Risk
1/18/2011
09:15 AM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Cyber Warfare Risks Overblown

Calls for military oversight of cybersecurity distract from protecting against legitimate threats, said the Organization for Economic Cooperation and Development.

Top 10 Security Stories Of 2010
(click image for larger view)
Slideshow: Top 10 Security Stories Of 2010
Will we see cyberwar in our lifetime? According to a report released on Friday, it's unlikely that "an event with the characteristics of conventional war but fought exclusively in cyberspace" will ever occur, or have any kind of global impact.

So says the new Organization for Economic Co-operation and Development report, "Reducing Systemic Cybersecurity Risk," written by Peter Sommer, a visiting professor at London School of Economics, and Ian Brown, senior research fellow at Oxford Internet Institute at Oxford University.

According to the report, the best way to combat online attacks is to practice the basics: create secure code, monitor for malware and intrusions, educate users, and always have an attack and recovery response plan in place for the attacks that inevitably do get through.

But today's penchant for sensationalizing even small incidents as major attacks -- and labeling them as cyberwar or cyber terrorism -- actually makes organizations and government agencies less prepared for dealing with the harmful and damaging types of attacks they continue to face.

Interestingly, the report also notes that despite legislators' focus on securing the nation's critical infrastructure, the vast majority of said infrastructure remains in the hands of private companies. Of course, these companies are ultimately responsible to shareholders, rather than government appeals for cooperation or military oversight.

Accordingly, militarizing all cyberspace is not only unnecessary, but wouldn't produce much of an effect. "We think that a largely military approach to cybersecurity is a mistake. Most targets in the critical national infrastructure of communications, energy, finance, food, government, health, transport, and water are in the private sector," said Brown, a critical infrastructure expert who's consulted for the Department of Homeland Security and the European Network and Information Security Agency, among other organizations.

Furthermore, unlike conventional warfare, the military's cyberweapons -- hacking, malicious code, denial of service attacks, rootkits, social engineering -- don't offer any useful deterrence, since attackers can use zombie PCs controlled by a botnet to launch untraceable attacks.

Why, then, is there so much discussion about the role that the United States military must play in protecting the nation's critical infrastructure as well as systems at large? Together with poor analysis and inexact language, the report authors cite "heavy lobbying" as a factor.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: LOL.
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6213
Published: 2014-04-19
Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 Patch 1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1833.

CVE-2013-6214
Published: 2014-04-19
Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 9.05, 10.01, and 10.10 allows remote authenticated users to obtain sensitive information via unknown vectors, aka ZDI-CAN-2042.

CVE-2014-0778
Published: 2014-04-19
The TCPUploader module in Progea Movicon 11.4 before 11.4.1150 allows remote attackers to obtain potentially sensitive version information via network traffic to TCP port 10651.

CVE-2014-1974
Published: 2014-04-19
Directory traversal vulnerability in LYSESOFT AndExplorer before 20140403 and AndExplorerPro before 20140405 allows attackers to overwrite or create arbitrary files via unspecified vectors.

CVE-2014-1983
Published: 2014-04-19
Unspecified vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x before 3.1.1 allows remote attackers to cause a denial of service (CPU consumption) via unknown vectors.

Best of the Web