Search

Begin New Search Topic Cybersecurity Political Geography Global Focus

71. War, Terrorism, and Catastrophe in Cyber Insurance: Understanding and Reforming Exclusions

Author:
Jon Bateman
Publication Date:
10-2020
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
Cyber insurance is a promising way to contain the havoc cyber attacks wreak, but endless lawsuits hamper its effectiveness. Reforms and new solutions are sorely needed. Insurance is one of the most promising tools for addressing pervasive cyber insecurity. A robust market for insuring cyber incidents could, among other things, financially incentivize organizations to adopt better cyber hygiene—thereby reducing cyber risk for society as a whole. But cyber insurance is not yet mature enough to fulfill its potential, partly due to uncertainty about what kinds of cyber risks are, or can be, insured. Uncertainties in cyber insurance came to a head in 2017, when the Russian government conducted a cyber attack of unprecedented scale. Data-destroying malware called NotPetya infected hundreds of organizations in dozens of countries, including major multinational companies, causing an estimated $10 billion in losses.1 NotPetya showed that cyber risk was greater than previously recognized, with higher potential for “aggregation”—the accumulation of losses across many insurance policies from a single incident or several correlated events. NotPetya also exposed a serious ambiguity in how insurance policies treat state-sponsored cyber incidents. Some property and casualty insurers declined to pay NotPetya-related claims, instead invoking their war exclusions—long-standing clauses that deny coverage for “hostile or warlike action in time of peace and war” perpetrated by states or their agents.2 War exclusions date back to the 1700s, but they had never before been applied to cyber incidents. This novel use of the war exclusion, still being litigated, has raised doubts about whether adequate or reliable coverage exists for state-sponsored cyber incidents. Some observers have asked whether such incidents are insurable at all, given the potential for aggregated cyber losses even more catastrophic than those of NotPetya.3 And while the war exclusion has attracted the most attention, another exclusion—for terrorism—presents similar challenges to cyber claims.
Topic:
Terrorism, War, Cybersecurity, and Non-Traditional Threats
Political Geography:
Global Focus

72. Deepfakes and Synthetic Media in the Financial System: Assessing Threat Scenarios

Author:
Jon Bateman
Publication Date:
07-2020
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
Bad actors could use deepfakes—synthetic video or audio—to commit a range of financial crimes. Here are ten feasible scenarios and what the financial sector should do to protect itself. Rapid advances in artificial intelligence (AI) are enabling novel forms of deception. AI algorithms can produce realistic “deepfake” videos, as well as authentic-looking fake photos and writing. Collectively called synthetic media, these tools have triggered widespread concern about their potential in spreading political disinformation. Yet the same technology can also facilitate financial harm. Recent months have seen the first publicly documented cases of deepfakes used for fraud and extortion. Today the financial threat from synthetic media is low, so the key policy question is how much this threat will grow over time. Leading industry experts diverge widely in their assessments. Some believe firms and regulators should act now to head off serious risks. Others believe the threat will likely remain minor and the financial system should focus on more pressing technology challenges. A lack of data has stymied the discussion.
Topic:
Security, Cybersecurity, Artificial Intelligence, and Non-Traditional Threats
Political Geography:
Global Focus

