CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Search for "intelligence community"

Search Results for: intelligence community

CTO Perspectives on Cyber Security Bill

On June 10, 2010, the US Senate Homeland Security and Governmental Affairs Committee (HSGAC) unveiled a major cybersecurity bill designed to modernize, strengthen, and coordinate US Cyber defenses.

Senators Collins, Carper and Lieberman introduced this bill with the clear articulation to defend not just federal networks but the Internet itself.

The bill itself is named the “Protecting Cyberspace as a National Asset Act of 2010.”

It creates an Office of Cyber Policy in the White House with a director accountable to the public to lead all federal cyberspace efforts and devise national cyberspace strategy.  A National Center for Cybersecurity and Communications within the Department of Homeland Security, also led by a director accountable to the public, to enforce cybersecurity policies through the government and even the private sector.

Some key aspects of this Bill, from the site of the HSGAC:

  1. Creation of an Office of Cyberspace Policy in the Executive Office of the President run by a Senate-confirmed Director, who will advise the President on all cybersecurity matters. The Director will lead and harmonize federal efforts to secure cyberspace and will develop a national strategy that incorporates all elements of cyberspace policy, including military, law enforcement, intelligence, and diplomatic.  The Director will oversee all related federal cyberspace activities to ensure efficiency and coordination.
  2. Creation of a National Center for Cybersecurity and Communications (NCCC) at the Department of Homeland Security (DHS) to elevate and strengthen the Department’s cyber security capabilities and authorities. The Director will regularly advise the President on efforts to secure federal networks.  The NCCC will be led by a Senate-confirmed Director, who will report to the Secretary. The NCCC will include the United States Computer Emergency Response Team (US-CERT), and will lead federal efforts to protect public and private sector cyber and communications networks.
  3. Updates the Federal Information Security Management Act (FISMA) to modernize federal agencies practices of protecting their internal networks and systems. With strong leadership from DHS, these reforms will allow agencies to move away from the system of after-the-fact paperwork compliance to real-time monitoring to secure critical systems.
  4. Requiring the NCCC to work with the private sector to establish risk-based security requirements that strengthen cyber security for the nation’s most critical infrastructure that, if disrupted, would result in a national or regional catastrophe.
  5. Requiring covered critical infrastructure to report significant breaches to the NCCC to ensure the federal government has a complete picture of the security of these sensitive networks.  The NCCC must share information, including threat analysis, with owners and operators regarding risks to their networks. The Act will provide specified liability protections to owners/operators that comply with the new risk-based security requirements.Creation of a responsible framework, developed in coordination with the private sector, for the President to authorize emergency measures to protect the nation’s most critical infrastructure if a cyber vulnerability is being exploited or is about to be exploited. The President must notify Congress in advance before exercising these emergency powers. Any emergency measures imposed must be the least disruptive necessary to respond to the threat and will expire after 30 days unless the President extends them.  The bill authorizes no new surveillance authorities and does not authorize the government to “take over” private networks.
  6. Development of a comprehensive supply chain risk management strategy to address risks and threats to the information technology products and services the federal government relies upon. This strategy will allow agencies to make informed decisions when purchasing IT products and services.
  7. Requiring the Office of Personnel Management to reform the way cyber security personnel are recruited, hired, and trained to ensure that the federal government has the talent necessary to lead the national cyber security effort and protect its own networks.

Now some analysis:

