Part 1: Introduction and Definitions (posted July 7)
Part 2: Recent Cyber Skirmishes (posted July 10)
Part 3: How Cyberwar Could Happen
Part 4: Implications of Cyberwar
Part 5: What Is to Be Done?

What Are the Prospects for Cyberwar? And What Can You Do to Prepare?

Part 4: What Is to Be Done?

Like Lenin, we must ask, “What is to be done?”

A cyberwar—like any war—is an outcome no one wants. But, given the ready availability and growing power of cyberweapons, the plethora of potential military targets on IT networks, and the many points of friction between competing nation-states, this is an outcome we could all soon face with little or no warning. All organizations need to be able to protect key assets if cyberwar comes, or they will risk becoming collateral damage.

Contingency planning. There should be no doubt as to who is responsible for an organization’s response to a possible cyberwar or other security challenges.  Although cybersecurity programs are typically executed by a Chief Information Officer (CIO), Chief Information Security Officer (CISO), or Chief Security Officer (CSO), the entire leadership team must be committed to cyber preparedness. Beyond enhancing resiliency, this type of preparation will build a mindset that is better able to recognize current and future security risks, navigate the threat landscape in pursuit of business opportunities, and allocate security resources more effectively.

Knowing what you need to know. Contingency planning for cyberwar should include knowing how a potential cyber combatant looks at an organization. The cyber threat landscape—the identity of adversaries, the type of operation they might conduct, and the tools they might use—changes daily, and it’s affected by where and how an organization does business, how it conduct business, and who it does business with.

Organizations need to be able to identify the most important assets to protect in the event of cyberwar. If they try to protect everything, in the end they will protect nothing. Understanding both the threat landscape and an organization’s critical assets is essential to crafting a strong and resilient contingency plan.  A major component of this is to be able to know what critical assets are and who is responsible for them.  Organizations also must understand the architecture of their IT networks and be able to identify applications that are not continuously monitored.

Another key element is understanding whether an organization has a secure enterprise ecosystem.Organizational assets—and vulnerabilities—are part of a global network, and a given company or government agency exercises direct control over only a portion of it. Supply chains, service providers and strategic partners, employees, and customers are all interconnected—in fact are becoming more so with the spread of the IoT—and an attack on any one of these elements could an entire organizations.

Flexible action plan. Contingency planning for cyberwar should be both threat-based and asset-based. That is, the choices should be predicated on informed risk assessments. Done right, an organization can continue to thrive, even in the aftermath of a cyberwar. Done wrong—or not at all—the organization may not survive.

A public-private partnership strategy should be another element of contingency planning for cyberwar. The Obama Administration, the United Kingdom, and the European Union have recently taken important steps to advance corporate cybersecurity. Developing a productive partnership between public authorities and private companies is a key element of US, UK, and EU strategies. Organizations should take advantage of the new opportunities that these and other governments’ initiatives represent and seek out the right opportunities to collaborate with the appropriate agencies. They should also recognize that information sharing is not a one-way street and be prepared to implement cyberwar contingency planning that encompasses enterprise ecosystems, industry peers, cross-industry groups, and government agencies.

Informed, adaptive, secure. In sum, the organizations that are best prepared for the contingency of cyberwar will focus on three key areas:

• Prioritizing resources and protecting those items and processes that are valuable to both the organization and potential cyber combatants.
• Carrying out cybersecurity practices that will not only protect a business in the event of cyberwar, but put it ahead of the pack in the global marketplace.
• Engaging with policymakers and regulators to keep up-to-date on threat vectors and plans for responding to threats.

Part 1: Introduction and Definitions (posted July 7)
Part 2: Recent Cyber Skirmishes (posted July 10)
Part 3: How Cyberwar Could Happen
Part 4: Implications of Cyberwar
Part 5: What Is to Be Done?

What Are the Prospects for Cyberwar? And What Can You Do to Prepare?

Part 4: Implications of Cyberwar

Apocalypse not yet …

Under current circumstances the effects of a cyberwar on most organizations are more likely to be disruptive than apocalyptic for two main reasons. First, although cyber exploits can immobilize functions that are critical to the operations of companies and regions for hours and maybe days, modern cyberarchitectures tend to have enough built-in redundancy and resiliency to preclude a cataclysmic crash of all critical systems simultaneously, on a national scale, and for an extended period.

