Hardrock69
06-13-2011, 01:33 PM
http://www.networkworld.com/columnists/2011/060611-edit.html
The Pentagon is expected to announce a cyberstrategy this month that concludes a cyberattack on the U.S. can be an act of war, and while the damage from such an assault may warrant that position, hopefully this just amounts to loud barking given the perils involved.
The Wall Street Journal says the Pentagon's 30-page document (18 pages of which are classified) broaches the idea of the U.S. using military force to respond to a nation-backed cyberattack. The gist: If an attack caused significant damage to our economy, infrastructure or people, the U.S. could respond with an equivalent amount of military force.
The Pentagon is expected to announce a cyberstrategy this month that concludes a cyberattack on the U.S. can be an act of war, and while the damage from such an assault may warrant that position, hopefully this just amounts to loud barking given the perils involved.
The Wall Street Journal says the Pentagon's 30-page document (18 pages of which are classified) broaches the idea of the U.S. using military force to respond to a nation-backed cyberattack. The gist: If an attack caused significant damage to our economy, infrastructure or people, the U.S. could respond with an equivalent amount of military force.
The tacit admission here is that our digital crown jewels are insecure enough to warrant this scabbard rattle. While we know our networks are under constant attack, and the government showed as far back as 2007 in the Aurora experiment that a hacker could destroy a generator, perhaps we're more vulnerable than they are letting on.
As if to emphasize the point, just last week defense contractor Lockheed Martin was the target of a "significant and tenacious attack," although the company declined to release more details.
But crafting a position about how we might respond to cyberattacks and actually responding are two different things. Questions abound.
First and most obvious, how do you adequately ascertain who attacked? Stuxnet, after all, has defied efforts to pinpoint the source (or so we are led to believe).
Worse, what if part of the intent of an attack is to mislead us about the source? Spoofing is an art unto itself, but if these are nationally driven attacks, presumably we are talking about the top people in the game so it would certainly be within their grasp.
Related to that, what if the attack emanated from a country but wasn't state-sponsored? How do you determine culpability? How complex does the effort have to be to indicate state-level support?
And to emphasize the folly of that, turn it around into a goose and gander question. What happens when an attack on a country was clearly launched from the U.S.? How do we establish that it wasn't us?
All of that said, with the growing likelihood of cyberwarfare, it is good to see the Pentagon addressing this as a pressing issue. Given the daunting questions, however, we hope the discussion of a military response to a cyberattack is mostly grandstanding. The last thing this tinder box of a world needs right now is one more reason to pick up arms.
I remember an episode in the original Star Trek series, where the Enterprise goes into orbit around some planet, and Kirk and Spock beam down to the planet, and the leaders of that world say the Enterprise has been destroyed in a simulated attack, and the crew has been ordered to report to the planet's "Disintegration machines".
That episode freaked me out heavily.....the thought of being ordered to step into some kind of booth, and the door closes, and when it opens, that person has been destroyed.
Seems we are arriving at that scenario now. We do not need to be physically attacked by bombs or whatever.
So the Pentagon can just claim that someone launched a cyberattack, or if one was really launched, there is no way to actually prove who it was that launched it.
The next step beyond "terrists", an enemy with no fixed homeland, no definite membership, just shadows in the night. :umm:
The Pentagon is expected to announce a cyberstrategy this month that concludes a cyberattack on the U.S. can be an act of war, and while the damage from such an assault may warrant that position, hopefully this just amounts to loud barking given the perils involved.
The Wall Street Journal says the Pentagon's 30-page document (18 pages of which are classified) broaches the idea of the U.S. using military force to respond to a nation-backed cyberattack. The gist: If an attack caused significant damage to our economy, infrastructure or people, the U.S. could respond with an equivalent amount of military force.
The Pentagon is expected to announce a cyberstrategy this month that concludes a cyberattack on the U.S. can be an act of war, and while the damage from such an assault may warrant that position, hopefully this just amounts to loud barking given the perils involved.
The Wall Street Journal says the Pentagon's 30-page document (18 pages of which are classified) broaches the idea of the U.S. using military force to respond to a nation-backed cyberattack. The gist: If an attack caused significant damage to our economy, infrastructure or people, the U.S. could respond with an equivalent amount of military force.
The tacit admission here is that our digital crown jewels are insecure enough to warrant this scabbard rattle. While we know our networks are under constant attack, and the government showed as far back as 2007 in the Aurora experiment that a hacker could destroy a generator, perhaps we're more vulnerable than they are letting on.
As if to emphasize the point, just last week defense contractor Lockheed Martin was the target of a "significant and tenacious attack," although the company declined to release more details.
But crafting a position about how we might respond to cyberattacks and actually responding are two different things. Questions abound.
First and most obvious, how do you adequately ascertain who attacked? Stuxnet, after all, has defied efforts to pinpoint the source (or so we are led to believe).
Worse, what if part of the intent of an attack is to mislead us about the source? Spoofing is an art unto itself, but if these are nationally driven attacks, presumably we are talking about the top people in the game so it would certainly be within their grasp.
Related to that, what if the attack emanated from a country but wasn't state-sponsored? How do you determine culpability? How complex does the effort have to be to indicate state-level support?
And to emphasize the folly of that, turn it around into a goose and gander question. What happens when an attack on a country was clearly launched from the U.S.? How do we establish that it wasn't us?
All of that said, with the growing likelihood of cyberwarfare, it is good to see the Pentagon addressing this as a pressing issue. Given the daunting questions, however, we hope the discussion of a military response to a cyberattack is mostly grandstanding. The last thing this tinder box of a world needs right now is one more reason to pick up arms.
I remember an episode in the original Star Trek series, where the Enterprise goes into orbit around some planet, and Kirk and Spock beam down to the planet, and the leaders of that world say the Enterprise has been destroyed in a simulated attack, and the crew has been ordered to report to the planet's "Disintegration machines".
That episode freaked me out heavily.....the thought of being ordered to step into some kind of booth, and the door closes, and when it opens, that person has been destroyed.
Seems we are arriving at that scenario now. We do not need to be physically attacked by bombs or whatever.
So the Pentagon can just claim that someone launched a cyberattack, or if one was really launched, there is no way to actually prove who it was that launched it.
The next step beyond "terrists", an enemy with no fixed homeland, no definite membership, just shadows in the night. :umm: