Russian Cyber Strategy And Tactics

Russia views cyber very differently than its western counterparts, from the way Russian theorists define cyberwarfare to how the Kremlin employs its cyber capabilities. The following is a summary of the key findings: 

Russian officials are convinced that Moscow is locked in an ongoing, existential struggle with internal and external forces that are seeking to challenge its security in the information realm. 

The Internet, and the free flow of information it engenders, is viewed as both a threat and an opportunity in this regard. 

• Russian military theorists generally do not use the terms cyber or cyberwarfare. 

Instead, they conceptualise cyber operations within the broader framework of information warfare, a holistic concept that includes computer network operations, electronic warfare, psychological operations, and information operations. 

• In keeping with traditional Soviet notions of battling constant threats from abroad and within, Moscow perceives the struggle within “information space” to be more or less constant and unending. 

This suggests that the Kremlin will have a relatively low bar for employing cyber in ways that US decision makers are likely to view as offensive and escalatory in nature. 

• Offensive cyber is playing a greater role in conventional Russian military operations and may potentially play a role in the future in Russia's strategic deterrence framework. 

Although the Russian military has been slow to embrace cyber for both structural and doctrinal reasons, the Kremlin has signaled that it intends to bolster the offensive as well as the defensive cyber capabilities of its armed forces. During the contingencies in Georgia and Ukraine, Russia appeared to employ cyber as a conventional force enabler

• The Georgia and Ukraine conflicts also provided opportunities for Russia to refine their cyberwarfare techniques and procedures and to demonstrate their capabilities on the world stage. These demonstrations may later serve as a basis to signal or deter Russia's adversaries. 

• Hacktivists and cyber-criminal syndicates have been a central feature of Russian offensive cyber operations, because of the anonymity they afford and the ease with which they can be mobilized. 

However, the crowd-sourced approach that has typified how the Kremlin has utilised hackers and criminal networks in the past is likely to be replaced by more tailored approaches, with the FSB and other government agencies playing a more central role.

Information Warfare 

The Russians generally do not use the terms cyber (kiber) or cyberwarfare (kibervoyna), except when referring to Western or other foreign writings on the topic. 

Instead, like the Chinese, they tend to use the word informatisation, thereby conceptualising cyber operations within the broader rubric of information warfare (informatsionnaya voyna). The term, as it is employed by Russian military theorists, is a holistic concept that includes computer network operations, electronic warfare, psychological operations, and information operations.

In other words, cyber is regarded as a mechanism for enabling the state to dominate the information landscape, which is regarded as a warfare domain in its own right. 

Ideally, it is to be employed as part of a whole of government effort, along with other, more traditional, weapons of information warfare that would be familiar to any student of Russian or Soviet military doctrine, including disinformation operations, PsyOps, electronic warfare, and political subversion. 

Perhaps not surprisingly, given the broad conception of IW in Russian theory, the focus of Russia’s cyber operations also tends to be strategic and long term in nature, rather than operational or tactical. 

While Russian theorists have discussed what they call the information-strike operation against enemy forces, which was evidenced in the 2008 war with Georgia, most actual uses of information weapons in operations have aimed at the domestic “nerves of government” or of society, not combat forces or military command and control. 

Indeed, the “information-psychological” aspect that covers the use of the press and the media broadly conceived against a target’s information space is a key category among many in the Russian definition of Information Operations and Information Warfare. 

This strategic emphasis has, in turn, influenced, or been influenced by, how Russia has organised and postured its cyber forces.

Hacktivists and Criminals 

Cyber hacking groups, or advanced persistent threat (APT) groups, have become a central part of Russia’s cyber-IO toolkit. 

While direct links to the Russian government are difficult to prove conclusively, the Russian government denies that it sponsors any hacker groups, there are a number of groups whose activities are closely aligned with the Kremlin’s objectives and worldview. 

Russia is not unique in this regard: China, Iran, North Korea, and other cyber adversaries have been known to outsource their operations to non-state actors. Where Russia differs from these other adversaries is its success in this regard. To begin with, Russia has been enabled by its ability to draw on a vast, highly skilled, but under-employed community of technical experts. 

