Complexity and Social Networks Blog

« A look inside brain tissue to see network connections | Main | Monetizing and understanding Facebook Fanpages - An entrepreneurial perspective »

3 November 2011

International Cyber Security Challenges

It is widely recognized in government, business, military and scientific circles that there is a growing interconnectedness of physical and virtual infrastructure through information and communication technology (ICT). Many refer to it as Cyberspace. A domain, pervasive and ubiquitous, now considered strategically equal to land, air, sea, and space. Yet from a security perspective, cyberspace is different to the four other domains. It has emergent properties and eludes state control. Beyond its impact on leadership, management or institutions, there is a common fear that the growing interconnectedness offers more and more avenues for disruptions in the digital supply chain and thus increases the vulnerability of the information society, military power and the global economy to system failure.

The causes of disruptions to cyberspace and critical infrastructure - e.g. utilities, transport, telecoms, defense contractors, government institutions - in general can be divided into three categories: natural disasters, accidents and intentional attacks . Cyber threats are risks arising from cyberspace and its technologies (e.g. hacking, denial of service attacks, viruses, malware). The impact of malicious cyber activities can be without direct consequences (e.g. installing spyware) but may as well lead to physical consequences (e.g. loss of business or failure of control systems). Cybercrime is a common threat image in the business community while cyber terrorism, cyber war and information warfare dominate defense community's framing of the issue . The worst case scenario frequently mentioned but highly contested is an "electronic Pearl Harbor" type disruption.

Images of threats typically involve a broad range of adversaries and targets, including both state and non-state actors, dissolving the boundaries between the domestic and the international. Along these lines, non-state actors may be a challenge to as well as providers of security. Most observers focus on the transnational and network-based character of cyber threats. Adversaries are typically seen as operating in loosely organized networks consisting of relatively independent nodes of individuals. Research and media coverage of recent cyber attacks underline that beyond the hype concerns are real as attempts to exploit or defeat existing cyber infrastructures are happening ever second.

IT-security researchers showed that an unprotected computer connected to the Internet to collect intelligence on attack techniques and behaviors ("honeypot") was hacked and utilized for a botnet within 15 minutes of connecting it to the Internet. The sophistication of attacks and their consequences have reached a new level since 2010. Unlike distributed denial of service (DDOS) attacks to disrupt the Internet in Estonia or Georgia, the "Stuxnet Worm", likely developed by a state actor, targeted industrial control systems that use Siemens software and infected over 30,000 computers in Iran, including computers involved in running nuclear facilities in Iran. The latter raises even greater concerns about not only the threat to industrial control systems, but to all components of our information and communications technologies, generally. Early in 2011, RSA, a provider of SecurID two-factor authentication products which can be considered one of the core Internet security technologies experienced a similar APT breach to its infrastructure as Google did in 2010. Unlike most intrusions that go after financial and identity data, advanced persistent threat (APT) attacks tend to go after source code and other intellectual property. Intrusions may even sneak into an organization's network, sometimes for years, even after it has taken corrective action.

Much has been written about the challenge of attribution in cyberspace. Who is intruding in a system and who is behind the malicious activity? If we are attacked, will we know who is behind it, so that we can respond, without incurring the wrath of the world community? All too often it remains difficult, if not impossible, to identify the involved parties who hide behind the anonymity and global orientation of the Internet and utilize a catacomb of enablers, consisting of both legitimate and illegitimate providers, to cover their tracks. Policy makers and military planners are only beginning to address these questions.

In fact, cyber security and risk is inherently difficult to comprehend and communicate, due to its socio-technical complexity, and relationships among stakeholders in the international community. There is for example, little agreement as to what the security issue in cyberspace actually is as well as what is critical and the threat level . From a European perspective, the cyber insecurity "hype" is much more prevalent in the U.S. than in Europe. Consequently, it is difficult to come together around a common, collective vision in international bodies such as the UN or NATO by states such as the United States, United Kingdom, France, and Germany which often lead the adoption of broad based agendas. An additional challenge derives from the existing cyber security institutional eco-system which resembles a broad set of international, national, and private organizations with unclear and overlapping boundaries as well as differing capacities. Finally, the government resources available are tied up with national cyber security efforts such as critical infrastructure protection where state and industry objectives are only partially convergent. Specifically, the private sector fears that sensitive information on past security incidents might not be treated with the necessary degree of confidentiality by state entities and cause damage to their reputation. Furthermore, international approaches would be of much greater interest for transnational businesses. Many believe a comprehensive approach , one that provides for appropriate information sharing and mutual assistance obligations governed by international policies and treaties, is needed. Considering the struggles of the UN, EU or NATO in developing a common comprehensive approach for conflict and crisis management and the illustrated difficulties in the cyber security domain, this will pose a great challenge to the international community.

Nevertheless it requires a public-private collaboration which identifies critical cyber priorities, sets goals and objectives for each, and identifies corresponding milestones and metrics for those objectives so that they can be resourced, tracked, and improved over time. It is also important to systematically collect and share statistically significant malicious cyber activity data on the national and global scale. Moreover, we need to build the capability to quickly connect the dots among disparate databases to get a true picture of which instances of criminality are connected to each other, to which malicious actors, and to which enablers. However, first and foremost none of these and many other points is actively and openly debated among government or private industry organizations, nor is the fact that current means of law enforcement have proven insufficient, specifically because they tend to be reactive instead of proactive; they investigate after the fact instead of preventing the criminal attack. We must recognize that more of the same will not change this reality. The complexity of cyber risk must be addressed strategically and proactively by an alliance of business and government stakeholders, including, but not limited to, law enforcement because no single effort or initiative will eliminate the cyber threat.

References
Archick, K. (2006) "Cybercrime: The Council of Europe Convention", Report, U.S. Congressional Research Service.