Cyber Warfare Risks OverblownCyber Warfare Risks Overblown
Calls for military oversight of cybersecurity distract from protecting against legitimate threats, said the Organization for Economic Cooperation and Development.
January 18, 2011
Top 10 Security Stories Of 2010
(click image for larger view)
Slideshow: Top 10 Security Stories Of 2010
Will we see cyberwar in our lifetime? According to a report released on Friday, it's unlikely that "an event with the characteristics of conventional war but fought exclusively in cyberspace" will ever occur, or have any kind of global impact.
So says the new Organization for Economic Co-operation and Development report, "Reducing Systemic Cybersecurity Risk," written by Peter Sommer, a visiting professor at London School of Economics, and Ian Brown, senior research fellow at Oxford Internet Institute at Oxford University.
According to the report, the best way to combat online attacks is to practice the basics: create secure code, monitor for malware and intrusions, educate users, and always have an attack and recovery response plan in place for the attacks that inevitably do get through.
But today's penchant for sensationalizing even small incidents as major attacks -- and labeling them as cyberwar or cyber terrorism -- actually makes organizations and government agencies less prepared for dealing with the harmful and damaging types of attacks they continue to face.
Interestingly, the report also notes that despite legislators' focus on securing the nation's critical infrastructure, the vast majority of said infrastructure remains in the hands of private companies. Of course, these companies are ultimately responsible to shareholders, rather than government appeals for cooperation or military oversight.
Accordingly, militarizing all cyberspace is not only unnecessary, but wouldn't produce much of an effect. "We think that a largely military approach to cybersecurity is a mistake. Most targets in the critical national infrastructure of communications, energy, finance, food, government, health, transport, and water are in the private sector," said Brown, a critical infrastructure expert who's consulted for the Department of Homeland Security and the European Network and Information Security Agency, among other organizations.
Furthermore, unlike conventional warfare, the military's cyberweapons -- hacking, malicious code, denial of service attacks, rootkits, social engineering -- don't offer any useful deterrence, since attackers can use zombie PCs controlled by a botnet to launch untraceable attacks.
Why, then, is there so much discussion about the role that the United States military must play in protecting the nation's critical infrastructure as well as systems at large? Together with poor analysis and inexact language, the report authors cite "heavy lobbying" as a factor.
About the Author(s)
You May Also Like
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
What's In Your Cloud?Nov 30, 2023
Everything You Need to Know About DNS AttacksNov 30, 2023
Passwords Are Passe: Next Gen Authentication Addresses Today's Threats
How to Use Threat Intelligence to Mitigate Third-Party Risk
Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware
Everything You Need to Know About DNS Attacks
Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
AI in Cybersecurity: Using artificial intelligence to mitigate emerging security risks
Defending Corporate Executives and VIPs from Cyberattacks
Building Immunity: The 2021 Healthcare and Pharmaceutical Industry Cyber Threat Landscape Report