Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/18/2017
02:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

The Future of Democratic Threats is Digital

Public policy and technological challenges take center stage as security leaders discuss digital threats to democracy.

CYBERSEC EUROPEAN CYBERSECURITY FORUM - Kraków, Poland - Technology has transformed the geopolitical landscape and nature of conflict, said Sean Kanuck, director of Future Conflict and Cyber Security at the International Institute for Strategic Studies last week.

"Cyber operations are being used to achieve traditional, economic, political, and criminal ends," he emphasized in his keynote for the conference's State track. "The challenges to global interoperability are not limited by physical connectivity of networks."

Kanuck listed a few key strategic trends in cyber conflict: offensive operations below the level of armed conflict, private sector companies as enablers and targets, automation and higher visibility, collateral damage, and data manipulation and fabricated information campaigns.

Cyberattacks to influence democracy are stealthier; crafted to cause uncertainty. "What we actually see is nation-states intentionally operating below the threshold of armed attack that would lead to military response," he explained. "Citizens are unsure who perpetrated attacks."

The idea of compromising users' trust in the democratic system is at the foundation of many geopolitical threats, said Janis Sarts, director of the NATO Strategic Communications Centre of Excellence in Latvia. He pointed to recent attacks on voting systems as an example.

"When you think, 'What is the fundamental element of democratic society?' -- that is elections. We trust it will bring us results," he explained in a panel titled "From Cyber With Love: Digital Threats to Democracy."

"If you take away trust, either by hacking or by making people believe you did, it's enough," he continued.

Michael Chertoff, cofounder and executive chairman at the Chertoff Group and former US Secretary of Homeland Security, pointed to attacks on integrity of information and their ability to manipulate people. He pointed to attacks on media and advertising as an example.

"We haven't really appreciated what it means to lose control of information, including information about ourselves," he said. "The EU is ahead of the United States in realizing what it means to have someone else control your data."

Threats to critical infrastructure

Some threats don't target citizens' trust but critical infrastructure and the economy.

"The IoT and poorly designed devices that are easily infected present a real threat to the US economy," says Melissa Hathaway, president of Hathaway Global Strategies and former cybersecurity advisor for the George W. Bush and Barack Obama administrations, in an interview with Dark Reading.

"There needs to be an urgent focus on the few problems that affect many," she continues, citing energy, telecommunications, and finance as three sectors vulnerable to cyberattacks. "It's easy to disrupt service and get malware to destroy capabilities, and we lack resilience."

Hathaway emphasizes the importance of collaborating with allies, fixing infrastructure, and focusing on trade and diplomacy. Right now, the United States is more worried about cyber weaponry than how cyberattacks could influence its economic structure, she explains. Cybersecurity isn't always about inbound weapons, but about economic opportunity based on how actors change market forces.

We need to engage -- and right now, she says, the US is not engaging. It's critical to work with all nations in diplomatic exchanges, not only those which are like-minded. "I mean real diplomatic negotiations, understanding what the other side wants," Hathaway explains.

The Internet is core to international interactions, trade negotiations, and communications technology. It could present a real risk, and any nation could abuse it. "Anybody can be a geopolitical threat depending on how they use or misuse technologies and market forces," she says.

Fellow experts agree the issue of democratic threats is as much about public policy as it is about tech.

"Cybersecurity lies at the interface of a number of different areas -- home, abroad, civilian, and military," said Sir Julian King, European commissioner for the UK Security Union, in his opening keynote remarks. "Many different actors need to be involved when [a cyberattack] happens, and they need to work together swiftly and efficiently."

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
10/22/2017 | 10:49:15 AM
Long problematic
Considering that (1) security researchers have been pointing out the technical flaws with actual digital voting for years and (2) we still haven't resolved the issues of low-tech threats (e.g., actual coercion, ballot-box stuffing, etc.), these sudden realizations are neither surprising nor promising.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/27/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27014
PUBLISHED: 2020-10-30
Trend Micro Antivirus for Mac 2020 (Consumer) contains a race condition vulnerability in the Web Threat Protection Blocklist component, that if exploited, could allow an attacker to case a kernel panic or crash. An attacker must first obtain the ability to execute high-privileged code on the targ...
CVE-2020-27015
PUBLISHED: 2020-10-30
Trend Micro Antivirus for Mac 2020 (Consumer) contains an Error Message Information Disclosure vulnerability that if exploited, could allow kernel pointers and debug messages to leak to userland. An attacker must first obtain the ability to execute high-privi...
CVE-2020-27885
PUBLISHED: 2020-10-29
Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged-in user’s session by stealing cookies which means that a malicious hacker can change the logged-in user’s pass...
CVE-2020-25646
PUBLISHED: 2020-10-29
A flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private key in logs. This directly impacts confidentiality
CVE-2020-26205
PUBLISHED: 2020-10-29
Sal is a multi-tenanted reporting dashboard for Munki with the ability to display information from Facter. In Sal through version 4.1.6 there is an XSS vulnerability on the machine_list view.