  1. By ensuring the White House will have a Senate-confirmed Director, it will help underscore for the executive branch that this issue should be taken a bit more serious.  Sounds like a prudent thing for the Congress to do.
  2. Creating a National Center for Cybersecurity and Communications (NCCC) in DHS with a leader also confirmed by the Senate sends a similar message, but it also empowers an individual and group to do something that no one has been authorized to do before (at least no one under the rank of President). This office will have authority to lead across government.  As a CTO with enterprise experience I respect this kind of position.  I am convinced you cannot defend large enterprises without the smart application of both central authority and decentralized action.  If you try with either of those missing you fail.  I am not worried about too much technical authority being drawn into one location, there are too many forces at play to keep that power from being abused and, if the person and staff are picked carefully, they will avoid making decisions that impact missions in a negative way.  Notice I have caveated my opinion here.  The nation must choose wisely and put a very smart technology leader in this position.  Someone who can enforce the right standards and give direction when required but can back off and let agency IT leaders run things when required and that person must be smart enough to know when and how to decide what to decide about.
  3. Updating FISMA is long overdue.  Moving towards real-time monitoring is GREAT!  It is the only way I know of to move towards enhancing both security and functionality at the same time.
  4. Naming the NCCC as the focal point for coordination with the federal sector is also a solid move.  It goes without saying, but the NCCC should be staffed and led by very savvy, very social, very action-oriented people.  Without social leaders with high emotional intelligence we stand the risk of getting what we have always gotten here.
  5. As a CTO, I applaud the measures this Bill describes for removing artificial impediments to information sharing.  Government and industry need trust-based relationships and unfortunately too many laws and behaviors that flow from those laws, like FOIA, have damaged those relationships.  Addressing them head on is the right thing to do.  Technologically there are few issues here.  Issues are in policy and the Bill seems to do a good job at addressing some big ones.
  6. Development of a comprehensive supply chain management strategy is another great goal I am glad to see.  There has been a great deal of action lately in establishing coordination mechanisms with senior IT leadership in the country and I believe this will serve as a good foundation for development of a strategy like this.
  7. The human side of technology is one that also needs significant attention and it is good seeing the Bill address this head-on by requiring OPM to reform the way the government leads cyber security personnel.

Some concluding thoughts:

  • I wish I would have raised another issue with the staffers.  I feel bad about this, but I have something I would like to add to the Bill.  I guess I’m too late, but maybe I can get my input to the SSCI or HPSCI instead.  I want to suggest that the US Intelligence Community be tasked with providing a detailed yearly cyber intelligence threat assessment  for unclassified dissemination. The IC does a good job of providing some counterintelligence assessments and frequently mentions cyber in open fora like Congressional Testimony, but I believe this issue deserves a focused, NIE-like report dedicated to this topic.  Of course the IC should also be tasked with support to the NCCC.
  • I found the Bill was full of smart information coordination and information sharing language and constructs.
  • The great work of folks at NSA, Cyber Command (including legacy organizations like JTF-GNO and JFCC-NW), STRATCOM, DHS, NCICC, US CERT, FBI, DC3 and many others must continue and I believe the language in this bill is very respectful of the great work that these groups have been doing.
  • I wonder who the first CTO of the NCCC will be?  That is going to be one cool job!

For more see:

Some humor for the CTO: Dakota Wisdom meets the enterprise

An enterprise technologist from government gave me this piece of humor and I wanted to share it here.  We can all use a laugh in these trying times, right?

I first saw a similar piece when serving in the Pentagon in the summer of 1997.  I heard a version repeated again by retired General Clapper at an intelligence community function. But like many other pieces of wisdom it keeps coming back around.  It has an enduring quality to it.

So here goes:  The CTO’s version of Dakota Wisdom

The tribal wisdom of the Dakota Indians, passed on from generation to generation, says that,

“When you discover that you are riding a dead horse, the best strategy is to dismount.”

However, in the world of the CTO, a whole range of far more advanced strategies are often employed, such as:  When you discover that you are riding a dead horse, the best strategy is to:

1. Buy a stronger whip.

2. Change riders.

3. Threaten the horse with termination.

4. Appoint a committee to study the horse.

5. Arrange to visit other countries to see how others ride dead horses.

6. Lower the standards so that dead horses can be included.

7. Reclassify the dead horse as “living impaired”.

8. Hire outside contractors to ride the dead horse.

9. Harness several dead horses together to increase the speed.

10. Provide additional funding and/or training to increase the dead horse’s performance.

11. Do a productivity study to see if lighter riders would improve the dead horse’s performance.

12. Declare that as the dead horse does not have to be fed, it is less costly, carries lower overhead and therefore contributes substantially more to the bottom line of the economy than do some other horses.

13. Rewrite the expected performance requirements for all horses.

14. Promote the dead horse to a supervisory position.

15. Establish a new CMMI and ITIL activity to optimize the dead horse.

16.  Roll out designs for a new customer-focused Service Oriented Architecture (SOA) leveraging the dead horse.

17.  Declare the dead horse to be part of your cloud computing strategy.

 

 

For more tech see:

Cyber And Physical Security: The discussion continues

Seven years ago I authored a short piece published in Government Security on the tending convergence of cyber and physical security. The piece, titled “Cyber and Physical Security Unite,” is still online at http://govtsecurity.com/mag/cyber_physical_security and still gets periodic attention.

