Civil dimension of security
Information and Cyber security: options for the international community and NATO
Download 159.78 Kb.
|
- Navigate this page:
- Annex Types of Malware
- Trojan Horse
- Embedded Malware
- Foreign Military Studies Office, Fort Leavenworth, KS., 2003
Information and Cyber security: options for the international community and NATO63. The challenges of the Information Age for national and international security are complex and require the combined efforts of international, regional and national authorities and the private sector, as well as sub- and trans-national groupings of active individuals. NATO is not in a position to address all aspects of this challenge, but it does have a significant role to play, not least because it unites nations with the most developed information and communication infrastructure (infrastructure, hardware and software which collectively make up the Internet are still overwhelmingly Western designed and produced; more than 50% of the world's Internet traffic transits the United States).83 64. On the global level, NATO should support initiatives to negotiate at least some norms of acceptable behaviour for the cyber domain. This framework must discourage the cyber arms race and clearly prohibit the use of cyber attacks against civilian infrastructures. The principles of international law should also recognise indirect responsibility of a state to ensure that its territory is not used by non-state actors to launch attacks against a third country. If a country systematically fails to ensure that or provides sanctuary for perpetrators, it should be considered as breaching international law and should face sanctions.84 When addressing our Committee at the Assembly session in Varna, Kenneth Geers of the NATO CCD COE suggested that the universal cyber treaty could follow the path of the Chemical Weapons Convention, i.e. focus on promoting best practices, helping find data points quickly, and sending teams to collect forensics, and eventually securing networks. 65. Achieving this agreement will not be easy, since some critical players – such as China – view cyber security from an “information security” perspective. This perspective is based on their desire to limit dissent and access to information deemed threatening to their regimes. These nations have proposed in-built tracking devices on all Internet packets that would allow all actions on the Internet to be traced. Western analysts argue this would be cumbersome, costly and easily negated by criminal groups, intelligence agencies and militaries. Therefore, the real target of such proposals is the average Internet user and their ability to access information and engage in political dialogue anonymously.85 Such a surveillance approach is prohibited by many NATO member states’ own laws governing surveillance, propaganda and counter-terrorism. 66. Other approaches to policing the cyber domain focus on developing technical solutions within Internet infrastructure itself to help maintain security. The Internet was originally designed to be interoperable and has therefore paid little attention to security aspects. The 2003 US National Strategy to Secure Cyberspace identified vulnerabilities within three “key Internet protocols”: the Internet Protocol, which guides data from source to destination across the Internet; the Domain Name System, which translates Internet Protocol numbers into recognisable Web addresses; and the Border Gateway Protocol, which provides the connection between networks to create the “network of networks”86. None of these protocols have in-built mechanisms to verify the origin or authenticity of information sent to them, leaving them vulnerable to being manipulated by malicious actors. Therefore, funding and developing technical solutions for a new set of secure protocols that will address many of the vulnerabilities in the current Internet infrastructure whilst falling short of surveillance of member states populations could be useful to NATO. 67. In addition, NATO member states should support wide ratification of binding international treaties, like the Council of Europe’s Convention on Cybercrime, because banning cyber criminal activities would also help negate cyber terrorists as well as state-sponsored cyber attacks that often use the same techniques as cyber criminals. The verifiability of these conventions is a serious issue, however. 