Risk
2/17/2011
07:44 PM
George V. Hulme
George V. Hulme
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Cyberwar: Experts Have Hard Time Defining It, Let Alone Defending Against It

Rather than wait for a catastrophic event, government and private industry should develop a framework for dealing with state sponsored attacks aimed at the critical infrastructure.

Rather than wait for a catastrophic event, government and private industry should develop a framework for dealing with state sponsored attacks aimed at the critical infrastructure.Although, after watching the panel, one wasn't left with any level of confidence that such a plan would be put into place.

The panel, Cyberwar, Cybersecurity, and the Challenges Ahead, moderated by James Lewis, director and senior fellow at the Center for Strategic and International Studies included Michael Chertoff, former Secretary of Homeland Security; Bruce Schneier, chief technology security officer at BT; and McConnell, former director of national intelligence and former director of the NSA.

To kick things off, James Lewis asks the audience if Stuxnet, operation Aurora, and other similar attacks are, indeed, acts of cyberwar. Some hands went up in agreement that those types of events are acts of war, more attendees however didn't think so.

The panel seemed no more capable of hanging a definition to the term, either. But they did agree, generally, that there is a lot of nastiness that needs to be better controlled. As CSIS' Lewis put it: "We are not in a state of cyberwar, but we are in something that is dangerous."

What do we do about it? Chances are the nation will wait for some catastrophic event argued former intelligence chief Mike McConnell. McConnell expressed doubt that the nation would come together to put into place the policies and public/private partnerships necessary to defend state-sponsored advanced attacks against the critical infrastructure.

McConnell and Chertoff also agreed that vanilla digital espionage and information theft don't rise to Cyberwar. And any such designiation would depend on the scale and the amount of data destroyed in an attack. "I tend to look at security as a spectrum of challenges, and I draw a bright line between theft and espionage and then the destruction of systems," Certoff said. "It depends upon the scale [of the destruction] and its genesis as to whether it is war," he said.

To crystallize his point, Certoff said that as a nation we tolerated state-level spying and the stealing of national secrets without labeling it an act of war, but added that "stealing and espionage are much different things that a sustained attack on the power grid."

Schneier, however, made a case that Cyberwar is a sexy term and a term that sells and opens government budget coffers. "There's a lot of push for budget and power and overstating the threat is a good way to get people scared."

Regardless, it's a dangerous Internet and likely to stay that way for some time. As for potential solutions, the panel put forth little more than increasing regulatory demands on companies to secure their networks and increasing the liability responsibilities for those that fail to protect their systems.

So, as we've dealt with viruses, e-mail based attacks, worms, network breaches, and most every other type of attack - so too will we probably deal with state-backed cyber attacks. And that's to deal with it after the fact, just as McConnell predicts.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0607
Published: 2014-07-24
Unrestricted file upload vulnerability in Attachmate Verastream Process Designer (VPD) before R6 SP1 Hotfix 1 allows remote attackers to execute arbitrary code by uploading and launching an executable file.

CVE-2014-1419
Published: 2014-07-24
Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain privileges via unspecified vectors.

CVE-2014-2360
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules allow remote attackers to execute arbitrary code via packets that report a high battery voltage.

CVE-2014-2361
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mode.

CVE-2014-2362
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules rely exclusively on a time value for entropy in key generation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by predicting the time of project creation.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.