Cyber Security Answers General Defense

Download 1.51 Mb.

Page	20/29
Date	19.10.2016
Size	1.51 Mb.
	#4954

1 ... 16 17 18 19 20 21 22 23 ... 29

General Defense

Background

Frontline Answers

No cyber attacks – civilian harm, can only be used once, can be reversed to target the attacker, retribution, resource limits, need luck, lack of assets

Maness & Valeriano, 2015, Ryan C. Maness, Northeastern University, Department of Political Science, Brandon Valeriano, University of Glasglow, Cyber War versus Cyber Realities: Cyber Conflict in the International System, Kindle Edition, page number at end of card

We find that the security dilemma has no place in these international interactions. The cyber world is nebulous; an infiltration against a military facility in this realm could bleed into the public sector. Malicious cyber incidents on infrastructure have been and will continue to be rare to nonexistent because states are restrained due to the high probability of civilian harm, the nature of the weapons (single use), and the weak payoffs if utilized (Gartzke 2013). These types of offensive cyber actions are just as unlikely as interstate nuclear or chemical weapons attacks. There is a system of normative restraint in cyber operations based on the conditions of collateral damage, plus the factors of blowback and replication. Foreign policy tactics in the cyber world can be replicated and reproduced. Any cyber weapon used can be turned right back on its initiator. On top of this, it is likely that severe cyber operations will be bring retribution and consequences that many states are not willing to accept. We have seen many interstate conflicts since the advent of the Internet age, but the largest and only cyber operation thus far during a conventional military conflict, the 2008 Russo-Georgian skirmish, consisted of almost trivial DDoS and vandalism. Since then, Russia has even avoided using cyber weapons during the Crimean and larger Ukrainian crises of 2014. Other operations are mainly propaganda operations or occur in the realm of espionage. That the United States did not use cyber tactics against Iraq, Afghanistan, or Libya, at least as directed at the executive level, signifies that cyber tactics are typically restrained despite significant constituencies in the military that want to use the weapons. Stuxnet is the outlier, as our data demonstrate, not the norm or the harbinger of the future to come. Cyber operations are limited in that their value is negligible, the consequences of a massive cyber incident are drastic, and the requirements to carry one out are vast. The idea of a lone cyber hacker being able to bring states to their knees is a fantastic one. Cyber operations like Stuxnet require an exceptional amount of funds, technical knowledge, luck, and on-the-ground assets for successful implementation. Massive and truly dangerous cyber operations are beyond the means of most countries. These statements are not opinions, but contentions made based on the facts at hand and the data we have collected. We also see regionalism dominate in cyberspace. Despite the vastness and transboundary capacity of the Internet, most operations are limited to local targets connected to traditional causes of conflict, such as territorial disputes and leadership disagreements. Issues are important (Mansbach and Vasquez 1981) in world politics and in cyber politics. This is why international relations scholarship is so important in relation to the cyber question. Cyber operations are not taken devoid of their international and historical contexts. What has happened in the past will influence how future technologies are leveraged and where they are applied. The goal of this book will be to use this theoretical frame to explain the cyber conflict dynamics of rival states, as well as non-state actors willing and able to launch cyber malice. Valeriano, Brandon; Maness, Ryan C. (2015-04-27). Cyber War versus Cyber Realities: Cyber Conflict in the International System (pp. 16-17). Oxford University Press. Kindle Edition.

Zero impact to cyber-attacks --- overwhelming consensus of qualified authors goes neg

- No motivation---can’t be used for coercive leverage

- Defenses solve---benefits of offense are overstated

- Too difficult to execute/mistakes in code are inevitable

- AT: Infrastructure attacks

- Military networks are air-gapped/difficult to access

- Overwhelming consensus goes neg

Colin S. Gray 13, Prof. of International Politics and Strategic Studies @ the University of Reading and External Researcher @ the Strategic Studies Institute @ the U.S. Army War College, April, “Making Strategic Sense of Cyber Power: Why the Sky Is Not Falling,” U.S. Army War College Press, http://www.strategicstudiesinstitute.army.mil/pdffiles/PUB1147.pdf

CONCLUSIONS AND RECOMMENDATIONS: THE SKY IS NOT FALLING¶ This analysis has sought to explore, identify, and explain the strategic meaning of cyber power. The organizing and thematic question that has shaped and driven the inquiry has been “So what?” Today we all do cyber, but this behavior usually has not been much informed by an understanding that reaches beyond the tactical and technical. I have endeavored to analyze in strategic terms what is on offer from the largely technical and tactical literature on cyber. What can or might be done and how to go about doing it are vitally important bodies of knowledge. But at least as important is understanding what cyber, as a fifth domain of warfare, brings to national security when it is considered strategically. Military history is stocked abundantly with examples of tactical behavior un - guided by any credible semblance of strategy. This inquiry has not been a campaign to reveal what cy ber can and might do; a large literature already exists that claims fairly convincingly to explain “how to . . .” But what does cyber power mean, and how does it fit strategically, if it does? These Conclusions and Rec ommendations offer some understanding of this fifth geography of war in terms that make sense to this strategist, at least. ¶ 1. Cyber can only be an enabler of physical effort. Stand-alone (popularly misnamed as “strategic”) cyber action is inherently grossly limited by its immateriality. The physicality of conflict with cyber’s human participants and mechanical artifacts has not been a passing phase in our species’ strategic history. Cyber action, quite independent of action on land, at sea, in the air, and in orbital space, certainly is possible. But the strategic logic of such behavior, keyed to anticipated success in tactical achievement, is not promising. To date, “What if . . .” speculation about strategic cyber attack usually is either contextually too light, or, more often, contextually unpersuasive. 49 However, this is not a great strategic truth, though it is a judgment advanced with considerable confidence. Although societies could, of course, be hurt by cyber action, it is important not to lose touch with the fact, in Libicki’s apposite words, that “[i]n the absence of physical combat, cyber war cannot lead to the occupation of territory. It is almost inconceivable that a sufficiently vigorous cyber war can overthrow the adversary’s government and replace it with a more pliable one.” 50 In the same way that the concepts of sea war, air war, and space war are fundamentally unsound, so also the idea of cyber war is unpersuasive. ¶ It is not impossible, but then, neither is war conducted only at sea, or in the air, or in space. On the one hand, cyber war may seem more probable than like environmentally independent action at sea or in the air. After all, cyber warfare would be very unlikely to harm human beings directly, let alone damage physically the machines on which they depend. These near-facts (cyber attack might cause socially critical machines to behave in a rogue manner with damaging physical consequences) might seem to ren - der cyber a safer zone of belligerent engagement than would physically violent action in other domains. But most likely there would be serious uncertainties pertaining to the consequences of cyber action, which must include the possibility of escalation into other domains of conflict. Despite popular assertions to the contrary, cyber is not likely to prove a precision weapon anytime soon. 51 In addition, assuming that the political and strategic contexts for cyber war were as serious as surely they would need to be to trigger events warranting plausible labeling as cyber war, the distinctly limited harm likely to follow from cyber assault would hardly appeal as prospectively effective coercive moves. On balance, it is most probable that cyber’s strategic future in war will be as a contribut - ing enabler of effectiveness of physical efforts in the other four geographies of conflict. Speculation about cyber war, defined strictly as hostile action by net - worked computers against networked computers, is hugely unconvincing.¶ 2. Cyber defense is difficult, but should be sufficiently effective. The structural advantages of the offense in cyber conflict are as obvious as they are easy to overstate. Penetration and exploitation, or even attack, would need to be by surprise. It can be swift almost beyond the imagination of those encultured by the traditional demands of physical combat. Cyber attack may be so stealthy that it escapes notice for a long while, or it might wreak digital havoc by com - plete surprise. And need one emphasize, that at least for a while, hostile cyber action is likely to be hard (though not quite impossible) to attribute with a cy - berized equivalent to a “smoking gun.” Once one is in the realm of the catastrophic “What if . . . ,” the world is indeed a frightening place. On a personal note, this defense analyst was for some years exposed to highly speculative briefings that hypothesized how unques - tionably cunning plans for nuclear attack could so promptly disable the United States as a functioning state that our nuclear retaliation would likely be still - born. I should hardly need to add that the briefers of these Scary Scenarios were obliged to make a series of Heroic Assumptions. ¶ The literature of cyber scare is more than mildly reminiscent of the nuclear attack stories with which I was assailed in the 1970s and 1980s. As one may observe regarding what Winston Churchill wrote of the disaster that was the Gallipoli campaign of 1915, “[t]he terrible ‘Ifs’ accumulate.” 52 Of course, there are dangers in the cyber domain. Not only are there cyber-competent competitors and enemies abroad; there are also Americans who make mistakes in cyber operation. Furthermore, there are the manufacturers and constructors of the physical artifacts behind (or in, depending upon the preferred definition) cyber - space who assuredly err in this and that detail. The more sophisticated—usually meaning complex—the code for cyber, the more certain must it be that mistakes both lurk in the program and will be made in digital communication.¶ What I have just outlined minimally is not a reluc - tant admission of the fallibility of cyber, but rather a statement of what is obvious and should be anticipat - ed about people and material in a domain of war. All human activities are more or less harassed by friction and carry with them some risk of failure, great or small. A strategist who has read Clausewitz, especially Book One of On War , 53 will know this. Alternatively, anyone who skims my summary version of the general theory of strategy will note that Dictum 14 states explicitly that “Strategy is more difficult to devise and execute than are policy, operations, and tactics: friction of all kinds comprise phenomena inseparable from the mak - ing and execution of strategies.” 54 Because of its often widely distributed character, the physical infrastruc - ture of an enemy’s cyber power is typically, though not invariably, an impracticable target set for physical assault. Happily, this probable fact should have only annoying consequences. The discretionary nature and therefore the variable possible characters feasible for friendly cyberspace(s), mean that the more danger - ous potential vulnerabilities that in theory could be the condition of our cyber-dependency ought to be avoidable at best, or bearable and survivable at worst. Libicki offers forthright advice on this aspect of the subject that deserves to be taken at face value: ¶ [T]here is no inherent reason that improving informa - tion technologies should lead to a rise in the amount of critical information in existence (for example, the names of every secret agent). Really critical information should never see a computer; if it sees a computer, it should not be one that is networked; and if the computer is networked, it should be air-gapped.¶ Cyber defense admittedly is difficult to do, but so is cyber offense. To quote Libicki yet again, “[i]n this medium [cyberspace] the best defense is not necessarily a good offense; it is usually a good defense.” 56 Unlike the geostrategic context for nuclear-framed competition in U.S.–Soviet/Russian rivalry, the geographical domain of cyberspace definitely is defensible. Even when the enemy is both clever and lucky, it will be our own design and operating fault if he is able to do more than disrupt and irritate us temporarily.¶ When cyber is contextually regarded properly— which means first, in particular, when it is viewed as but the latest military domain for defense planning—it should be plain to see that cyber performance needs to be good enough rather than perfect. 57 Our Landpower, sea power, air power, and prospectively our space systems also will have to be capable of accepting combat damage and loss, then recovering and carrying on. There is no fundamental reason that less should be demanded of our cyber power. Second, given that cyber is not of a nature or potential character at all likely to parallel nuclear dangers in the menace it could con - tain, we should anticipate international cyber rivalry to follow the competitive dynamic path already fol - lowed in the other domains in the past. Because the digital age is so young, the pace of technical change and tactical invention can be startling. However, the mechanization RMA of the 1920s and 1930s recorded reaction to the new science and technology of the time that is reminiscent of the cyber alarmism that has flour - ished of recent years. 