How To Avoid All-Out War in Cyberspace

china-preparing-to-wage-war-in-cyberspace.jpg

While some fear the Internet will be a primary battlefield for future societies, this alarmism is a bit premature. 

Restraint is the strategic underpinning of how many states confront cyber actions. Despite calls for a response to cyber aggression, the U.S. government still has not decided on a viable reaction given limited options. 
As David Sanger recounts in the New York Times, “in a series of classified meetings, officials have struggled to choose among options that range from largely symbolic responses … to more significant actions that some officials fear could lead to an escalation of the hacking conflict between the two countries.”

Strategic restraint tends to defy a form of conventional wisdom that sees the future of cyberspace as a lawless wild west where anything goes and offensive capabilities need to be built up in order to deter an adversary. This defines the tone of the New York Times story. In fact, some of the most cantankerous states in cyberspace tend to behave in a responsible manner because to act otherwise would invite terrible consequences.

Why do governments tend to not respond to cyber actions? According to our research, despite the massive influx of cyber operations that we are aware of we find little evidence of the escalation processes inherent in typical conflicts. In fact, we might be witnessing an era of Cyberpeace. States operating in cyberspace react differently than in most strategic domains, a reality that drastically differs from perception given the way the news media reports the latest cyber violation as if it is the spark of a new onslaught and validation of the concept of cyberwar. There are two reasons for this: the dynamics of restraint and the development of cyber norms.

It’s easy to assume that the United States and other nations would “hack back” when their systems are targeted by adversaries. In fact, many private companies are moving towards this position after their networks are compromised. Yet government officials tend to understand something that private individuals do not: the inner workings of a bureaucracy are complex and dangerous. Needlessly provoking an escalatory response in a domain where both sides are wholly unprotected and borderline incompetent would be strategic suicide. For this simple reason we often see restraint. There is also the reality states will spy on each other, and sometimes even admire their adversaries’ work.
The U.S. government has so far refrained from responding to the OPM hack. If there is a response, we predict it will likely come through criminal charges on individuals, not the Chinese state. In fact, the great majority of cyber incidents in our data go without a response in the cyber or the conventional domains. A total of seventy-eight percent of cyber actions we code go without a counterstrike. Of those with responses, seventeen (fifteen percent) come in the form of a cyber response—with only two cases of escalation in severity—and seven conventional responses (six percent). The non-response is the typical response, by an overwhelming margin.

d9e1e_responses-to-a-cyber-incident1.jpg

The lack of escalatory activity can also be explained by a system of norms the United States and others seek to enforce in cyberspace. Like traffic laws, a basic understanding of how things work and what limitations exist benefit everyone. Of course there will be violators, but everyone needs to understand the rules of the road first. Even China and Russia appear to be willing to work within some system of norms, though they disagree with the United States on what the norms should be. Nevertheless, Russia and China are engaging in norms-setting institutions and process, such as the devolution of the Internet Corporation for Assigned Names and Numbers, recognizing that a rules-based framework is important to manage the growth of global connectivity.

While many may scoff at the idea of norms, they can be effective means to control the basic behaviors of the majority of actors. Of course there will always be deviants, but as long as we have clear systems of norms, deviancy will be seen as just that—out of the norm.

This all bodes very well for our cyber future. While there is fear that the Internet will be primary threat vector for future societies, this alarmism is a bit premature and primarily based on the lack of understanding of how cyberspace works. We fear what we do not understand. Cyberspace can be controlled and made safe, but this requires us to understand it, to be aware of the possible escalation dynamics at hand in each conflict, and to be take in all available sources of information instead of relying on a few. Given the convergence of the basics of restraint and norms, even the most aggressive of states can be shown to be peaceful actors in cyberspace, even when being poked.
DefenseOne: http://bit.ly/1MhKdVG

 

 

« Inside the FBI Cyber Division
Artificial Intelligence Decodes ISIS »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

it-sa 365

it-sa 365

it-sa 365 is a digital platform for connecting IT security vendors and experts with those who bear responsibility for IT security in management and technology.

GardPass Cyber Security

GardPass Cyber Security

GardPass Cyber specializes in cyber security recruitment and also offers complementary services such as security assessments and advice.

RiskSense

RiskSense

RiskSense empowers enterprises and governments to reveal cyber risk, quickly orchestrate remediation, and monitor the results.

PakCERT

PakCERT

PakCERT is the national Computer Emergency Response Team for Pakistan.

Swiss Re

Swiss Re

Swiss Re Group is a leading wholesale provider of reinsurance, insurance and other insurance-based forms of risk transfer including cyber risk.

UM Labs

UM Labs

UM Labs is a developer of security products for Voice over IP (VoIP), protecting SIP trunk connections, safeguarding mobile phone communications and enabling BYOD.

MASS

MASS

MASS provides world-class capabilities in electronic warfare operational support, cyber security, information management, support to military operations and law enforcement.

GlassSquid

GlassSquid

glasssquid.io simplifies your cyber security job search. We want to help you find your next perfect fit opportunity by removing the confusion.

Arctic Wolf Networks

Arctic Wolf Networks

Arctic Wolf Networks delivers the industry-leading security operations center (SOC)-as-a-service that redefines the economics of cybersecurity.

NSA Career Development Programs

NSA Career Development Programs

NSA offers entry-level programs to help employees enhance their skills, improve their understanding of a specific discipline and even cross-train into a new career field.

Aversafe

Aversafe

Aversafe provides individuals, employers and certificate issuers around the world with a first line of defense against credential fraud.

CloudBolt Software

CloudBolt Software

CloudBolt provide solutions for your toughest cloud challenges. From automation, to cost and security, and hybrid IT governance — we have you covered.

INVISUS

INVISUS

INVISUS protects businesses against the latest cyber risks – including business and employee identity theft, data breaches, and cybersecurity compliance.

AlJammaz Technologies

AlJammaz Technologies

AlJammaz Technologies is the leading Technology Value-Added Distributor, which distributes advanced technology products, solutions and services in area including networking and cybersecurity.

Credible Digital Security Pvt. Ltd. (CDSPL)

Credible Digital Security Pvt. Ltd. (CDSPL)

CDSPL is an innovative Cyber Security Services Company in India. We are committed to offering cyber security solutions for important sectors such as energy and utilities, healthcare, and more.

National Cybersecurity Alliance

National Cybersecurity Alliance

The National Cybersecurity Alliance is a non-profit organization on a mission to create a more secure, interconnected world.