Risk
1/18/2011
09:15 AM
50%
50%

Cyber Warfare Risks Overblown

Calls for military oversight of cybersecurity distract from protecting against legitimate threats, said the Organization for Economic Cooperation and Development.

Top 10 Security Stories Of 2010
(click image for larger view)
Slideshow: Top 10 Security Stories Of 2010
Will we see cyberwar in our lifetime? According to a report released on Friday, it's unlikely that "an event with the characteristics of conventional war but fought exclusively in cyberspace" will ever occur, or have any kind of global impact.

So says the new Organization for Economic Co-operation and Development report, "Reducing Systemic Cybersecurity Risk," written by Peter Sommer, a visiting professor at London School of Economics, and Ian Brown, senior research fellow at Oxford Internet Institute at Oxford University.

According to the report, the best way to combat online attacks is to practice the basics: create secure code, monitor for malware and intrusions, educate users, and always have an attack and recovery response plan in place for the attacks that inevitably do get through.

But today's penchant for sensationalizing even small incidents as major attacks -- and labeling them as cyberwar or cyber terrorism -- actually makes organizations and government agencies less prepared for dealing with the harmful and damaging types of attacks they continue to face.

Interestingly, the report also notes that despite legislators' focus on securing the nation's critical infrastructure, the vast majority of said infrastructure remains in the hands of private companies. Of course, these companies are ultimately responsible to shareholders, rather than government appeals for cooperation or military oversight.

Accordingly, militarizing all cyberspace is not only unnecessary, but wouldn't produce much of an effect. "We think that a largely military approach to cybersecurity is a mistake. Most targets in the critical national infrastructure of communications, energy, finance, food, government, health, transport, and water are in the private sector," said Brown, a critical infrastructure expert who's consulted for the Department of Homeland Security and the European Network and Information Security Agency, among other organizations.

Furthermore, unlike conventional warfare, the military's cyberweapons -- hacking, malicious code, denial of service attacks, rootkits, social engineering -- don't offer any useful deterrence, since attackers can use zombie PCs controlled by a botnet to launch untraceable attacks.

Why, then, is there so much discussion about the role that the United States military must play in protecting the nation's critical infrastructure as well as systems at large? Together with poor analysis and inexact language, the report authors cite "heavy lobbying" as a factor.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7266
Published: 2015-02-01
Algorithmic complexity vulnerability in Cybozu Remote Service Manager through 2.3.0 and 3.x through 3.1.2 allows remote attackers to cause a denial of service (CPU consumption) via vectors that trigger colliding hash-table keys. NOTE: this vulnerability exists because of an incomplete fix for CVE-2...

CVE-2014-7269
Published: 2015-02-01
ASUS JAPAN RT-AC87U routers with firmware 3.0.0.4.378.3754 and earlier, RT-AC68U routers with firmware 3.0.0.4.376.3715 and earlier, RT-AC56S routers with firmware 3.0.0.4.376.3715 and earlier, RT-N66U routers with firmware 3.0.0.4.376.3715 and earlier, and RT-N56U routers with firmware 3.0.0.4.376....

CVE-2014-7270
Published: 2015-02-01
Cross-site request forgery (CSRF) vulnerability on ASUS JAPAN RT-AC87U routers with firmware 3.0.0.4.378.3754 and earlier, RT-AC68U routers with firmware 3.0.0.4.376.3715 and earlier, RT-AC56S routers with firmware 3.0.0.4.376.3715 and earlier, RT-N66U routers with firmware 3.0.0.4.376.3715 and earl...

CVE-2014-8630
Published: 2015-02-01
Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by shel...

CVE-2014-9200
Published: 2015-02-01
Stack-based buffer overflow in an unspecified DLL file in a DTM development kit in Schneider Electric Unity Pro, SoMachine, SoMove, SoMove Lite, Modbus Communication Library 2.2.6 and earlier, CANopen Communication Library 1.0.2 and earlier, EtherNet/IP Communication Library 1.0.0 and earlier, EM X8...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.