Risk
10/19/2009
10:45 AM
Fritz Nelson
Fritz Nelson
Commentary
Connect Directly
Facebook
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Full Nelson: The Growing Threat Of Cyberwarfare

Many more casualities will pile up, but policy and agreements will prove meaningless against today's anonymous cyberwarrior.

Each F-35 Joint Strike Fighter contains several hundred chips, many of which aren't fabricated in the United States and which, according to some theorists, could be the target of trapdoors. A Wall Street Journal article reported that the F-35 program was recently compromised by an attack using Chinese Internet host systems, and the data stolen was encrypted. An AviationWeek story later downplayed the incident. Cyberthreats.

In 2007, Israel, suspecting a nuclear installation in Syria, sent an air raid to destroy the facility, bypassing Syria's vaunted radar systems. Many speculate that the radar had been tampered with. Cyberwarfare.

Because civilians allegedly drove the Russia-Georgia battle in cyberspace, many refuse to call it war. Likewise, in Estonia, a country was disrupted, money was lost, but no sovereignty was taken, no guns, no victory or defeat. The wars of history don't allow for engines of abstraction, only those of explosives.

Mike McConnell, former director of national intelligence, recently said: "The ability to threaten the U.S. money supply is the equivalent of today's nuclear weapon."

Despite the threats, some experts, including RAND Corp., suggest a slowdown in spending on cyberwar defenses, and there already have been substantial cuts, including the Air Force cybersecurity programs. The government has been mum on developing cyberoffensive capabilities, although many arm-chair pundits have suggested we're building our own trapdoors in the hardware and software we export.

There are, however, several initiatives under way, including building a replica of the Internet to test for vulnerabilities and a DARPA-funded initiative through MIT to test our own ability to examine chips for things like trapdoors (the program is called Trust in IC). Col. Charles Williamson III, the staff judge advocate for Air Force Intelligence, argued in the Air Force Journal for creating a .mil botnet using an army of discarded or aging computers, though he stopped short of calling for civilian zombies.

And then there's policy. Certainly, the rules will need some rewriting. The Geneva and Hague Conventions make civilian involvement in war illegal, but those agreements don't account for cyberwarfare. Melissa Hathaway, former senior director for cyberspace for the National Security Council and Homeland Security Council, made the case to take the discussion international given the widespread nature of these threats. "If we can bring it into some of the policies we're looking at, the synchronization, formulation, rules of engagement, and what is ethical behavior . . . that's one way to address it."

While policy and agreements are nice in theory, they will prove meaningless against today's cyberwarrior. The anonymity of attackers and the thick dossier of attack targets mean more casualties and a call for an ever-more-vigilant defense posture. The painful part is figuring out who may attack, how it will occur, and where it will begin. Indeed, it may have already begun. After all, on the Internet, nobody knows they're in a dogfight.

Fritz Nelson is the Editorial Director for InformationWeek and the Executive Producer of TechWebTV. Fritz writes about startups and established companies alike, but likes to exploit multiple forms of media into his writing.

Follow Fritz Nelson and InformationWeek on Twitter, Facebook, YouTube and LinkedIn:

Twitter @fnelson @InformationWeek @IWpremium

Facebook Fritz Nelson Facebook Page InformationWeek Facebook Page

YouTube TechWebTV

LinkedIn Fritz Nelson on LinkedIn InformationWeek

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0640
Published: 2014-08-20
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to bypass intended restrictions on resource access via unspecified vectors.

CVE-2014-0641
Published: 2014-08-20
Cross-site request forgery (CSRF) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to hijack the authentication of arbitrary users.

CVE-2014-2505
Published: 2014-08-20
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to trigger the download of arbitrary code, and consequently change the product's functionality, via unspecified vectors.

CVE-2014-2511
Published: 2014-08-20
Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop before 6.7 SP1 P28 and 6.7 SP2 before P14 allow remote attackers to inject arbitrary web script or HTML via the (1) startat or (2) entryId parameter.

CVE-2014-2515
Published: 2014-08-20
EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a superuser ticket.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.