58 We can be confident that cyber defense should be able to function well enough, given the strength of political, military, and commercial motivation for it to do so. The technical context here is a medium that is a constructed one, which provides air-gapping options for choice regarding the extent of networking. Naturally, a price is paid in convenience for some closing off of possible cyberspace(s), but all important defense decisions involve choice, so what is novel about that? There is nothing new about accepting some limitations on utility as a price worth paying for security.¶ 3. Intelligence is critically important, but informa - tion should not be overvalued. The strategic history of cyber over the past decade confirms what we could know already from the science and technology of this new domain for conflict. Specifically, cyber power is not technically forgiving of user error. Cyber warriors seeking criminal or military benefit require precise information if their intended exploits are to succeed. Lucky guesses should not stumble upon passwords, while efforts to disrupt electronic Supervisory Con - trol and Data Acquisition (SCADA) systems ought to be unable to achieve widespread harmful effects. But obviously there are practical limits to the air-gap op - tion, given that control (and command) systems need to be networks for communication. However, Internet connection needs to be treated as a potential source of serious danger.¶ It is one thing to be able to be an electronic nuisance, to annoy, disrupt, and perhaps delay. But it is quite another to be capable of inflicting real persisting harm on the fighting power of an enemy. Critically important military computer networks are, of course, accessible neither to the inspired amateur outsider, nor to the malignant political enemy. Easy passing reference to a hypothetical “cyber Pearl Harbor” reflects both poor history and ignorance of contemporary military common sense. Critical potential military (and other) targets for cyber attack are extremely hard to access and influence (I believe and certainly hope), and the technical knowledge, skills, and effort required to do serious harm to national security is forbiddingly high. This is not to claim, foolishly, that cyber means absolutely could not secure near-catastrophic results. However, it is to say that such a scenario is extremely improbable. Cyber defense is advancing all the time, as is cyber offense, of course. But so discretionary in vital detail can one be in the making of cyberspace, that confidence—real confidence—in cyber attack could not plausibly be high. It should be noted that I am confining this particular discussion to what rather idly tends to be called cyber war. In political and strategic practice, it is unlikely that war would or, more importantly, ever could be restricted to the EMS. Somewhat rhetorically, one should pose the question: Is it likely (almost anything, strictly, is possible) that cyber war with the potential to inflict catastrophic damage would be allowed to stand unsupported in and by action in the other four geographical domains of war? I believe not.¶ Because we have told ourselves that ours uniquely is the Information Age, we have become unduly respectful of the potency of this rather slippery catch-all term. As usual, it is helpful to contextualize the al - legedly magical ingredient, information, by locating it properly in strategic history as just one important element contributing to net strategic effectiveness. This mild caveat is supported usefully by recognizing the general contemporary rule that information per se harms nothing and nobody. The electrons in cyber - ized conflict have to be interpreted and acted upon by physical forces (including agency by physical human beings). As one might say, intelligence (alone) sinks no ship; only men and machines can sink ships! That said, there is no doubt that if friendly cyber action can infiltrate and misinform the electronic informa - tion on which advisory weaponry and other machines depend, considerable warfighting advantage could be gained. I do not intend to join Clausewitz in his dis - dain for intelligence, but I will argue that in strategic affairs, intelligence usually is somewhat uncertain. 59 Detailed up-to-date intelligence literally is essential for successful cyber offense, but it can be healthily sobering to appreciate that the strategic rewards of intelligence often are considerably exaggerated. The basic reason is not hard to recognize. Strategic success is a complex endeavor that requires adequate perfor - mances by many necessary contributors at every level of conflict (from the political to the tactical). ¶ When thoroughly reliable intelligence on the en - emy is in short supply, which usually is the case, the strategist finds ways to compensate as best he or she can. The IT-led RMA of the past 2 decades was fueled in part by the prospect of a quality of military effec - tiveness that was believed to flow from “dominant battle space knowledge,” to deploy a familiar con - cept. 60 While there is much to be said in praise of this idea, it is not unreasonable to ask why it has been that our ever-improving