Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/18/2017
02:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

The Future of Democratic Threats is Digital

Public policy and technological challenges take center stage as security leaders discuss digital threats to democracy.

CYBERSEC EUROPEAN CYBERSECURITY FORUM - Kraków, Poland - Technology has transformed the geopolitical landscape and nature of conflict, said Sean Kanuck, director of Future Conflict and Cyber Security at the International Institute for Strategic Studies last week.

"Cyber operations are being used to achieve traditional, economic, political, and criminal ends," he emphasized in his keynote for the conference's State track. "The challenges to global interoperability are not limited by physical connectivity of networks."

Kanuck listed a few key strategic trends in cyber conflict: offensive operations below the level of armed conflict, private sector companies as enablers and targets, automation and higher visibility, collateral damage, and data manipulation and fabricated information campaigns.

Cyberattacks to influence democracy are stealthier; crafted to cause uncertainty. "What we actually see is nation-states intentionally operating below the threshold of armed attack that would lead to military response," he explained. "Citizens are unsure who perpetrated attacks."

The idea of compromising users' trust in the democratic system is at the foundation of many geopolitical threats, said Janis Sarts, director of the NATO Strategic Communications Centre of Excellence in Latvia. He pointed to recent attacks on voting systems as an example.

"When you think, 'What is the fundamental element of democratic society?' -- that is elections. We trust it will bring us results," he explained in a panel titled "From Cyber With Love: Digital Threats to Democracy."

"If you take away trust, either by hacking or by making people believe you did, it's enough," he continued.

Michael Chertoff, cofounder and executive chairman at the Chertoff Group and former US Secretary of Homeland Security, pointed to attacks on integrity of information and their ability to manipulate people. He pointed to attacks on media and advertising as an example.

"We haven't really appreciated what it means to lose control of information, including information about ourselves," he said. "The EU is ahead of the United States in realizing what it means to have someone else control your data."

Threats to critical infrastructure

Some threats don't target citizens' trust but critical infrastructure and the economy.

"The IoT and poorly designed devices that are easily infected present a real threat to the US economy," says Melissa Hathaway, president of Hathaway Global Strategies and former cybersecurity advisor for the George W. Bush and Barack Obama administrations, in an interview with Dark Reading.

"There needs to be an urgent focus on the few problems that affect many," she continues, citing energy, telecommunications, and finance as three sectors vulnerable to cyberattacks. "It's easy to disrupt service and get malware to destroy capabilities, and we lack resilience."

Hathaway emphasizes the importance of collaborating with allies, fixing infrastructure, and focusing on trade and diplomacy. Right now, the United States is more worried about cyber weaponry than how cyberattacks could influence its economic structure, she explains. Cybersecurity isn't always about inbound weapons, but about economic opportunity based on how actors change market forces.

We need to engage -- and right now, she says, the US is not engaging. It's critical to work with all nations in diplomatic exchanges, not only those which are like-minded. "I mean real diplomatic negotiations, understanding what the other side wants," Hathaway explains.

The Internet is core to international interactions, trade negotiations, and communications technology. It could present a real risk, and any nation could abuse it. "Anybody can be a geopolitical threat depending on how they use or misuse technologies and market forces," she says.

Fellow experts agree the issue of democratic threats is as much about public policy as it is about tech.

"Cybersecurity lies at the interface of a number of different areas -- home, abroad, civilian, and military," said Sir Julian King, European commissioner for the UK Security Union, in his opening keynote remarks. "Many different actors need to be involved when [a cyberattack] happens, and they need to work together swiftly and efficiently."

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
10/22/2017 | 10:49:15 AM
Long problematic
Considering that (1) security researchers have been pointing out the technical flaws with actual digital voting for years and (2) we still haven't resolved the issues of low-tech threats (e.g., actual coercion, ballot-box stuffing, etc.), these sudden realizations are neither surprising nor promising.
Cloud Security Threats for 2021
Or Azarzar, CTO & Co-Founder of Lightspin,  12/3/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Assessing Cybersecurity Risk in Todays Enterprises
Assessing Cybersecurity Risk in Todays Enterprises
COVID-19 has created a new IT paradigm in the enterprise and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-29572
PUBLISHED: 2020-12-06
app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field.
CVE-2020-29573
PUBLISHED: 2020-12-06
sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\...
CVE-2020-27772
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in coders/bmp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned int`. This would most likely lead to an impact to application availability, but could po...
CVE-2020-27773
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/gem-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned char` or division by zero. This would most likely lead to an impact to appli...
CVE-2020-28950
PUBLISHED: 2020-12-04
The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges during installation process.