The CSIS, a Washington-based bipartisan think tank that in December submitted a set of security recommendations to President Obama, argues that such a strategy would require the government to declare its cyberinfrastructure a vital asset for national and economic security. It would then need to indicate its willingness to use all of the tools at its disposal -- diplomatic, economic, military and intelligence -- to protect that asset.
Build a cyber-response capability
In 1963, soon after the Cuban missile crisis, President John F. Kennedy established a National Communications System (NCS) responsible for ensuring the reliability and availability of communications capabilities during emergencies. Its task was to work with federal agencies and private industry to provide national security and emergency preparedness capabilities for the telecommunications sector. During the 9/11 crisis, the NCS played a crucial role in coordinating the resources needed to ensure that vital communication services remained uninterrupted.
When it comes to cybersecurity, there is no equivalent capability, says James Lewis, director of the technology and public policy program at the CSIS. "If there's a fire on the Internet, who's the fire department?" he asks. In the event of an Internet crisis, there is no single entity that either the federal government or private industry can depend on to coordinate a response. "There's no one you can simply pick up the phone and speak with," Lewis says.
Implementing such a capability is not going to be easy, says Paul Kurtz, former special assistant to the president and senior director for critical infrastructure protection on the White House's Homeland Security Council. Attacks against key Internet protocols and routing technologies could cause considerable and lengthy disruption. Coordinating a response could involve numerous stakeholders including carriers, Internet service providers, technology vendors and bodies like ICANN (the Internet Corporation for Assigned Names and Numbers), says Kurtz, who is currently a partner at Good Harbor Consulting LLC.
"In the old days, we had trucks with SS7 network switches on them that could be rolled in place quickly to reconnect copper networks that went down," Kurtz says. "In an IP-based world, we have not even begun to scratch the surface of how we would restore networks" in the event of a cataclysmic disruption.
Secure targets in critical infrastructure areas
The "digital Pearl Harbor" in which large swathes of the Internet would be taken down by adversaries to create widespread disruption is a possibility that needs to be prepared for, security analysts say. But far more likely and worrying are more focused attacks against critical infrastructure targets such as power, financial services and water services.
The cascading blackout in the Northeast in 2003 remains a potent example of the havoc a computer failure can cause -- even if, as in that case, the incident was caused by negligence rather than malice.