I’ve been asked by some government friends to update my thoughts on the old article I mentioned, and am noodling over how to do that now. If you have any advice/comments/suggestions for me on that I would appreciate it. I’ve reprinted it below.

QUOTE:

Cyber And Physical Security Unite

May 1, 2003 12:00 PM, Bob Gourley

The passion is coming back to the on-again/off-again romance between cyber-security and physical security. Three drivers are putting the excitement back in the relationship: technology, policy and economics.

TECHNOLOGY — Increasingly physical security devices are being computer-enabled. They are also being networked together to provide automated results of physical security status to centralized databases for analysis. Often these devices communicate with each other via wireless circuits. All of this physical security information must be protected, forcing an integration of the cyber- and physical security disciplines. Computers and networks must be protected from both cyber- and physical compromise, of course, which reinforces the connection.

POLICY — In some situations, IT security is run by one organization, personnel security by another, physical security by another, and network operations by another. Each may have its own budget, priorities and processes. This results in seams that adversaries can exploit. Patching these seams requires policies that reinforce coordination and cooperation.

ECONOMICS — Managing the two together can result in more efficient use of budgets and staff time. Integrating physical and cyber security is not without challenges. The disciplines have always been related, but both require different expertise.

No organization should force its physical security guard force to be the computer network response team (or vice versa). Trying to do so is a recipe for failure for both missions. How, then, can organizations find the right balance in integrating physical and cyber security? Here are five suggestions:

  • Respect the expertise requirements and training needs of both disciplines.
  • Allow leaders in both disciplines to have insights into and input to each other’s emergency reaction plans.
  • Ensure coordination prior to acquisition of physical or cyber security devices.
  • Ensure senior management is well versed in the needs of both disciplines.
  • Periodically exercise the entire security force using multiple, realistic scenarios.

UNQUOTE

In thinking about how to update that short piece I thought about what has changed since 2003.  Changes include:

  • We are now more dependent than ever on IT
  • Threats to our cyber structures have been growing
  • There is now more linkage than ever between physical and cyber threats (bad people who operate in cyberspace usually are doing bad things in the real world too, for example, and bad people plotting attacks frequently use cyber to help their malicious purposes).
  • Technology for cyber security has continued to advance and almost everything in the physical world is connected to IP-based communications.
  • There has been a real shift towards all citizens (including fed workers) using social media, resulting in significant information opportunities for the bad guys.
  • There is a more refined national structure for coordinating across critical infrastructure sectors.  There has also been changes in how cyber security coordination occurs.

But many things have remained the same, including:

  • Human nature, including the tendency of humans to focus on the mission they are assigned and, for many reasons, to not focus so much on the mission others are assigned.
  • Bureaucratic politics, much of which flows from human nature, and much of which serves to reduce collaboration and coordination.
  • Pressure on budgets.  There is always a need to watch how money is spent.
  • The importance of both physical security and cyber security is another critical constant.  Both must get done to a level where our country can thrive in tough times. This is an enduring need.
  • And, unfortunately, we are still facing many challenges in optimizing our defenses against both physical and cyber attacks.

Because of all that, how should I update that little article?  I think the give key points I made are still pretty close, but they need to be fleshed out and informed by the many new cyber and physical structures and processes we have in place in enterprises big and small.

The article is definitely in need of an update to be relevant.  If you have any suggestions for me on how to do that please let me know.

Related Reading

An Assessment on the Cyber Threat

How would you describe the threat to the US information infrastructure? If you are a technologist or a national security expert or both I hope you would use your background and experience and expertise and produced a fused-all source assessment based on facts. But it is also ok to cite the masters, folks who really know what they are talking about and are paid to produce the most accurate possible reports. Below is an assessment I extracted from a source I know to be reliable, but to most of you technologists and national security professionals I hope this list will be seen as intuitive statements that ring true to your experience. Please look it over and let me know what you think (I’ll inject some thoughts at the end):

Judgements:

“The fact is that we are currently building an information infrastructure — the most complex systems the world has ever known — on an insecure foundation. We have ignored the need to build trust into our systems. Simply hoping that someday we can add the needed security before it is too late is not a strategy.”

Additionally:

  • We are growing increasingly dependent on information systems for commercial and government activities.
  • Our adversaries recognize this dependence and are developing tools to attack our information systems.
  • Protecting our systems will require an unprecedented level of cooperation between government and the private sector.
  • Protecting our critical information systems and the data on them will be key to our survival as the world’s leading economic power and as the world’s leader in information technology.
  • Our heavy and growing societal and strategic dependence on information technologies and information systems has created vulnerabilities — vulnerabilities to our economic institutions, to the systems that support public needs, to our privacy, and to our military capabilities.
  • The number of known potential adversaries conducting research on information attacks is increasing rapidly and includes intelligence services, military organizations and non-state entities such as terrorism groups.
    Technology will increase the sophistication of their capabilities and will continue to reduce the cost of attack and the risk if security remains where it is today.
  • And the attackers have enormous incentives.Trillions of dollars in financial transactions and commerce moving over a medium that has minimal protection and sporadic law enforcement. Increasing quantities of intellectual property residing on networked systems. And the opportunity to disrupt military effectiveness and public safety, with elements of surprise and anonymity.
  • The state sponsored terrorists and military Information Warfare people pose the greatest risk to our critical infrastructure because they have the greatest knowledge and resources.
  • Foreign governments and their military services are paying increasing attention to the concept of ”Information Warfare”. Foreign military writings discuss the importance of disrupting the flow of information in combat. The battlespace of the future also will extend to our domestic information infrastructure, such as our electric power grids and our telecommunications networks – in short, the very foundations of our economy.
  • We cannot keep building new capabilities on a poor foundation of security. We cannot ignore the need to build trust into our information systems any longer.
  • It is folly to hope that someday we can add needed elements before it’s too late. The longer we wait, the more our country is exposed, and the costlier it will be to address the problem.If we are going to lead the world in information technology we must recreate the trust that existed between our government and our industry that allowed us to lead the free world for over forty years. We still have the power to lead by our example, and we still have the time to do what is right.

I think the information and assessments and powerful thoughts above are right on and should be considered by anyone in the national security and technology space.

The source?  1998 speeches and testimony by then Director of Central Intelligence George Tenet.  I think he pretty much nailed what would happen with the assessment above (read more online at: https://www.cia.gov/news-information/speeches-testimony/1998/dci_speech_040698.html and https://www.cia.gov/news-information/speeches-testimony/1998/dci_testimony_062498.html

In fact, seems like he provided clear an unambiguous warning.

Since then, it seems like very leader in the national security, DoD and Intelligence Space that comes into office seems to muddle on oblivious to the cyber threat till some incident hits them, like Moonlight Maze or the series of intrusions into DoD and other nets over 2007 or the attacks vs Estonia or the attacks vs. Georgia or the attacks vs. Google.  And in each time you get folks saying something like “oh well that was a wake up call.”

Any thoughts on that?

Is there anything that can be done so 12 years from now we are not asking ourselves why people in key positions are still saying things like “oh that was a wake-up call!”?

For more on this topic see the even older warning by CIA Director John Deutch at: Leader Of U.S. Intelligence Community Delivers Clear and Unambiguous Warning of Cyber Threat

Related Posts:

Enhancing IT Support to the Counter Terror Effort: Design Criteria

This is the concluding post on enhancing IT innovation in support of the Counter Terror effort.  The first part focused on the challenge and importance context relevant to design criteria.  This post focuses on design criteria and proposes next steps.

Transforming the Challenge Into Design Criteria:

The legacy IT environment of the counter-terror community is complex.  Changes to the environment must be done by design or they may cause unintended consequences that result in more harm to the system than good. To enable good design, the challenges previously articulated can be captured in explicit goals that the counter-terror IT enterprise must achieve.   Primary Design Criteria are those that must be met in a successful design.  Secondary Design Criteria are those that are highly desirable but not absolutely essential.

Primary Design Criteria.  The counter-terror IT enterprise will possess the following features:

  • Data streams are the feeds of data normally moving across IP-based networks from sensors, databases, command centers and other generators of message traffic and events.
    • Data stream design features supporting humans include the need to provide access to and insight into data streams in a way conducive to immediate understanding of importance.  Alerts on what is occurring in data streams should be provided.  Visualizations of data streams should be provided.  Since humans are the only component of the system which can assess relevance they must be able to inject their assessments of relevance into the data stream. Therefore, analysts/watchstanders/other approved users will be given an ability to rapidly tag information in stream as desired. Data streams must be designed to support humans with many other analytical capabilities including an ability to understand how the enterprise is functioning (data ingest rates, networks/nodes available, bottlenecks, what is nominal performance etc).
    • Data stream design features supporting computer to computer processing will include design of systems to evaluate data streams to produce alerts to users and to evaluate new data in the context of all legacy data (through pattern matching, correlation and database search).  This evaluation step may generate additional alerts.
    • A key note: the counter-terror mission requires data stream’s from from a wide community including communities operating at many different classification levels.  The engineering of solutions that bring these streams together seems to be a very straightforward task but the very high data rates and need for security make this a challenge. There are ways to use software to create cross domain data repositories and that may be the way ahead here. And an enduring challenge is in finding rapid ways to bring on new streams of data from other organizations.  This also requires focused engineering.
  • Databases are holders of and operators on data.
    • Database design features supporting humans include the need to provide enhanced means of accessing, discovering and working with data at rest. People need systems that automatically discover relationships in the data.  Users must also be given ways to assess the relevance of data at rest and then inject assessments of their judgment (users get to give the “so what” of the information).  Humans must be enabled with guided navigation and discovery engines, especially discovery engines that will enable discovery of all variations/spellings of names and locations.
    • Database design features focused on automation include design of a means to evaluate every update to a database in context of previous information in the enterprise. Every update to a database must be evaluated by automated routines to understand how the update related to existing information stores from throughout the enterprise.  When data is found that relates to other data, users must be notified so evaluations can be made on its relevance.  When databases are queried and when discovery engines are run against databases misspellings must not be an issue (modern discovery capabilities return all related results including all potential misspellings).  Multi-lingual search/correlation and other language support tools and information extraction capabilities are also required.

The primary design criteria are summarized in the following matrix:

Secondary Design Criteria.  If at all possible, the counter-terror IT enterprise will possess the following additional features:

  • Designs in this environment should accommodate change.  Open standards and open architecture are a must. Collaborative development environments which enable secure code development and application development lifecycle management are also a must.
  • The mission here places a very high premium on IT security and the protection of privacy.  The legacy architecture and objective design will both continue to emphasize protection of data and privacy.  Additionally, the objective design will work with an existing network and ride on top of existing infrastructure.  This means the objective design will accommodate multiple domains of classification and security policy.
  • A key shortfall in our capabilities (human and machie) is name spellings, however, we don’t do well in challenging people to validate their name entries.  There is a need for a “do you mean…?” feature when people are enterirng data.  Auto-fills driven by data from hundeeds of indexes and databases could help drive this feature.
  • Production of intelligence in living/fluid/dynamic ways is in need of focused attention.  Little engineering needs to be done to accomplish this, but upgrading IT can at times be a good excuse to get the attention of business process owners and can help in improving business processes (we have all seen what IT can do to a bad process, it can automate the bad process and make it far worse).
  • The most significant situations confronting members of the intelligence community are those that require our best thinkers to collaborate together across many systems.  The need to enhance collaboration is a continuing, enduring requirement that should be a consideration in all designs.


Concluding Thoughts:

Redesign and modernization of current systems and the enterprise IT environment supporting counter terror work is a complex task involving far more than just the intelligence community.  It involves a large community of IC providers, IC users, law enforcement, homeland security and IT professionals.  Throughout the redesign of IT for this large community we should ensure computers support humans in ways where humans do what humans do best and computers do what computers do best.

Next Steps:

A useful next step will be to closely examine the entire framework of counter terror systems with the framework above.  This review can inform strategic decisions regarding future design work.

The framework above can also be used in developing requirements and in evaluating commercial technologies which can be relevant to meeting mission needs.  New design criteria do not always need to result in totally new systems.  Frequently existing systems can be improved by configuration changes and CONOP improvements and the design criteria above can aid in discussing those.

A closing note:  This paper addresses a framework for considering key design criteria.  It is the opinion of the author that governance must be addressed in conjunction with systems design.  Technology can help mitigate threats to the nation, but only if the right decisions are made regarding how data flows and that generally requires clear, non-ambiguous community-wide governance structures.

Thoughts for the CTO from 171 BC

I saw an interesting statement reportedly by Lucius Aemilius Paulus Macedonicus (229 BC-160 BC).  This two-time consul of the Roman Republic and noted general during the Third Macedonian War (171 BC – 168 BC) offered guidance prior to his involvement in the war, which may have contributed to his ability to achieve victory in what had previously been a messy stalemated theater.

His guidance on advice and the credible sources of advice follows:

QUOTE:

In every circle, and truly, at every table, there are people who lead armies into Macedonia; who know where the camp ought to be placed; what posts ought to be occupied by troops; when and through what pass that territory should be entered; where magazines should be formed; how provisions should be conveyed by land and sea; and when it is proper to engage the enemy, when to lie quiet and they not only determine what is best to be done, but if any thing is done in any other manner than what they have pointed out, they arraign the consul, as if he were on trial before them. These are great impediments to those who have the management of affairs; for every one cannot encounter injurious reports with the same constancy and firmness of mind as Fabius did, who chose to let his own ability be questioned through the folly of the people, rather than to mismanage the public business with a high reputation.

I am not one of those who think that commanders ought at no time to receive advice; on the contrary, I should deem that man more proud than wise, who regulated every proceeding by the standard of his own single judgment. What then is my opinion? That commanders should be counseled chiefly by persons of known talent, by those who have made the art of war their particular study, and whose knowledge is derived from experience, by those who are present at the scene of action, who see the enemy, who see the advantages that occasions offer, and who, like people embarked in the same ship, are sharers of the danger.

If, therefore, anyone thinks himself qualified to give advice respecting the war which I am to conduct, let him not refuse the assistance to the State, but let him come with me into Macedonia.

He shall be furnished with a ship, a tent, even his traveling charges will be defrayed, but if he thinks this is too much trouble, and prefers the repose of a city life to the toils of war, let him not on land assume the office of a pilot. The city in itself furnishes abundance of topics for conversation. Let it confine its passion for talking to its own precincts and rest assured that we shall pay no attention to any councils but such as shall be framed within our camp. (See LIVY, book 44, chapter 22, Trans. Alfred C. Schlesinger, vol 13, p. 161).

UNQUOTE

What did you think of when you read that? Did you think of strange technical guidance given by a person with no experience in IT that impacted your architecture?  I guess we have all seen that.

I’m also thinking now about the huge amount of kibitzing and complaining and advice from outsiders now being thrust on government IT leaders, especially those in the intelligence community.  It is true there are things that need to change there, but the fact is, it takes someone in the fight to have a real understanding of the complexities of the issues that face the community.

I would certainly like to see more/better mechanisms to get advice and thoughts and help from outsiders to the IT leadership of the intelligence community.  That type of information exchange can always be improved, and lord knows government IT leaders need more help.  But what I would most like to see is a greater number of thought leaders and professionals from industry and academia offering advice founded in a deep understanding of the mission needs and complexities of the IT environment in the intelligence community.

There are many ways to gain that knowledge.  For example, for many the way to learn will be to apply for positions in government and serve directly inside.  Another very close way will be to serve in the defense industrial establishment in a position that gives you exposure to government challenges.  I’ve seen others from the outside, like Tim O’Reilly and Craig Newmark, seek to learn by dedicating time meeting broad swaths of people from all echelons of government.  Others seek to learn by attending government conferences, industry days and related events.  I assume some can also learn a great deal by reading, especially if that reading includes thoughts from a government thought leaders.

Anyway, I thought the Lucius Lucius Aemilius Paulus Macedonicus quote was interesting and worth a read.

For more on these topics:

National Security:

Towards a Cyber Deterrent

Towards a Cyber Deterrent

Bob Gourley

bob.gourley@comcast.net

29 May 2008


The constant exploitation of computer systems attached to the net and the threat of devastating attacks against our critical infrastructures warrants a strategic approach to Cyber Security. Among the ideas being considered is the possible declaration of a national policy of “Cyber Deterrence.” The best way to improve the situation, this theory goes, is to stop the attackers from attacking in the first place.

What must the nation do to successfully declare and execute a deterrence strategy in this domain? Years of focused study on this question by strategic planners, economists, technologists, and academicians in the Cyber Conflict Studies Association (CCSA) have resulted in a framework for discourse on this topic.[1] The examination of cyber deterrence is far from over, but some initial conclusions can already be drawn, and recommendations for more study can be made.

In a national security context, deterrence is an influence strategy designed to prevent attack. It involves understanding adversaries and what motivates them, communicating to adversaries in a way that makes it perfectly clear what behaviors will put them at risk, and demonstrating an ability to respond. Six key challenges have been identified that must be addressed before a deterrence strategy can be put in place for cyber attacks. These challenges are:

· Attribution of Attack

· Knowing the enemy

· Proving we can know who is attacking without undermining how we know

· Deciding and articulating what behaviors to deter

· Establishing and articulating credible responses that are not escalatory

· Operating fast in an environment that impedes our ability to act

Challenge number one: Attribution of Attack.