Moreover, the actors who currently have the greatest capability to use cybertools to inflict broad, systemic damage on their adversaries are the well-resourced nation-states who are most likely to calibrate their targeting carefully and whose economies are intertwined by­ growing IT and other links. (See James Lewis’s article “In Defense of Stuxnet.”) For example, if China or the United States were to try to immobilize the entire economy of an adversary, they would open a serious risk of a cyber or kinetic counter-attack aimed at inflicting the same kind of damage — a situation loosely analogous to the ‘mutually assured destruction’ doctrine that helped restrain nuclear saber-rattling during the Cold War.

Hasta manana, maybe?

… but maybe tomorrow

This balance is likely to change over time, though. On the “demand” side, there is a growing gray market in hacking tools that is likely to make more powerful exploits—directed, for example, against industrial control systems—more available to governments of smaller nations and even non-state groups that would have less to lose in a cyber exchange than a major power.(Mediareports) On the “supply” side, the number of potential targets of cyber weaponry is growing exponentially as the Internet of Things increases linkages and devices that cyberweapons can target; the consulting firm Gartner projects that 26 billion devices—not counting personal computers, tablets, and smartphones—will be connected to the IoT by 2020, representing a nearly 30-fold increase since 2009.

The accelerating globalization of many organization’ operations will also leave them increasingly vulnerable to disruption from cyberwar, even if it does not involve their home government. Businesses rely on research-and-development and production processes that are based in third-world countries; these important sources of innovation and revenue could be cut off, at least temporarily, by the deployment of cyber weapons. Cyberwar operations could also disrupt supply chains and support services. Tensions between China and its neighbors, for example, could disrupt call center operations in the Philippines or the manufacture of specialty parts for global supply chains in Vietnam.

The most likely casualties

Even now, when cyberwar is less likely to have apocalyptic consequences, it could disrupt companies’ operations across much of the economy. Industries most closely tied to military capabilities probably would quickly become the front lines of such a conflict: the defense industrial base; commercial Internet service providers and telecommunications firms that provide communications architecture and services for commercial, military, and other government operations; airlines; energy companies; pharmaceutical manufacturers and healthcare providers; and utilities that supply power and water to government facilities.

Business, nonprofit, and government leaders should also anticipate significant indirect effects. Companies across the industry spectrum and across the globe would likely be at risk of damage from malware or a massive DDOS attack that a cybercombatant had introduced into their business eco-systems, via customers, suppliers, perhaps even employees’ personal contacts and electronic devices that had been connected to corporate networks.

Part 1: Introduction and Definitions (posted July 7)
Part 2: Recent Cyber Skirmishes (posted July 10)
Part 3: How Cyberwar Could Happen
Part 4: Implications of Cyberwar
Part 5: What Is to Be Done?

What Are the Prospects for Cyberwar? And What Can You Do to Prepare?

Part 3: How Cyberwar Could Happen

Part 3: How Cyberwar Could Happen

The pace and stakes of cyber skirmishing are on the rise, reducing the margin of error and increasing the chance that misunderstanding or miscalculation by one or more nation-states could escalate these skirmish into cyberwar. Below, I extrapolate existing trends to sketch out three possible scenarios for how this might happen.

Blowing up the Internet as well as the Houses of Parliament?

Scenario 1: Hackers Unbound. The likeliest scenario for an escalation to cyberwar starts with hackers, in my view. Because of the uncertain control that intelligence and military services often have over such groups, hackers could exceed the desires of the government they’re affiliated with—say, by destroying data rather than merely defacing a public-facing website or by introducing malware that spreads beyond the target’s IT system.

Even actions by independent hackers could set off escalation. Attribution for cyber exploits is hard in the best of circumstances, and nation-states’ use of proxy hacker groups could lead some targets to see a government hand behind an action lacking affiliation with an intelligence or military service. Assignment of attribution may get even more difficult as the hacking kits increasingly available online make it easier for private citizens, or for smaller and poorer states, to carry out fast and sophisticated attacks.In these conditions, for example, an attack on Chinese organizations’ IT systems by hackers protesting conditions in Tibet, or on Russian oil companies’ networks by a group concerned about pollution in Siberia, could be viewed as a proxy for hostile actions by a Western government—leading to a spiral of retaliation.

• An escalation of cyber skirmishes caused by hacker exploits could occur with little warning. Companies and other third parties probably would have no visibility into hacker group operations or the likelihood that these would spark retaliation from the target.

There’s heavy damage when heavyweights brawl.

Scenario 2:  Clash of the Titans. In this scenario, cyber skirmishes escalate into cyberwar as a complement to conventional military action, as apparently happened in the Russia-Georgia conflict in 2008; alternatively, cyber weapons could be against military targets instead of kinetic strikes. A country facing the prospect of an adversary’s military deployment along a disputed border could use cyber tools to disrupt the IT systems that modern armed forces use for communications and logistical support—leading the targeted country to retaliate.