68. In terms of public-private co-operation, relevant authorities of NATO nations should be more pro-actively engaging private IT companies when it comes to setting stricter rules on the use of cyber space. Dialogue is essential because software companies like Microsoft and Google remain able, by developing various software options, to exercise influence beyond what any nation state could aspire to do using their legislative powers. Incentives must be put in place to encourage private companies, particularly those running critical national infrastructures and designing cyber hardware and software, to upgrade their security systems beyond simple profit vs. loss calculations. It is also important for our nations to co-operate closely with Internet Service Providers in order to identify and quarantine the compromised computers (botnets) residing on their soil. 69. The Alliance should also establish closer co-operation with the EU based on already existing agreements. Although NATO is developing cyber defence capabilities, it still needs the EU because it issues laws on comprehensive standards for cyberspace and NATO does not. It would be useful, however, if the EU established the position of an EU “Cyber Czar” in order to have a clear contact point for NATO. 70. With respect to its own contribution, the most immediate objective for the Alliance is to ensure swift and efficient implementation of the newly adopted Cyber Security Policy and Action Plan. NATO should incorporate its cyber policies (and encourage its member states to do likewise) into a broader framework for adapting the military to the realities of the Information Age. Cyber security is not a value per se, it must be seen within the context of the developing concept of network-enabled capabilities. In other words, we need to find the right balance between the advantages offered to our armed forces by the new information and communication technologies, and the introduction of stricter protective measures against cyber threats, measures that could result in reduced efficiency of the military. 71. It also goes without saying that NATO must clarify its response mechanisms for itself in case of a cyber attack against one or more of its members, although these mechanisms do not necessarily need to be announced publicly in order not to let the adversaries know what they could get away with. Some argue that Article 5 should not be applied with respect to cyber attacks because their effect so far has been limited to creating inconvenience rather than causing the loss of human lives and because it is hard to determine the attacker. So far, there is no evidence that cyber attacks took human lives. However, the Rapporteur believes that the application of Article 5 should not be ruled out, given that new developments in cyber weapons such as Stuxnet might eventually cause damage comparable to that of a conventional military attack. 72. In more practical terms, NATO should consider its role in protecting physical infrastructure associated with the cyber domain. The physical vulnerability of fibre-optic cables and information hubs represent a serious challenge within the cyber domain. Most long-haul fibre-optic cables reach land at obvious choke points, which make them susceptible to attack or damage. Of note is the choke point for transatlantic cables, Widemouth Bay, Cornwall, in the UK, where four major EU‑US cables reach land.87 This area has reportedly been designated “vital to US security” because of these cables.88 Meanwhile, the vast majority of the physical cables that connect the United States and Asia run through the Luzon Strait choke point between Taiwan and the Philippines.89 Cables in the Malacca Strait are also congested, and island NATO members and partners, like Iceland, Japan and Australia, are particularly vulnerable.90 To date, the best form of protection for these sub-surface cables has been their anonymity. However, sometimes this is not enough, as highlighted by the fact that 75% of Internet capacity between Europe and a large part of Asia was temporarily lost when, in 2008, ships off the Egyptian coast severed two inter-continental fibre-optic cables by dragging their anchors.91 A Georgian woman denied 90% of Armenians access to the Internet for 5 hours when she inadvertently cut through a cable with her spade.92 There have also been other large Internet disruptions caused by cable incidents in Malta, Sicily, the United States and Asia.93 These highlight the possibility of sabotage by state or non-state actors. In terms of bandwidth capacity, NATO member states are heavily dependent on infrastructure in the United Kingdom for their transatlantic communications. Much of these key Internet peering points are based in and around London and have previously been threatened by flooding.94 Any disruption to these infrastructures could have far-reaching economic and military effects. 73. Other elements of NATO’s better preparedness against cyber attacks include further strengthening of national cyber incident response teams, achieving full operational capability of NCIRC, intensification of joint exercises, promoting more efficient sharing of best practices among the Allies and a wider use of “red teams”. Before investing in highly elaborate cyber defence systems, however, the Allies should first ensure that proper levels of basic “computer hygiene” are routinely maintained. 74. Security of networks in critical national infrastructure objects should remain a key priority. Technical solutions being examined in this regard include the introduction of high fidelity sensors to monitor intrusion activity on networks, and the strengthening of fault tolerance techniques.95 However, for a truly comprehensive cyber approach to infrastructure resilience, technological solutions alone will not suffice. A collaborative approach between citizens/systems users, businesses, law enforcement agencies and civil institutions will provide the best cyber security for these objects.96 75. The Rapporteur also suggests that NATO considers applying common funding procedures for procurement of some critical cyber defence capabilities for its member states. The Alliance and its nations should also redouble their efforts to invest in human capital, because currently the Western nations are widely believed to be losing their advantage in cyberspace in terms of numbers of cyber experts and qualified personnel. 76. Other practical measures should include reviewing our policies in terms of critical information that is to be stored online. The “Cablegate” revealed some documents that date back to 1966. Nigel Inkster, a prominent British expert, says that this “suggests an excess of zeal among those tasked to place State Department data on SIPRNet, since these cannot be relevant to today's operational requirements.” It is also necessary to review the operating systems of critical national infrastructure with a view to limiting their unnecessary exposure to online connections. Furthermore, new safeguard mechanisms must be put in place to prevent unauthorised downloading of sensitive data to digital storage devices. Procedures for vetting relevant personnel should also be revisited. 77. That said, the Rapporteur wishes to emphasise that all necessary security measures should not cross the line where they would violate the fundamental principles and values cherished by the nations of the Euro-Atlantic community. It is also important for our national security interests: since the cyber domain is to a large extent governed by the people, it is important to win the moral support of the majority of the virtual community. In order to prevent abuse by the governments, stricter security rules should be accompanied by measures ensuring democratic oversight. For instance, the United States announced recently the establishment of the Privacy and Civil Liberties Oversight Board (PCLOB) to ensure that privacy and civil liberties are protected.97 78. Last but not least, the Rapporteur would like to underline the role of parliamentarians not only in terms of issuing relevant legislation, but also in communicating with a public that is often insufficiently informed about the scope of opportunities and risks posed by the Information Age. Annex
1 As pointed out by Craig Mondie, Chief Research and Strategy Officer, Microsoft. See in Cybersecurity: Is Technology Moving Faster than Policy? Security & Defence Agenda report. 31 January 2011. http://www.securitydefenceagenda.org/Portals/14/Documents/Publications/2011/Cybersecurity_Dinner_report_Final2.pdf 2 Reducing Systemic Cybersecurity Risk, OECD/IFP Project on “Future Global Shocks”. Peter Sommer & Ian Brown. January 2011. 3 Cyber war and cyber power. Issues for NATO doctrine. By Jeffrey Hunker. NATO Defense College Research Paper No. 62, November 2010. 4 President Obama has said cyber criminals have caused around US$1 trillion damage worldwide in one year. 5 All NATO nations (including CoE non-member states Canada and the United States) have signed the Convention, but Belgium, Canada, the Czech Republic, Greece, Luxembourg, Poland, Spain and Turkey have not ratified it. CoE member state Russia did not sign the Convention. 