The primary challenge is one of attribution of attack. You cannot deter unless you can punish and you cannot effectively punish unless you have attribution. Although there are many aspects of attribution, the key challenges are technical ones. The current Internet allows anonymity. And this anonymity can be supplemented when an actor wants to remain undiscovered. Adversaries can spoof addresses, use anonymiser servers, and use open access to the net from a wide range of physical locations.


Challenge number two: Knowing the enemy.

We already know the many kinds of threat actors in cyberspace (Nation State, Terrorist Group, Organized Crime, Hackers, etc), and we have a great deal of experience in defending against them and, unfortunately, suffering losses to them. This experience can help us with our calculations, and can help us articulate requirements to the intelligence community for additional support.


But a deterrence strategy requires even more knowledge. Deterrence requires an understanding of how adversaries view their security and how they assess risk. Deterrence also requires an understanding of of how adversaries might assess their cost/benefits. Adversaries might not be concerned about our responses if they think they will be measured and proportional. Additionally, deterrence strategies will not work for all adversaries (these strategies can only work for actors that are rational, deterrence strategies do not work for those who feel they have nothing to lose). Therefore, a key standing requirement for our intelligence community must be to always understand what our adversaries hold dear, since a deterrence strategy requires us to hold that at risk.


Challenge number three: Proving we can know who is attacking without undermining how we know.

Deterrence in the cyber domain is complicated by the number of participants in cyberspace. There are now over 1 billion PCs in the globe. As of November 2007 there were 3.3 billion cell phone subscribers in the world (past the 50% of the population mark). Any of these PCs or cell phones can be used to participate in or trigger attacks. And in many cases these devices can be recruited to act in ways that the device owner cannot control. Even it we could know which devices are attacking, how do we know who controls the device? Which of the users of these 4.3 billion devices should we be tailoring our strategy for? This type of complexity is different than that addressed in Cold War deterrence models.


For our deterrent to be credible, not only must we have attribution (challenge number one), but we must reveal that we have the power to know who is attacking among all the users in the globe using any of the 4.3 billion end devices connected to the Internet. But if we reveal to adversaries that we have that power, we give them knowledge they can use to create new means to deceive and hide attacks, giving them a way to get around the deterrent.


Challenge number four: Deciding what behaviors to deter and articulating them in ways that do not undermine the strategy.

In the cold war, the primary objective of deterrence was deterrence of nuclear attack. In the cyber realm we need to make some choices. In general, the more we can deter the better. But if we decide to deter more than we can detect, attribute and really respond to, we might not be seen as credible, which undermines the deterrent effect.  We should ask ourselves some questions: Do we seek to have a deterrent strategy that addresses low level hacker activity or  nation state sponsored attacks? Do we seek to deter cyber crime? Do we seek to deter cyber espionage?


Perhaps the bigger challenge is in deciding which behaviors will be articulated in our deterrent strategies. If we clearly articulate what falls inside the deterrent environment we are giving away what lies outside the deterrent environment. Adversaries will know what they can get away with and can get around the deterrent. If our cyber deterrent requires us to make an open declaration of what we hold dear and what we view as expendable we may be revealing too much about our nation’s strengths and weaknesses. If we decide on a more ambiguous articulation it may be so vague that it has no effect. Either extreme may undermine the effort.


Challenge number five: Devising and articulating credible responses that are not escalatory and that do not undermine the deterrent strategy.


To have an effective deterrent we must have a capability to respond. Our responses are by no means limited to responses in cyberspace. The range of responses can span the full spectrum of diplomatic, economic, legal and military responses to include the use of force if required.


Articulating what we will do when attacked in cyberspace raises several challenges, including challenges of proportionality (and those challenges are directly related to credibility). At a minimum, the punishment must outweigh the potential benefits of the attack. And in many cases the way to deter might be to hold an entire nation at risk. Here too we should ask ourselves some questions: Will we articulate a strategy that says cyber espionage will be met with destruction of a nation? That is probably not a credible threat so it undermines the desired deterrent effect. Do we devise methods to corrupt info being stolen by cyber spies? That might pose a good deterrent, but challenge one and two above will need to be addressed for this to work. Will we articulate a strategy that says if the US power grid is attacked by a nation state we will destroy that nation state? That might be a bit more credible of a policy statement, but depending on the country in question that could lead to nuclear escalation. So even that policy statement might not be seen as credible. What adversary would think we would risk nuclear war to prevent cyber attacks?

There is another school of thought in the cyber studies community which posits that we should declare a strategy of deterrence that has more ambiguity, so we will keep our adversaries guessing about what our response may be. This approach might be of use in deterring cyber espionage, for example. In general, for a theory like that to work it should be backed up by a very strong defense and a well functioning internal decision-making process so our actions will not be escalatory by mistake.


Regardless of which school of thought is proven right over time, we must consider ways to communicate our deterrent to a wide range of actors in cyberspace.


Challenge number six: Operating fast in an environment that impedes our ability to act

For deterrence to work, our adversaries must know that the punishment will come and it will defeat them. Since attacks can hit us quickly and can do significant damage while underway, the response needs to be as swift as possible. Operating swiftly can also serve to maximize the deterrent value of future attacks.


This means we must demonstrate a capability to quickly detect who is attacking, and then rapidly determine the appropriate response, and then execute with the speed that we would if we were responding to a nuclear attack. We should have an ability to take away what an adversary cherishes most within minutes of detection of an attack on our systems. And as an aid for future deterrent and for continued international support we will need to offer proof of how we knew what we knew. Additionally, for credibility purposes we must periodically demonstrate the entire mission thread, from detection of an attack to attribution of the attacker to swift punitive measures that overwhelm the attacker.


Wargaming and exercises in this domain consistently demonstrate the complexities in coordinating responses to cyber attacks. [2] Wargames and exercises also demonstrate that current processes require fast elevation into the most senior levels of the national decision-making structure, which slows rather than speeds the process.  Slower decisions means slower responses.   This may very well be an issue that can be solved with more wargaming and more policy work but for now it is a component of a challenge which must be addressed.

The domestic and international legal environment also has impedance effects that slows the ability to attribute who is attacking and slows responses. Slowing attribution undermines deterrence strategies. It may be that changes to domestic and international law can help speed the attribution of cyber attacks and help deter future attacks. But till that is addressed the challenge remains one that today’s strategists must deal with.


Addressing the challenges:

These six challenges have been with us since the start of the Internet age. If there were simple solutions to any of these they would have been solved by now. Addressing these challenges will likely require mobilizing the intellectual capital of a broad swath of experts in industry, academia and government. But meanwhile, the nation has responsibilities to our citizens that require defense. Till a deterrence strategy can be developed that is supportable it is prudent to mount a more vigorous defense.


Mounting a more vigorous defense can help address the deterrence related challenges articulated above. If we can make attacks against our enterprise more costly to attackers then that can make deterrence easier. And if we can protect our most sensitive information from assault then that can remove temptation to attack. And if we can enhance our ability to know all adversaries in cyberspace we can enhance our ability to create more workable solutions to deterrence strategies.


The good news is that new approaches to defense are possible, including significantly strengthened operating systems and new methods of enabling security across the entire technology stack. Identity management and access control can be improved. And the rapid and continuing enhancement of networking technologies will allow significantly enhanced abilities to secure Internet access points and even establish national boundaries in cyberspace if desired. More will need to be done to mount the best possible defense, including using the nation’s education system to ensure all citizens are able to defend their parts of cyberspace and cultivating a positive culture of cyber security in the nation. Treaties that delegitimize the state use of non-state bad actors in cyberspace may also need to be considered.


Intuitively, it seems that mounting a vigorous defense will lay a foundation for a future deterrence based strategy. But this planning assumption is one of many which should be questioned in future research. Strengthening defense while continuing research is the mantra of the day when it comes to cyber defense, cyber deterrence and all other aspects of cyber conflict. Cross-functional, cross-discipline, public and private intellectual work remains before a solid foundation for success can be laid.

[1]For more on the CCSA and its Research Agenda see Dr. James Mulvenon’s “Toward a Cyberconflict Studies Research Agenda.” http://www.cyberconflict.org/pdf/IEEEarticlefinal.pdf

[2] As an exemplar report of a public cyber exercise see: www.dhs.gov/xlibrary/assets/prep_cyberstormreport_sep06.pdf

Gov 2.0: Top 25 Most Fascinating Communicators in Government IT

Crucial Point LLC CTO and Founder Bob Gourley named to the GovFresh list of the Top 25 Most Fascinating Communicators in Government IT.

Gov 2.0: Top 25 Most Fascinating Communicators in Government IT.

We are really honored when we make the award lists. Some of note include:

 

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]