyberpower has helped states coordinate and employ fearsome conventional weapons.

Stuxnet, while unique, also is at times underrated. As Jason Healey noted, Stuxnet had features of autonomy and mirrors an environment in which computational agents are delegated increasingly broad cognitive powers. The way we make war often mirrors the way we make wealth, and future cyberweapons are being dreamt up in an environment characterized by the rise of a “Second Economy” built on a vast and increasingly automatic infrastructure. Cyberspace, once the humble child of the 19th century telegraphic revolution, is increasingly conquering almost every aspect of everyday life and even reaching inside the human body. It’s not surprising that many cybersecurity ideas are drawn from science fiction, even if they often mislead. Science fiction is, after all, a vehicle for commenting on destabilizing changes in the present.

The ground is shifting. DARPA’s Plan X heralds the rise of military-industrial cyber weapon complexes with streamlined cyberweapon acquisition and deployment, and potentially new kinds of cyber weapons that move beyond the network base of contemporary cyber offense and defense. Trends in computing may shift towards biological and analog computing, complicating current technical assumptions. Big data as a form of cyberpower can aid in uncovering patterns of vulnerability that targets may be entirely unaware of. New methods of password cracking challenge old assumptions about password strength and the user vector for targeting. Finally, if the operational repertoire of cyber warfare in and of itself is limited, cyberpower’s capacity to intersect with other operational environments and modify their features makes attack endlessly customizable.

The idea that the offense is dominant should be held to rigor. But so is the idea that eternal principles of cyber conflict and geopolitics can be derived from the study of an extremely limited set of cases. History is important, and is sadly overlooked in the information security and warfare fields. The Cyber Conflict Studies Association, thankfully, is seeking to remedy this. Certain essential aspects of security and war never change, and a disruption-focused tech industry ignores this at its own peril. But assumptions based on modern Internet Protocol technologies will fail to be of strategic value when attackers bypass them or the technologies change. Want an example? Take a gander at the vulnerabilities inherent in your own car. The answer is not an “everything is new” attitude, but a richer and more detailed effort to think about what precisely cyberspace is. A solid understanding of cyberspace, separate from the domination of any one kind of technology, can not only inform about the nature of cyberpower and cyber threat but also hedge against technological change. That conversation is far from finished, and hopefully 2013 will auger a more useful debate about war and other forms of conflict in cyberspace.

CTOvision Pro Special Technology Assessments

We produce special technology reviews continuously updated for CTOvision Pro members. Categories we cover include:

  • Analytical Tools - With a special focus on technologies that can make dramatic positive improvements for enterprise analysts.
  • Big Data - We cover the technologies that help organizations deal with massive quantities of data.
  • Cloud Computing - We curate information on the technologies enabling enterprise use of the cloud.
  • Communications - Advances in communications are revolutionizing how data gets moved.
  • GreenIT - A great and virtuous reason to modernize!
  • Infrastructure  - Modernizing Infrastructure can have dramatic benefits on functionality while reducing operating costs.
  • Mobile - This revolution is empowering the workforce in ways few of us ever dreamed of.
  • Security  -  There are real needs for enhancements to security systems.
  • Visualization  - Connecting computers with humans.
  • Hot Technologies - Firms we believe warrant special attention.

 

Recent Research

Tech Firms Seeking To Serve Federal Missions: Here is how to follow the money

Creating The New Cyber Warrior: Eight South Carolina Universities Compete

Mobile Gamers: Fun-Seeking but Fickle

Update from DIA CTO, CIO and Chief Engineer on ICITE and Enterprise Apps

Pew Report: Increasing Technology Use among Seniors

Finding The Elusive Data Scientist In The Federal Space

DoD Public And Private Cloud Mandates: And insights from a deployed communications professional on why it matters

Intel CEO Brian Krzanich and Cloudera CSO Mike Olson on Intel and Cloudera’s Technology Collaboration

Watch For More Product Feature Enhancements for Actifio Following $100M Funding Round

Navy Information Dominance Corps: IT still searching for the right governance model

DISA Provides A milCloud Overview: Looks like progress, but watch for two big risks

Innovators, Integrators and Tech Vendors: Here is what the government hopes they will buy from you in 2015

solid
About AdamElkus

Adam Elkus is a PhD student in Computational Social Science at George Mason University. He writes on national security, technology, and strategy at CTOvision.com and the new analysis focused Analyst One, War on the Rocks, and his own blog Rethinking Security. His work has been published in The Atlantic, Journal of Military Operations Foreign Policy, West Point Counterterrorism Center Sentinel, and other publications.