battle space knowledge has been compatible with so troubled a course of events in the 2000s in Iraq and Afghanistan. What we might have misunderstood is not the value of knowledge, or of the information from which knowledge is quarried, or even the merit in the IT that passed information and knowledge around. Instead, we may well have failed to grasp and grip understanding of the whole context of war and strategy for which battle space knowledge unquestionably is vital. One must say “vital” rather than strictly essential, because relatively ignorant armies can and have fought and won despite their ig - norance. History requires only that one’s net strategic performance is superior to that of the enemy. One is not required to be deeply well informed about the en - emy. It is historically quite commonplace for armies to fight in a condition of more-than-marginal reciprocal and strategic cultural ignorance. Intelligence is king in electronic warfare, but such warfare is unlikely to be solely, or even close to solely, sovereign in war and its warfare, considered overall as they should be.¶ 4. Why the sky will not fall. More accurately, one should say that the sky will not fall because of hostile action against us in cyberspace unless we are improb - ably careless and foolish. David J. Betz and Tim Ste vens strike the right note when they conclude that “[i]f cyberspace is not quite the hoped-for Garden of Eden, it is also not quite the pestilential swamp of the imagination of the cyber-alarmists.” 61 Our understanding of cyber is high at the technical and tactical level, but re - mains distinctly rudimentary as one ascends through operations to the more rarified altitudes of strategy and policy. Nonetheless, our scientific, technological, and tactical knowledge and understanding clearly indicates that the sky is not falling and is unlikely to fall in the future as a result of hostile cyber action. This analysis has weighed the more technical and tactical literature on cyber and concludes, not simply on balance, that cyber alarmism has little basis save in the imagination of the alarmists. There is military and civil peril in the hostile use of cyber, which is why we must take cyber security seriously, even to the point of buying redundant capabilities for a range of command and control systems. 62 So seriously should we regard cyber danger that it is only prudent to as - sume that we will be the target for hostile cyber action in future conflicts, and that some of that action will promote disruption and uncertainty in the damage it will cause.¶ That granted, this analysis recommends strongly that the U.S. Army, and indeed the whole of the U.S. Government, should strive to comprehend cyber in context. Approached in isolation as a new technol - ogy, it is not unduly hard to be over impressed with its potential both for good and harm. But if we see networked computing as just the latest RMA in an episodic succession of revolutionary changes in the way information is packaged and communicated, the computer-led IT revolution is set where it belongs, in historical context. In modern strategic history, there has been only one truly game-changing basket of tech - nologies, those pertaining to the creation and deliv - ery of nuclear weapons. Everything else has altered the tools with which conflict has been supported and waged, but has not changed the game. The nuclear revolution alone raised still-unanswered questions about the viability of interstate armed conflict. How - ever, it would be accurate to claim that since 1945, methods have been found to pursue fairly traditional political ends in ways that accommodate nonuse of nuclear means, notwithstanding the permanent pres - ence of those means.¶ The light cast by general strategic theory reveals what requires revealing strategically about networked computers. Once one sheds some of the sheer wonder at the seeming miracle of cyber’s ubiquity, instanta - neity, and (near) anonymity, one realizes that cyber is just another operational domain, though certainly one very different from the others in its nonphysi - cality in direct agency. Having placed cyber where it belongs, as a domain of war, next it is essential to recognize that its nonphysicality compels that cyber should be treated as an enabler of joint action, rather than as an agent of military action capable of behav - ing independently for useful coercive strategic effect. There are stand-alone possibilities for cyber action, but they are not convincing as attractive options either for or in opposition to a great power, let alone a superpower. No matter how intriguing the scenario design for cyber war strictly or for cyber warfare, the logic of grand and military strategy and a common sense fueled by understanding of the course of strategic history, require one so to contextualize cyber war that its independence is seen as too close to absurd to merit much concern.