• This type of scenario probably would be preceded by warning signs, such as media reports of military movements and increasingly heated rhetoric between the two states. However, the nature and extent of disrupted IT systems would be hard to anticipate, and a spread of military malware beyond its intended targets—or its capture and re-use by other parties—could compound damages.

Who’s ready to go over the top?

Scenario 3:  Corporate Guns of August. As corporate IT systems suffer accelerated intellectual property theft and disruptions from cyber intrusions, some companies could launch their own cyber counteroffensives. Tactics for retaliation could range from placing “honeypots” with deliberately falsified data on corporate networks to disrupting the networks of suspected attackers.

This type of freebooting retaliation could quickly escalate.  Acting against the perpetrators of the massive Chinese cyber espionage operation identified in Mandiant’s report, for example, would mean attacking a unit of Beijing’s military.  And targeting an apparently private corporation—much less a group of “patriotic hackers”—could be just as dangerous because of the close ties between companies and national governments in countries like China and Russia.

• The country being targeted by a corporation’s private retaliation for cyber intrusions may also see such action as a proxy for the security or military services of the corporation’s home country, leading to a broader and more damaging spiral of escalation.

Part 1: Introduction and Definitions (posted July 7)
Part 2: Recent Cyber Skirmishes
Part 3: How Cyberwar Could Happen
Part 4: Implications of Cyberwar
Part 5: What Is to Be Done?

What Are the Prospects for Cyberwar? And What Can You Do to Prepare?

Part 2: Recent Cyber Skirmishes

Academic experts have noted that nation-states’ intelligence and military services today use cyber exploits to conduct the sort of sensitive tasks that, until recently, were carried out by human spies, commandos, or missiles. Two examples indicate how such actions can disrupt military and economic infrastructure as effectively as kinetic strikes:

• Hackers backed by nation-state resources—probably the United States and Israel, according to Kaspersky Labs—designed the Stuxnet computer worm and remotely introduced it into industrial control systems that were critical to Iran’s alleged program for developing nuclear weapons. This malware is thought to have destroyed about one-fifth of Iran’s nuclear centrifuges by causing them to spin out of control.
• In the run-up to the Russia-Georgia border war in 2007, Russian-controlled or –affiliated hackers clandestinely penetrated Georgia’s Internet infrastructure to deploy an array of botnets, DDOS attacks, logic bombs, and other cyber exploits. Once the shooting war started, the cyber weapons disabled the Tbilisi government and paralyzed Georgia’s national banking system—leading to a de facto financial quarantine as international banks and other payments processors feared cyber infection.

Georgian government page defaced by pro-Russian hackers.

Cyber tools can make espionage appear so pervasive and efficient that it creates a climate of insecurity and public demands for a muscular response. A Chinese military unit since 2006 has allegedly carried out cyber espionage operations against at least 141 companies in the United States and elsewhere, making off with hundreds of terabytes (TB) of data, according to a study that the computer security firm Mandiant published in early 2013.[1] All members of this unit are located i-n Shanghai, and there apparently have been no direct, face-to-face meetings with human collaborators in the targeted companies. Extensive media coverage of this report and other allegations of rampant Chinese cyber espionage almost certainly played a role in US officials’ decision to indict Chinese military intelligence officers for cyber espionage and have also fueled calls for Washington to engage in offensive cyber operations and take other stiff measures.

Chinese intelligence officers indicted by the FBI as cyber spies.

Cyber privateers? Hacker groups with ambiguous relationships to national governments often play an important role in cyber skirmishes. They provide plausible deniability for a nation-state’s cyber operations, akin to the Soviet and US use of guerrilla groups as proxies during the Cold War.

• Russian cyber operations against Ukraine this year, Georgia in 2008, and Estonia in 2007 appear to have been carried out for the most part by criminal groups and other hackers with no overt links to the Russian Government—although Kiev, Tbilisi,Tallinn, and independent security researchers have charged that such links existed.
• US officials claim that hackers acting at the Iranian Government’s behest in 2012 attacked the websites and communications networks of the energy giant Saudi ARAMCO, in the same way that Tehran has used purportedly independent hacker groups to infiltrate and disrupt political opposition groups’ websites.
• China has reportedly tolerated, if not encouraged, “patriotic hackers” who have disrupted and defaced the websites of US, Japanese, and other organizations at times of diplomatic tension.

[1] Mandiant has since been acquired by FireEye.