  • Pingback: My Infosec Wish for 2013: A Balanced Cyberwarfare Debate

  • http://twitter.com/GovCloud/status/286331396585304064/ NJVC Cloud Computing (@GovCloud)

    RT @ctovision: My Infosec Wish for 2013: A Balanced #Cyberwarfare Debate http://t.co/UB4GhF59 #analysis #bigdata #cybersecurity

  • http://twitter.com/davidbaliles/status/286341240922963969/ @davidbaliles

    RT @ctovision: My Infosec Wish for 2013: A Balanced #Cyberwarfare Debate http://t.co/UB4GhF59 #analysis #bigdata #cybersecurity

  • Dan Kuehl

    this is a well-stated and reasonable discussion of the cyber war debate, which echoes much of what I’ve written and taught for many years. (could be why I like it!) trying to separate the cyber war debate from the larger contexts in which it exists-technical, legal, political, military, etc-is misleading and foolish but all too common, as are efforts to walk off the”cyber community” from the others of which it has become part and parcel. I particularly like Adam’ s paragraph that opens with “stuxnet”. the ref to “way we make wealth”, which comes from the Toffler’ s book “war and anti-war”, has a new and richer meaning than many of us understood it way back in the early 1990s. what it means is that the world’s economy and the way we make wealth comes from our use and exploitation of interconnected cyber networks…which is now how we make war also.

    • http://twitter.com/Aelkus Adam Elkus (@Aelkus)

      It’s an honor to hear that from you, since your chapter in Cyberpower and International Security is one of my biggest influences as a writer on this subject.

  • http://twitter.com/Andrew_Zammit/status/286442357497425920/ @Andrew_Zammit

    My Infosec Wish for 2013: A Balanced Cyberwarfare Debate http://t.co/kgAfYAxR by @Aelkus

  • http://twitter.com/hnpitts/status/286468001933443073/ @hnpitts

    RT @Aelkus: Back at @ctovision, I have a little piece asking for more balanced cyber warfare/conflict discussion in 2013. http://t.co/KlmXzpqL

  • Pingback: Seven Shapers Of Technology in 2013

  • http://twitter.com/ISCSP_ORG/status/286506363910230016/ @ISCSP_ORG

    RT @AlexOlesker: @Aelkus puts cyber warfare into technical, strategic, and historical context: http://t.co/3IvyJbPP http://t.co/sl3dLptH

  • http://twitter.com/BareftStratgist/status/287907951006597120/ N. Finney (@BareftStratgist)

    Great post about the cyber warfare debate by @Aelkus http://t.co/v4QVrYu6

  • http://twitter.com/BillyPope23/status/287916244835901440/ @BillyPope23

    @BareftStratgist @Aelkus: Great points about cyber. Exaggerated threats aren’t taken serious but this post should be: http://t.co/6dO8zdTK

  • http://twitter.com/BareftStratgist/status/287916352860213248/ N. Finney (@BareftStratgist)

    RT @BillyPope23: @BareftStratgist @Aelkus: Great points about cyber. Exaggerated threats aren’t taken serious but this post should be: http://t.co/6dO8zdTK

  • http://twitter.com/Aelkus/status/289357134267813888/ Adam Elkus (@Aelkus)

    @PatrickCMiller @selil Latest one on cyber here: http://t.co/WacTkG2i

  • Pingback: January Cyber War and Cyber Conflict Link Roundup

  • Pingback: Ready or not, software is eating the government contracting world