Many barriers to a cyber attack

Martin Libicki, October 2014, A Dangerous World? Threat Perceptions and US National Security, ed. Christopher Peeble & John Mueller, Martin Libicki is a senior management scientist at the RAND Corporation, where his research focuses on the effects of information technology on domestic and national security. He is the author of several books, including Conquest in Cyberspace: National Security and Information Warfare and Information Technology Standards: Quest for the Common Byte. He has also written two cyberwar monographs: Cyberwar and Cyberdeterrence and Crisis and Escalation in Cyberspace. Prior to joining RAND, Libicki was a senior fellow at the National Defense University, page # at end of card

An attack as large as posited would be unprecedented. No comparable major cyberattack has occurred since the Internet became accessible to the world’s public 20 years ago. Although prior absence is no proof that it will never happen, it may be premature to declare a major attack inevitable. All the trend lines— good and bad— are rising at the same time: (a) the sophistication of attackers and defenders; (b) the salience of cyberattack as a weapon, but also the rising sensitivity to the prospect that such attacks are possible and must be countered; (c) the bandwidth available for organizing a flooding attack, but also to ward it off; and (d) the complexity of operational software (which increases the number of places where vulnerabilities can be found), but also the complexity of security software and systems (which deepens the number of levels an attack must overcome to succeed). (2014-10-14). A Dangerous World? Threat Perception and U.S. National Security (Kindle Locations 2518-2524). Cato Institute. Kindle Edition.

No cyber terror threat

No impact

We developed our theory of cyber engagement fully in Chapter 3. The argument considers that cyber restraint is expected to dominate cyber interactions and should be predictive of future cyber operations. States will restrain themselves from crossing the “red lines” of cyber conflict because of the high operational and normative cost associated with these operations. They will not shut down military networks, knock out power grids, or black out Wall Street; the fear of blowback and retaliation not only in cyberspace, but by conventional means as well, is too great. States will also avoid these actions because of fears of collateral damage and infecting the rest of the Internet. Actions taken in cyberspace tend to invade all aspects of cyberspace. Even when states take actions to keep operations in the realm of cyber, the operations tend to spread and proliferate in ways not predicted. Escalated offensive capabilities will not be used because they could lead directly to war, civilian harm, and economic retaliation, which would then escalate conflict among states. These tactics would spread the conflict from the cyber realm to conventional conflict. Therefore, restraint is what we expect to find when we examine cyber conflict among states. States will do what they believe they can get away with and then will go no further. Restraint is the outcome we expect to see among states, while the process we expect to see at work is what we term cyber straitjacketing. The low level and limited amount of cyber conflict we do observe will mostly be between regional rivals, an unexpected result given the global reach of cyber technologies. Cyber regionalism is the assertion that most rival interactions in cyberspace will have a regional context, usually tied to territorial issues and other traditional issues between regional actors. However, because cyber conflict is restrained, these cyber incidents and disputes will usually take the form of propaganda, vandalism, or inconvenient denial of service methods and will not escalate to militarized conflict solely because of cyber issues. Escalation, especially among regional rivals, has been prevented through restraint thus far. Valeriano, Brandon; Maness, Ryan C. (2015-04-27). Cyber War versus Cyber Realities: Cyber Conflict in the International System (p. 213). Oxford University Press. Kindle Edition.

Cyber straight-jacketing means no attacks and diplomacy solves any impact

Maness & Valeriano, 2015, Ryan C. Maness, Northeastern University, Department of Political Science, Brandon Valeriano, University of Glasglow, Cyber War versus Cyber Realities: Cyber Conflict in the International System, Kindle Edition, page number at end of card