6A hidden world, growing beyond control. By Dana Priest and William M. Arkin. A Washington Post Investigation. 19 July 2010. 7WikiLeaks: the price of sharing data. IISS Strategic Comments. Volume 17, Comment 3. January 2011. 8Cables leak reveals flaws of information-sharing tool. By Joby Warrick. The Washington Post. 31 December 2010. 9 WikiLeaks Founder on the Run, Chased by Turmoil. By John F. Burns and Ravoi Somaiya. The New York Times. 23 October 2010. 10 Leaked Cables Offer Raw Look at U.S. Diplomacy. By Scott Shane and Andrew W. Lehren. The New York Times. 28 November 2010. 11 WikiLeaks: Saudi King Abdullah Encouraged U.S. to Attack Iran; Chinese Politburo Hacked Into Google. New York News & Features. 28 November 2010. 12 Reaction to Leak of U.S. Diplomatic Cables, Day 2. By Robert Mackey. The New York Times. 29 November 2010. 13 Reaction to Leak of U.S. Diplomatic Cables, Day 2. By Robert Mackey. The New York Times. 29 November 2010. 14 Pentagon revamps security in wake of Wikileaks. Homeland Security Newswire. 29 December 2010. 15 White House memo outlines new anti-leak measures. Reuters. 2 December 2010. 16 Pentagon revamps security in wake of Wikileaks. Homeland Security Newswire. 29 December 2010. 17 U.S. Clamps Down on Info Sharing. Defense News. 6 December 2010. 18 WikiLeaks fallout leads to an info-sharing clampdown. By Sean Railey. FederalTimes.com. 5 December 2010. http://www.federaltimes.com/article/20101205/IT03/12050306/ 19 U.S. Clamps Down on Info Sharing. Defense News. 6 December 2011. 20 WikiLeaks fallout leads to an info-sharing clampdown. By Sean Railey. FederalTimes.com. 5 December 2010. http://www.federaltimes.com/article/20101205/IT03/12050306/ 21 U.S. Air Force blocks NYT, Guardian over WikiLeaks. Reuters. 14 December 2010. 22 US blocks access to WikiLeaks for federal workers. By Ewen MacAskill. The Guardian. 3 December 2010. 23 The arrest of Julian Assange: as it happened. The Guardian. December 2010. 24 On his first day in office President Obama instructed US agencies to be more open and transparent. Later on he launched a review of the classification procedures, ordered training for personnel in charge of classifications, and obliged classifiers to provide their identification on each classified document (see in Wikileaks’ War on Secrecy: Truth’s Consequences. By Massimo Calabresi. Time. 2 December 2010.). 25 Intelligence in the Information Age; Spy Data For Sale. By Kevin O’Connell. Commentary. RAND Corporation. 8 April 2001. http://www.rand.org/commentary/2001/04/08/ND.html 26 Analysis: WikiLeaks will kill transparency. By C.M. Sennott. Globalpost.com. 29 November 2010. http://www.globalpost.com/dispatch/worldview/101129/opinion-wikileaks-will-kill-transparency 27 Intelligence in the Information Age; Spy Data For Sale. By Kevin O’Connell. Commentary. RAND Corporation. 8 April 2001. http://www.rand.org/commentary/2001/04/08/ND.html 28Reducing Systemic Cybersecurity Risk, OECD/IFP Project on “Future Global Shocks”. By Peter Sommer and Ian Brown. January 2011. 29 Why Are Hactivists “Anonymous” Defending WikiLeaks? Interview by Debbie Randle. BBC Newsbeat. 9 December 2010. 30Operation Avenge Assange, http://i.imgur.com/C35Ty.png 31Reducing Systemic Cybersecurity Risk, OECD/IFP Project on “Future Global Shocks”. By Peter Sommer and Ian Brown. January 2011; Hackers Rise for WikiLeaks. By Cassell Bryan-Low and Sven Grundberg. Wall Street Journal. 8 December 2010. 32Hundreds of WikiLeaks Mirror Sites Appear. By Ravi Somaiya. The New York Times. 5 December 2010. 33Anonymous vows to take leaking to the next level. By Ashley Fantz. CNN. 24 February 2011. 34Drop the Case Against Assange. By Tim Wu. Foreign Policy. 4 February 2011. 35These Revolutions Are Not All Twitter. By Andrew K. Woods. The New York Times. 1 February 2011. 36Yet another Facebook revolution: why are we so surprised? By John Naughton. The Guardian. 23 January 2011. 37A Tunisian-Egyptian Link That Shook Arab History. By David D. Kirkpatrick and David E. Sanger. The New York Times. 13 February 2011. 38Hackers Shut Down Government Sites. By Ravi Somaiya. The New York Times. 2 February 2011. 39These Revolutions Are Not All Twitter. By Andrew K. Woods. The New York Times. 1 February 2011. 40Facebook Officials Keep Quiet on Its Role in Revolts. By Jennifer Preston. The New York Times. 14 February 2011. 41Wikileaks' Julian Assange takes credit for Tunisian and Egyptian revolutions. Daily Mail online. 14 February 2011. http://www.dailymail.co.uk/news/article-1356754/Wikileaks-Julian-Assange-takes-credit-Tunisian-Egyptian-revolutions.html 42 Belarusians organize flash mob protests. Global Post. July 2011. http://www.globalpost.com/dispatch/news/regions/europe/110701/belarus-flash-mob-protests-facebook 43 ‘Belarus Cuts Social Media Access Amid Protests’. Office for a Democratic Belarus. July 2011, http://democraticbelarus.eu/node/13105 44 Sound of Post-Soviet Protest: Claps and Beeps, The New York Times. 14 July 2011. 45The Perpetrators of Cyber Attacks. By Mary Watkins. Financial Times. 17 February 2011. 46 The Information Polity: Social and Legal frameworks for Critical Cyber Infrastructure Protection”. By M. Losavio et al. In Cyber Infrastructure Protection, T. Saadawi and L. Jordan (eds) Strategic Studies Institute, 2011. 47Cyber war and cyber power. Issues for NATO doctrine. By Jeffrey Hunker. NATO Defense College research paper No. 62. November 2010. 48 On Cyber Peace. By Les Bloom and John E. Savage. Issue Brief. Atlantic Council. August 2011. 49 Mobilising Cyber Power. By Alexander Klimburg, Survival, 28 January 2011. 50Tackling the Cyber Threat. By Margaret Gilmore. RUSI commentary. http://www.rusi.org/analysis/commentary/ref:C4CBD84EDE6ACB 51 T. Thomas, “Al Qaeda and the internet: The danger of ‘cyberplanning”, Foreign Military Studies Office, Fort Leavenworth, KS., 2003 52 J. Wilson, “Operation Cupcake: British Spies Hack Al Qaeda’s Magazine to Replace Bombs with Cupcakes”. Time Magazine Online. 4 June 2011, http://newsfeed.time.com/2011/06/04/operation-cupcake-british-spies-hack-al-qaedas-magazine-to-replace-bombs-with-cupcakes/ 53 PLDT, Microsoft. team up for cloud computing. Malaya Business Insight. 2009, http://www.malaya.com.ph/apr11/busi7.html 54 Google Apps and Government. Official Google Enterprise Blog. September 2009. http://googleenterprise.blogspot.com/2009/09/google-apps-and-government.html 55 Lawmakers question the security of cloud computing. Reuters. 1 July 2010, 56 Open Networking Foundation Pursues New Standards. By John Markoff. The New York Times. 22 March 2011. 57 Lawmakers question the security of cloud computing. Reuters. 1 July 2010. 58 A Treaty for Cyberspace. By Rex Hughes. International Affairs. March 2010. 59Cyber war and cyber power. Issues for NATO doctrine. By Jeffrey Hunker. NATO Defense College research paper No. 62. November 2010. 60Before the Gunfire, Cyberattacks. By John Markoff. The New York Times. 12 August 2008. 61Stuxnet and the Future Cyber War. Farwell, James P. and Rohozinski. IISS, Survival, Feb-March 2011. 62Cyber-war a growing threat warn experts. By Clark Boyd. BBC. 17 June 2010. 63 The Information Polity: Social and Legal frameworks for Critical Cyber Infrastructure Protection”. By M. Losavio et al. In Cyber Infrastructure Protection, T. Saadawi and L. Jordan (eds) Strategic Studies Institute, 2011. p. 131. 64A recipient opens an e-mail, which is seemingly from someone he/she knows, opens an attachment containing a “sleeper” programme that embeds in the recipients computer. The attacker can then control the programme remotely - access e-mail, send confidential documents or turn on a Web camera or microphone and record. 65Google China cyberattack part of vast espionage campaign, experts say. By Ariana Eunjung and Ellen Nakashima. The Washington Post. 14 January 2010. 66Israeli Test on Worm Called Crucial in Iran Nuclear Delay. By William J. Broad, John Markoff and David E. Sanger. The New York Times. 15 January 2011. 67Stuxnet and the Future Cyber War. By Farwell, James P. and Rohozinski. IISS. Survival. Feb-March 2011; and Israeli Test on Worm Called Crucial in Iran Nuclear Delay. By William J.Broad, John Markoff and David E. Sanger. The New York Times. 15 January 2011. 68Cracking Stuxnet: A 21st century cyber weapon. By Ralph Langner. Ted.com brief. 29 March 2011. http://www.youtube.com/watch?v=CS01Hmjv1pQ 69 Toward Foolproof IP Network Configuration Assessments. By R. Talpade. In Cyber Infrastructure Protection, T. Saadawi and L. Jordan (eds) Strategic Studies Institute, 2011. p. 265. 70Cyber-security: the corporate gold rush. Jane’s Defence Weekly. 29 September 2010. 71The Cyber-war. By Eleanor Keymer. Jane’s Defence Weekly. 29 September 2010. 72Global Cybersecurity-Thinking About the Niche for NATO. By Eneken Tikk. SAIS Review, Vol. 30, No. 2, Summer-Fall 2010 73 Protecting Europe Against Large-Scale Cyber-Attacks. European Union Committee – Fifth report. UK House of Lords. March 2010. 74On Cyber Warfare. By Paul Cornish, David Livingstone, Dave Clemente and Claire York. A Chatham House Report. November 2010. 75Cyber Security Enhancement Act Redux. By Eric Chabrow. Government Information Security Articles. 10 February 2011. http://www.govinfosecurity.com/articles.php?art_id=3340 76 Pentagon’s New Cyber Strategy. By Jason Healey. Atlantic Council. 14 July 2011. 77Evaluating the 2010 Strategy Review. By Dave Clemente. Chatham House. http://www.chathamhouse.org.uk/files/17631_1010sdsr_clemente.pdf 78IISS Global Perspectives – Power in Cyberspace. Q&A with Nigel Inkster, Director, Transnational Threats and Political Risk, IISS. 18 January 2011. 79The New Vulnerability. By Jack Goldsmith. The New Republic. 7 June 2010. 80 Taken from “Inventory of CERT activities in Europe”. ENISA publication. March 2011. 81Cybersecurity: Is Technology Moving Faster than Policy? Security & Defence Agenda report. 31 January 2011. http://www.securitydefenceagenda.org/Portals/14/Documents/Publications/2011/Cybersecurity_Dinner_report_Final2.pdf 82Global Cybersecurity-Thinking About the Niche for NATO. By Eneken Tikk. SAIS Review, Vol. 30, No. 2, Summer-Fall 2010. 83Power in Cyberspace. Speech by Nigel Inkster, Director of Transnational Threats and Political Risk, IISS. 18 January 2011. http://www.iiss.org/middle-east/global-perspectives-series/power-in-cyberspace/read-the-speech/ 84Cyber war and cyber power. Issues for NATO doctrine. By Jeffrey Hunker. NATO Defense College research paper No. 62. November 2010. 85Internet Governance in an Age of Cyber Insecurity. By Robert Knake. Council on Foreign Relations Special Report no.56, September 2010. 86The National Strategy to Secure Cyberspace. The White House. February 2003. 87‘Internet’s undersea world’ http://personalpages.manchester.ac.uk/staff/m.dodge/cybergeography/atlas/alcatel_large.gif 88 Devon and Cornwall locations “vital to US security”. BBC, 6 December 2010. 89 Points of weakness in Internet cable network. By Adam Wolfe. Asiaone Digital. 17 January 2007. http://digital.asiaone.com/Digital/Features/Story/A1Story20070523-7003.html 90 Points of weakness in Internet cable network. By Adam Wolfe. Asiaone Digital. 17 January 2007. http://digital.asiaone.com/Digital/Features/Story/A1Story20070523-7003.html 91 Protecting Europe Against Large-Scale Cyber-Attacks. European Union Committee – Fifth report. UK House of Lords. March 2010. 92 Georgian pensioner facing jail for cutting off Armenias Internet by snipping cable. EU Times, 8 April 2011. 93 Severed Cables in Mediterranean Disrupt Communication. Bloomberg. 19 December 2008; and, Physical protection for the Internet. AlphaGalileo Institute. 14 December 2010. 94 Floods threaten UK Internet infrastructure. By Robert Jaques. V3.co.uk. 31 July 2007. http://www.v3.co.uk/v3-uk/news/1942516/floods-threaten-uk-Internet-infrastructure 95 Developing High Fidelity Sensors for Intrusion Activity on Enterprise Networks. By E. Wagner and A. Ghosh. In Cyber Infrastructure Protection, T. Saadawi and L. Jordan (eds) Strategic Studies Institute, 2011. 96 The Information Polity: Social and Legal frameworks for Critical Cyber Infrastructure Protection”. By M. Losavio et al. In Cyber Infrastructure Protection, T. Saadawi and L. Jordan (eds) Strategic Studies Institute, 2011. 97Cybersecurity Two Years Later. A Report of the CSIS Commission on Cybersecurity for the 44th Presidency. January 2011. 98How does a logic bomb work? By Julia Layton. http://computer.howstuffworks.com/logic-bomb.htm; also in Reducing Systemic Cybersecurity Risk, OECD/IFP Project on “Future Global Shocks”. January 2011. Directory: sites -> default -> files -> documents documents -> North Mankato Taylor Library documents -> In the Red and Brown Water documents -> - documents -> Cbp and Trade Automated Interface Requirements Appendix: pga december 22, 2015 documents -> Ace abi catair customs and Trade Automated Interface Requirements documents -> Ace abi catair customs and Trade Automated Interface Requirements documents -> Mobile audio/video recording systems documents -> The south australian government gazette documents -> All public acts appearing in this gazette are to be considered official, and obeyed as such documents -> Union interparlementaire inter-parliamentary union Download 159.78 Kb. Share with your friends:
| ||||||||||||