Russian and other East European hackers are also widely regarded as the best in the world, to the extent that they are sometimes hired by other states to conduct cyberattacks on their behalf. For example, Russian hackers were suspected of being behind North Korea’s hack of Sony Pictures

Conclusion 

Cyber operations, such as the DNC hack and the attack on the Ukrainian power grid, illustrate that Russia’s cyber capabilities and tactics continue to evolve and adapt. 

Estonia, Georgia, and Ukraine have served as testing grounds and signaling arenas for Russia’s cyber forces, providing opportunities for them to refine their cyberwarfare techniques and procedures while demonstrating their capabilities on the world stage to influence or deter Russia's adversaries. 

The simple DDoS attacks and DNS hijackings that typified Russian cyber operations in Estonia and Georgia have since been overshadowed by more sophisticated tactics and malware tools, such as BlackEnergy and Ouroboros. If the example of Ouroboros is any indication, state-based actors, such as the GRU and FSB, also appear to be playing a more direct role in Russian offensive cyber operations than they did in the past. 

Non-state hackers, criminal syndicates, and other advanced persistent threats will probably remain a constant feature of Russian offensive cyber operations, both for the anonymity they afford and the ease with which they can be mobilised. 

However, as governments and companies around the world have hardened their networks, the basic techniques used by hacktivists and other non-state actors, for instance, redirecting traffic, are no longer as useful as they were five or ten years ago. 

The crowd-sourced approach that has typified how the Kremlin has utilised hackers and criminal networks in the past is likely to be replaced by more tailored approaches, with the FSB and other state agencies conducting network reconnaissance in advance and developing malware to attack specific system vulnerabilities. 

CNA:

You Might Also Read:

What Is The GRU & Who Does It Hack?

Russia And US Offer Competing Visions Of Cyber Normality

« Google Helps Boost High Street Spending
Russian Hackers Have New Weapons »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Senetas

Senetas

Senetas is a leading developer and manufacturer of certified high-assurance encryption solutions, dedicated to protecting network transmitted data without compromising performance.

AML Solutions

AML Solutions

AML Solutions offer a full range of Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) services.

Kenexis

Kenexis

Kenexis is a consulting engineering firm providing services for process hazards analysis, fire and gas mapping, and industrial cybersecurity.

Identify Security Software

Identify Security Software

Our mission is to bring in a new age of autonomous human authentication in the security and identity space.

Asoftnet

Asoftnet

Asoftnet are specialists in IT security, IT forensics, IT service, websites, applications and mobile solutions.

Steganos

Steganos

Steganos offers highly secure and easy to use software tools that protect and secure on and offline data.

Featurespace

Featurespace

Featurespace is a world-leader in Adaptive Behavioural Analytics and creator of the ARIC™ platform for fraud and risk management.

Wise-Mon

Wise-Mon

Wise-Mon is expert in its field of network monitoring and control. We give solutions to huge organizations with tens of thousands of ports, as well as small companies with one switch.

Accredia

Accredia

Accredia is the national accreditation body for Italy. The directory of members provides details of organisations offering certification services for ISO 27001.

Hold Security

Hold Security

Hold Security works with companies of all sizes to provide unparalleled Threat Intelligence services that actually make a difference.

LogicHub

LogicHub

LogicHub is built on the principle that every decision process for threat detection and response can and should be automated.

Pelta Cyber Security

Pelta Cyber Security

Pelta Cyber Security is the cyber security consulting and solutions division of Softworld Inc. We provide staffing and recruitment services as well as consulting and solutions for outsourced projects.

Mindcore Technologies

Mindcore Technologies

Mindcore provide cyber security services, managed IT services and IT consulting services to businesses in NJ, FL, and throughout the United States.

Camelot Secure

Camelot Secure

Camelot Secure Secure360 platform is a holistic redefinition of what world-class cybersecurity strategies can be. Prepare. Protect. Deploy.

WeVerify

WeVerify

WeVerify is a platform for collaborative, decentralised content verification, tracking, and debunking.

Zeus Cloud

Zeus Cloud

Zeus Cloud provide clients with world-class web hosting services to businesses both big and small.