Cyberwarfare evolves faster than rules of engagement
Strict definitions of warfare are elusive when actors include nation-states, criminals and rogue actors
IDG News Service - As the rhetoric heats up over cyberwar -- including warnings that attacks on the U.S. are imminent and alarms that the U.S. has escalated the risk via malware attacks on Iran's nuclear program -- the rules of engagement are missing in action.
The current framework of international law and treaties doesn't adequately address cyberconflict, Jody Westby, CEO of Global Cyber Risk, said Monday at the Techonomy 12 conference.
Westby said that customary international law should be extended into the cyber domain and define a certain amount of a nation's critical infrastructure that should be "declared sacred and off limits for attack." She also argued that there should be an agreement outlawing "irregular forces," which in this context would include botnets.
But other members of a panel at the conference, being held in Tucson, Arizona, argued that the virtual and covert nature of cyberattacks make it difficult to trace them and hold actors responsible.
"Defining what's legitimate and what's not legitimate is easier said than done," said RSA executive chairman Art Coviello. And defining actions as war is problematic, especially given that nations have spied on each other "forever."
"When does spying end and economic warfare begin? And when does spying end and actual warfare begin?" Coviello asked.
And the players differ as well, Coviello added. "We're used to having wars between and among nation-states. Where does criminal behavior end and warlike behavior begin?"
Cybercriminals have a big-data problem, Coviello said: They possess more credentials than they can monetize. And they can make more money selling credentials from an executive at a defense contractor than they would by attacking that individual's bank account.
Among nation-states there is an emerging de facto understanding of the tit-for-tat rules of warfare: "You take out my power grid, and I take out your dam." But when malicious actors are also criminals, "hacktivists" and terrorists, these groups won't abide by these rules, Coviello said.
Coviello's concern now is the evolution from intrusion to disruption, as with the recent distributed denial-of-service attacks on New York banks.
While the U.S. military has a cybercommand, it's currently constrained from protecting entities outside of the .mil domain, Westby said.
And in the midst of concern over cyberattacks taking the form of economic warfare, lack of cooperation between business and government is also a problem, said John Kao, chairman of the Institute for Large Scale Innovation.
"There's an issue of trust; if I'm a company and I get hacked or robbed, I may or may not be totally forthcoming about what happened. There's the question of how to create rules of engagement for collaboration that don't exist," Kao said. "There's been crescendoing attacks against U.S. financial institutions, and CyberCom monitors this, but the rules of engagement in terms of how it communicates with the commercial sector haven't been defined."
While the panelists decried fear-mongering by politicians and warnings of a "cyber Pearl Harbor," Coviello referred back to a famous quote by Nicholas Negroponte calling the Internet both overhyped and underestimated. Cyberwarfare may be overhyped relative to the risk posed by a bad actor with a nuclear or biological weapon, but he warned that we may underestimate the extent to which a cyberattack could disrupt confidence, and by extension the economy.
- Cyberattacks could paralyze U.S., former defense chief warns
- The NSA blame game: Singling out RSA diverts attention from others
- Jury still out on FISA court
- Suspected China-based hackers 'Comment Crew' rises again
- Chinese hackers master the art of lying in wait
- Spy court OK'd all U.S. wiretap requests it received in 2012
- Groups denounce FBI plan to require Internet backdoors for wiretaps
- South Korea cyberattacks hold lessons for U.S.
- U.S. military networks not prepared for cyberthreats, report warns
- Return of CISPA: Cybersecurity boon or privacy threat?
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts