Risk
2/17/2011
07:44 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Cyberwar: Experts Have Hard Time Defining It, Let Alone Defending Against It

Rather than wait for a catastrophic event, government and private industry should develop a framework for dealing with state sponsored attacks aimed at the critical infrastructure.

Rather than wait for a catastrophic event, government and private industry should develop a framework for dealing with state sponsored attacks aimed at the critical infrastructure.Although, after watching the panel, one wasn't left with any level of confidence that such a plan would be put into place.

The panel, Cyberwar, Cybersecurity, and the Challenges Ahead, moderated by James Lewis, director and senior fellow at the Center for Strategic and International Studies included Michael Chertoff, former Secretary of Homeland Security; Bruce Schneier, chief technology security officer at BT; and McConnell, former director of national intelligence and former director of the NSA.

To kick things off, James Lewis asks the audience if Stuxnet, operation Aurora, and other similar attacks are, indeed, acts of cyberwar. Some hands went up in agreement that those types of events are acts of war, more attendees however didn't think so.

The panel seemed no more capable of hanging a definition to the term, either. But they did agree, generally, that there is a lot of nastiness that needs to be better controlled. As CSIS' Lewis put it: "We are not in a state of cyberwar, but we are in something that is dangerous."

What do we do about it? Chances are the nation will wait for some catastrophic event argued former intelligence chief Mike McConnell. McConnell expressed doubt that the nation would come together to put into place the policies and public/private partnerships necessary to defend state-sponsored advanced attacks against the critical infrastructure.

McConnell and Chertoff also agreed that vanilla digital espionage and information theft don't rise to Cyberwar. And any such designiation would depend on the scale and the amount of data destroyed in an attack. "I tend to look at security as a spectrum of challenges, and I draw a bright line between theft and espionage and then the destruction of systems," Certoff said. "It depends upon the scale [of the destruction] and its genesis as to whether it is war," he said.

To crystallize his point, Certoff said that as a nation we tolerated state-level spying and the stealing of national secrets without labeling it an act of war, but added that "stealing and espionage are much different things that a sustained attack on the power grid."

Schneier, however, made a case that Cyberwar is a sexy term and a term that sells and opens government budget coffers. "There's a lot of push for budget and power and overstating the threat is a good way to get people scared."

Regardless, it's a dangerous Internet and likely to stay that way for some time. As for potential solutions, the panel put forth little more than increasing regulatory demands on companies to secure their networks and increasing the liability responsibilities for those that fail to protect their systems.

So, as we've dealt with viruses, e-mail based attacks, worms, network breaches, and most every other type of attack - so too will we probably deal with state-backed cyber attacks. And that's to deal with it after the fact, just as McConnell predicts.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9605
Published: 2015-09-04
WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and create a system backup tarball, restart the server, or stop the filters on the server via a ' (single quote) character in the login and password parameters to webup...

CVE-2015-5612
Published: 2015-09-04
Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image.

CVE-2015-5688
Published: 2015-09-04
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.

CVE-2015-6807
Published: 2015-09-04
Cross-site scripting (XSS) vulnerability in the Mass Contact module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer mass contact" permission to inject arbitrary web script or HTML via a category label.

CVE-2015-6808
Published: 2015-09-04
Cross-site scripting (XSS) vulnerability in the Spotlight module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title.

Dark Reading Radio
Archived Dark Reading Radio
Another Black Hat is in the books and Dark Reading was there. Join the editors as they share their top stories, biggest lessons, and best conversations from the premier security conference.