Our notion of restraint being in operation in the cyber world also suggests the concept of straitjacketing cyber actors. Restraint alone cannot really be used to describe the policy process a state might consider when contemplating a cyber incident. Restraint represents the outcome of the policy process; the term that outlines the process under consideration might be more accurately termed cyber straitjacketing. States are straitjacketed in their ability to utilize cyber methods. In some ways, they are prevented from using the technology in order to prevent self-harm. Blowback and replication are real issues that need to be confronted in the cyber world. Any weapon used in this domain can be reproduced and directed back at the initiator. Using cyber tactics in many ways can harm the state more than it helps it. Likely the use of the technology will not produce a change in behavior of the target, but the action will be punished, and the cyber incident will become public. It is for these reasons that states will often willingly place their operatives in what might be considered constrained restriction. The consequences of using the technology at a maximum level are just too devastating. Another way to describe straitjacketing is that states are handcuffed in the operation of cyber tactics. Extreme actions are limited, because the conduct of these technologies is ungoverned and unlimited. The full range of motion is limited, due to the nature of the tactic and the taboo associated with its usage. Whichever term is preferred, the outcome is still the same: the limitation of action. While there might be negative connotations associated with each term given their history, the reality remains— that states are likely constrained in their actions, despite protestations that the international system is governed by anarchy. The paradox here is that no actor likes to be constrained in its policy choices. While the functional outcomes of the policy process and choices available to states are limited in the cyber realm, offensive posturing remains an option. States can threaten cyber retaliation in order to restrain a target from escalating a conflict, but the actual method of retaliation is often never in the cyber realm. When China infiltrates the United States in cyberspace, the United States utilizes diplomacy to solve the problem, rather than responding in a tit-for-tat manner. This avoids needless escalation, which could possibly get out of hand. Once again, the demonstration of responsibility of state-based actors defies conventional wisdom. States will even be prevented from using a cheap and quick tactic like cyber methods, because of the consequences of this use of the technology. When confronted with a new dynamic with immense potential, often states are prevented from utilizing the technology because of the difficulties in application, evaluation, and implementation. Valeriano, Brandon; Maness, Ryan C. (2015-04-27). Cyber War versus Cyber Realities: Cyber Conflict in the International System (p. 65). Oxford University Press. Kindle Edition.

Existing norms prevent escalation

Countries only engage in cyber espionage, not war

Going further, we spell out a theory of cyber espionage and how cyber terrorism will be utilized by states. Here we define cyber espionage as the use of dangerous and offensive intelligence measures to steal, corrupt, or erase information in the cybersphere of interactions. What is unusual about cyber espionage is the paradox of the tactic being common, but also literally the least a state can do. When cyber actions are exhibited, they tend to be low-level espionage actions that do not rise to the level of conflict or warfare. States seem to be very measured and concentrated in their cyber espionage activities. They take action for specific reasons if there is a demonstrated weakness in a target. If a target seems to take few measures to protect the home base and its resources, the initiator will exploit the vulnerability. In the espionage realm, states seem to be doing the least they can, given that their demonstrated capabilities often far outweigh their actual expressions of activity. States will restrain themselves from unleashing the full weight of their cyber capabilities, because the damage done is not worth the costs. Simple cost-benefit analysis would suggest that this will be the course of cyber operations in the future, yet the discourse takes on a troubling and inflammatory tone, in terms of what others predict. In short, some hype the collective fears in the system for their own ends. What we end up seeing in this domain is spycraft, not warcraft. Operations are taken to exploit a weakness in security, rather than operations taken to exploit or crush a target. Choices in the cyber realm are not made based on a need to infiltrate a target, but almost solely on the opportunity to hit a target based on its failures to secure basic protection. When the walls are down, the state will do what it can to gather information. When the walls are up, the state will be restrained and will not seek to use methods to break down the walls, because there will be consequences for these actions. China has been notorious for finding and exploiting gaps in American cyberspace defenses, but it has also sought to limit its conflictual interactions with the United States in most other realms. In this way, we see cyber espionage activities as a method to make known what can be done in relation to defense gaps, rather than a method to seek exploitation based on offensive capabilities. Valeriano, Brandon; Maness, Ryan C. (2015-04-27). Cyber War versus Cyber Realities: Cyber Conflict in the International System (pp. 49-50). Oxford University Press. Kindle Edition.

Cyberwar is less destructive than conventional war

Rid (2013: 142) makes the interesting point that since cyber war is not taking place in the form of violence, death, and destruction, cyber conflict actually reduces the amount of overall violence between states. Activities such as espionage and subversion become more cost-effective (Rid 2013: 142), but also more benign and less risky in some senses. This is an interesting path, but no one has sought to follow it, to dissect the context of cyber conflict between states, and to examine their impact. Valeriano, Brandon; Maness, Ryan C. (2015-04-27). Cyber War versus Cyber Realities: Cyber Conflict in the International System (p. 43). Oxford University Press. Kindle Edition.

