Risk
1/18/2011
09:15 AM
Connect Directly
RSS
E-Mail
50%
50%

Cyber Warfare Risks Overblown

Calls for military oversight of cybersecurity distract from protecting against legitimate threats, said the Organization for Economic Cooperation and Development.

Top 10 Security Stories Of 2010
(click image for larger view)
Slideshow: Top 10 Security Stories Of 2010
Will we see cyberwar in our lifetime? According to a report released on Friday, it's unlikely that "an event with the characteristics of conventional war but fought exclusively in cyberspace" will ever occur, or have any kind of global impact.

So says the new Organization for Economic Co-operation and Development report, "Reducing Systemic Cybersecurity Risk," written by Peter Sommer, a visiting professor at London School of Economics, and Ian Brown, senior research fellow at Oxford Internet Institute at Oxford University.

According to the report, the best way to combat online attacks is to practice the basics: create secure code, monitor for malware and intrusions, educate users, and always have an attack and recovery response plan in place for the attacks that inevitably do get through.

But today's penchant for sensationalizing even small incidents as major attacks -- and labeling them as cyberwar or cyber terrorism -- actually makes organizations and government agencies less prepared for dealing with the harmful and damaging types of attacks they continue to face.

Interestingly, the report also notes that despite legislators' focus on securing the nation's critical infrastructure, the vast majority of said infrastructure remains in the hands of private companies. Of course, these companies are ultimately responsible to shareholders, rather than government appeals for cooperation or military oversight.

Accordingly, militarizing all cyberspace is not only unnecessary, but wouldn't produce much of an effect. "We think that a largely military approach to cybersecurity is a mistake. Most targets in the critical national infrastructure of communications, energy, finance, food, government, health, transport, and water are in the private sector," said Brown, a critical infrastructure expert who's consulted for the Department of Homeland Security and the European Network and Information Security Agency, among other organizations.

Furthermore, unlike conventional warfare, the military's cyberweapons -- hacking, malicious code, denial of service attacks, rootkits, social engineering -- don't offer any useful deterrence, since attackers can use zombie PCs controlled by a botnet to launch untraceable attacks.

Why, then, is there so much discussion about the role that the United States military must play in protecting the nation's critical infrastructure as well as systems at large? Together with poor analysis and inexact language, the report authors cite "heavy lobbying" as a factor.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3341
Published: 2014-08-19
The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

CVE-2014-3464
Published: 2014-08-19
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers ...

CVE-2014-3472
Published: 2014-08-19
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVE-2014-3490
Published: 2014-08-19
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have...

CVE-2014-3504
Published: 2014-08-19
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.