In its 2007 Virtual Criminology Report McAfee stated that "cyber crime has expanded from isolated attacks initiated by individuals or small rings to well-funded, well-organized operations using sophisticated technology and social engineering." Further, the report noted that an estimated 120 countries are developing or utilizing cyber espionage or warfare capabilities. The report speculated that we are now entering a "cyber Cold War."
This past week at the RSA Conference in San Francisco I had the pleasure of moderating two panels that discussed this cyber Cold War analogy. The specific purpose of these panels was to more thoroughly analyze the Cold War analogy and tease out those similarities that could aid policy makers in better understanding the current threat environment and discarding those differences that would lead decision makers astray.
The conclusion of both panels was that we are indeed facing an exacerbated cyber threat. Some panelists concluded that we were indeed engaged in a cyber cold war with various adversaries, while other attendees were hesitant to label the currently threat environment as a "war". Further, the panelists found some useful similarities and distracting differences between the Cold War and the current cyber threat environment. Its my intention to blog about some of these similarities and differences that we discovered in future blog posts. Stay tuned!
3 comments:
I'm having trouble wrapping my head around this Cold War analogy, largely due to issues of attribution. As Cooper notes in his article, an attack from Beijing is not necessarily the work of the Chinese government, and at what point does an attack from a Chinese nationalist warrant counteraction against China? It seems as though the US will need to tread carefully, and enhance protection before retaliation becomes a consideration; that's where it'll get really messy.
Additionally, it seems as though the Obama administration recognizes the danger or these sorts of threats, and I hope that they'll be able and willing to offer incentives for computer science grads to enter careers in cyber security.
I think that this is an issue that is going to be on the table for a long time. First, I find it interesting that some people are having difficulty labeling this a cyber "war." And if I had not studied anything about cyber warfare then I would have trouble labeling this as a war because there are no threats of dead bodies or one country invading another; it is simply malicious things flying across wires. It is very abstract and I think that some are unaware of how dependent we are on our computer systems and if these are attacked many things could go wrong. It is tough for the average person to see the link between the financial sector or our power grid and computer systems, but that is what this cyber war will come down to. These countries are going to try to take down the United States by attacking our critical infrastructure and trying to severely cripple our economy. In a globalizing world this would set us back and thus other countries would gain an advantage over us.
The seriousness of this threat needs to be disseminated to the average citizen. Most are completely unaware that their computer could be used in a botnet, which could ultimately hurt their own country. Although this would be an enormous project to start, the government needs to start small and try and get the word out in bits. This will be the best way to prevent ourselves from being taken down by a major cyber attack.
I would have to agree with Charlie; it seems that the analogy of the current cyber war to a ‘cold war’ is very confusing to people less well-versed in what the actual effects of what’s going on in across the web are (myself partially included, although I am, I think, at least a little better off due to this class!) The main issue here is a lack of knowledge on the part of the everyday people of America (and, I suppose, other countries as well…). The average person using a computer in today’s world has very little concept of how the internet and other cyber ‘stuff’ actually works, much less is able to protect their own computers. These are the same people whose computers they unknowingly add to botnets and whose information is collected into dossiers in gigantic databases. They are certainly not informed on how the infrastructure of the internet works, much less how cyber attacks on government or other financial or power systems could affect their daily lives.
All of this could be considered irrelevant, however. The real question is whether we want the average person to be better informed about the dangers of cyberspace or whether it would just cause panic and confusion and they-couldn’t-do-anything-anyway-so-why-not-leave-it-up-to-the-academic-and-financial-and-governmental-sectors? Personally, I am inclined to think that everyone should be better informed about the computers and internet that they use everyday, but that might just be because I was astounded at how little I really knew and have since discovered during the course of this class. But that’s just me.
Post a Comment