Managed relations and threats of collateral damage keep cyber warfare limited

The corresponding logic here is that while rivals will use cyber operations against each other, the level of the cyber incident will be minimal and infrequent. Rivals learn to manage their relations with each other. There are periods of tension, escalation, and war, but by and large the modal outcome is tense cooperation rather than outright violence. Due to the dynamics of restraint, cyber powers will be limited in their use of cyber operations because of the consequences of such actions. Large-scale and devastating incidents will lead to retaliation and international condemnation. Reputation (Crescenzi 2007) concerns are important in international affairs, and the gains of a cyber operation are often not worth the risk of degrading the reputation of the initiating state. Cyber actions will degrade the standing of states because most states refrain from using the technology in the realm of foreign policy. Restraint dynamics straitjacket cyber states into constrained action in order to protect themselves from self-harm. Collateral damage on a civilian population will be punished with conventional means. Unleashing a virus on a command and control operation might seem like a logical and beneficial operation, but it renders a worm ready for dissection and replication right back to the offender. This leads to blowback, which can come in the cyber form but also occurs through conventional means. We argue that advanced cyber operations are a taboo not to be broken. They unleash consequences disproportionate to the benefits of launching cyber disputes. Simple cost-benefit analysis would dictate that cyber operations are going to be limited and constrained as the norms surrounding the issue make the use of the tactic a sacred violation. Targeting civilians is no longer allowed in the international system with the decline in the notion of sovereignty. Lower-level operations against the military are often unsuccessful as the target is protected and knows it will be the focus of action. Failure to protect the target is often the main reason for an infiltration in the first place. If an army is out in the open, exposed to the elements including aerial attack, bombardment, and attacks from the higher ground, do we blame the tactics used against them or the failures in leadership inherent in the target? Cyber operations are real and proliferating. Yet, they are mainly lower-level operations utilized to expose some real weakness in the target rather than a demonstration of the power of the initiating side.

Table 4.6 shows which methods are used for the initiating states’ objectives in international cyber conflict. The objectives of the initiators for cyber disputes are at an overall low to average severity level, with disruptions at an average of 1.39, espionage at 2.39, and attempts to change state behavior at 2. Advanced persistent threats (APTs) are the most severe methods, with an average score of 2.09 for espionage objectives and 2.73 for behavioral change objectives. Infiltrations are the second most severe, with an average of 1.85 for disruptions, 2.29 for espionage, and 2.67 for coercion. Intrusions are used primarily for espionage campaigns and are a favorite method of the Chinese, but have also been used as disruptions. For these methods we recorded an average severity score of 1.00, 1.85, and 3.00, respectively. DDoS methods register with less severe scores, at 1.06 for disruptions and 1.00 for behavioral change. Finally, vandalism records scores of 1.01 for disruptions and 1.00 when used as a tool of propaganda in attempts to change the policies of states. What is significant here is that none of these methods is above the severity level of three; thus our data show that cyber conflict is being waged at a manageable and overall low level. Valeriano, Brandon; Maness, Ryan C. (2015-04-27). Cyber War versus Cyber Realities: Cyber Conflict in the International System (p. 90). Oxford University Press. Kindle Edition.

Directory: uploads
uploads -> 587 Return function, r i(X) r i(0) r i(1) r i(2) r i(3) 1 0 2 4 6 Thermal Station, I 2 0 1 5 6 3 0 3 5 6 10
uploads -> Department of science and humanities department of mathematics part-a questions and answers
uploads -> The Case Against the nypd’s Quota-Driven ‘Broken Windows’ Policing What Is It?
uploads -> For want of a nail
uploads -> Ownership Models There are two different types of ownership models
uploads -> Police Militarization
uploads -> City of rising star regular meting thursday, july 14, 2016
uploads -> Township of winfield
uploads -> Stop Militarizing Law Enforcement Act of 2014
uploads -> The Black Panther Party’s Ten-Point Program What We Want Now!

Download 1.51 Mb.

Share with your friends:

1 ... 16 17 18 19 20 21 22 23 ... 29

It’s a good Topic

Cyber Security Answers General Defense