73. Iran’s Authoritarian Playbook: The Tactics, Doctrine, and Objectives behind Iran’s Influence Operations

Author:
Ariane Tabatabai
Publication Date:
09-2020
Content Type:
Policy Brief
Institution:
German Marshall Fund of the United States (GMFUS)
Abstract:
According to a 2013 indictment by the U.S. Department of Justice, hackers backed by a foreign power gained access to the controls of the Bowman Avenue Dam, a small dam in the New York City suburb of Rye, New York. Cyberattacks on infrastructure have long been a concern in the United States: Russia has targeted the U.S. power grid and other critical infrastructure in the past—at times successfully.1 Hackers backed by the People’s Republic of China have targeted U.S. utilities companies.2 However, neither of these strategic adversaries was behind this bold foray into U.S. suburbia: the culprit, according to the indictment, was the Islamic Republic of Iran.3 Over the past decade, Iran has emerged as an important national security challenge for the United States. A novel part of the regime’s effort—facilitated by the advent of the information age and new technology—is its development of a playbook and toolkit designed to undermine the United States at home just as, in the eyes of Tehran, Washington does in Iran. This makes the current Iranian challenge more subtle and nuanced than has been the case for most of the Islamic Republic’s existence. Iran has gradually expanded its capabilities to compete against the United States for influence within the region, and it is now also taking this competition into the United States and even Europe. One hundred days before the 2020 U.S. elections, the Office of the Director of National Intelligence put a fine point on this threat when National Counterintelligence and Security Center Director William Evanina released a statement noting that, “at this time, we’re primarily concerned with China, Russia and Iran,” who are all looking to “use influence measures in social and traditional media in an effort to sway U.S. voters’ preferences and perspectives, to shift U.S. policies, to increase discord and to undermine confidence in our democratic process.”4 The statement characterized the Iranian threat as follows: “Iran seeks to undermine U.S. democratic institutions and divide the country in advance of the elections. Iran’s efforts center around online influence, such as spreading disinformation on social media and recirculating anti-U.S. content.”5 The Islamic Republic’s authoritarian toolkit is unlikely to become as sophisticated as that of China or Russia in the near-term. After all, Iran’s economy is in shambles, its capacity restrained, and the model of society and governance it tries to offer profoundly limited in its appeal. And even the flagship tool used by Iran to interfere in democracies, namely its online influence operations, continues to suffer from such basic shortcomings as misspelled names, the repeated use of the same tactics and techniques, and a lack of proper research into the target and familiarity with its behavior.6 However, a perceived existential threat posed by the United States, an inability to match the conventional capabilities of the United States and its allies, and a strong desire to compete with the same, have encouraged Iran to double down on efforts to develop a set of asymmetric tools allowing it to overcome its shortcomings. In this sense, Iran is not dissimilar to Russia. “Authoritarian learning” (including partnerships with both Beijing and Moscow) has likely helped Tehran to overcome challenges and to develop its toolkit quickly and effectively. The result is that Iran is becoming a significant authoritarian actor challenging democracy in the United States and Europe. Tehran’s influence operations span traditional and digital media. The regime has built a sprawling web of traditional media outlets, as well as networks of accounts on all major social media platforms (even as it bans and limits access to these websites at home), allowing it to reach millions of users abroad. The content Iran creates, distributes, and amplifies is multilingual and seeks to adapt to democracies’ social, cultural, and political contexts—with fairly mixed results. Among the objectives of Iran’s information manipulation efforts are sowing tensions in democracies, dividing democratic nations internally and from each other, and alleging hypocrisy in democratic states’ foreign policies, undermining democratization in Iran and elsewhere. Iranian hackers routinely target U.S. persons, academic institutions, companies, non-profit organizations, and government agencies and departments. And Iran’s illicit finance schemes are considerable; although, they are currently focused on sanctions evasion and support of information operations, rather than used as a standalone vector to undermine democracies. Some of these tools and the tactics used by Iran are similar to those employed by both Russia and China—and both Beijing and Moscow have lent Tehran a hand in developing some of its capabilities,7 particularly in the realm of information manipulation. Iranian, Russian, and Chinese state media and associated social media accounts echo and amplify each other’s messaging. But there are also some differences in how Tehran deploys these tactics. This is in part due to differences in the political culture and structure of the country, the Islamic Republic’s own ideology and worldview, and the country’s status in the international system. Another significant set of differences arises from Iran’s shortcomings vis-à-vis both its adversaries (including the United States) and its authoritarian partners in Russia and China. For example, Russia and China can leverage their vast nuclear arsenal and enormous economic weight, respectively, to compete directly with the United States. Iran is ill-equipped to compete with the United States in either of those domains and, as such, sees this set of tools and efforts to undermine democracy as a means to elevate its level of competition rather than an end in itself. Hence, Tehran’s toolkit is more limited than those of Beijing or Moscow, leading the Islamic Republic to be more deliberate and selective in the programs it develops and, perhaps, more forceful in how it deploys them. As a result, though Iran’s growing efforts to undermine democracy should not be ignored and should be addressed adequately, for now, the Islamic Republic remains a lesser threat than China and Russia. This report tries to make sense of these activities and provide a framework for understanding Iran’s intentions and capabilities. It provides one of the first comprehensive discussions of Iran’s authoritarian toolkit, doctrine, and objectives. It must be noted that unlike other key Iranian initiatives—such as its nuclear program, missile activities, support for non-state actors, and regional interventions—Iran’s authoritarian toolkit remains scarcely studied in the academic literature. Understanding Tehran’s objectives in undermining democracy and the means it leverages to do so is important for a few reasons. First, Iranian activities over the past few years have shown that the regime is increasingly active in this space. And as Iran’s objectives and the tools it employs are different from those of other key malign actors, understanding their strengths and weaknesses and developing specific responses to them is a worthy exercise. Second, authoritarians learn from each other, and observing the Iranian case allows us to better identify the trends and comprehend the ways in which less powerful malign actors (as opposed to Russia and China, for example) may engage in similar activities designed to undermine democracy.
Topic:
Authoritarianism, Elections, Cybersecurity, Foreign Interference, Cyberspace, and Influence
Political Geography:
Iran, Middle East, and Global Focus

74. Cyber Space and International Law as a 21st Century Paradox | 21. Yüzyıl Paradoksu Olarak Siber Uzay ve Uluslararası Hukuk

Author:
Vahit Güntay
Publication Date:
12-2019
Content Type:
Journal Article
Journal:
Novus Orbis: Journal of Politics & International Relations
Institution:
Department of International Relations, Karadeniz Technical University
Abstract:
The studies in the base of international relations and security have revealed a different research subject with the developments of technology. Cybersecurity that is in the focus of the technical area has also been argued in the political base. The cyber dimension of security with discussing concepts like cyber politics, cyber deterrence or cyberwar has succeeded to remain on the agenda of states. As a central actor of the international system, states’ interest in cybersecurity has carried this subject to the international law research area. In this study, the historical process and theoretical approach have been evaluated in the base of international relations discipline and it is practised to detail problems about international law. Different data have also supported the approach to the core of this study. | Uluslararası ilişkiler ve güvenlik temelindeki çalışmalar teknolojik gelişmelerle birlikte farklı bir araştırma konusunu karşımıza çıkarmıştır. Teknik bir alanın ilgi odağında olan siber güvenlik politik bir temelde de tartışılmaya başlanmıştır. Siber politikalar, siber caydırıcılık ya da siber savaş gibi isimlerle tartışılmaya başlanan güvenliğin siber boyutu devletlerin de siyasi ajandalarına girmeyi başarmıştır. Uluslararası aktörlerin merkezinde olan devletlerin ilgisi siber güvenliği uluslararası hukukun inceleme alanına taşımıştır. Bu çalışma dahilinde siber güvenliğe ilişkin tarihsel süreç ve teorik yaklaşım uluslararası ilişkiler disiplini temelinde ele alınmış ve uluslararası hukuka dair sorunlar detaylandırılmaya çalışılmıştır. Çalışmanın özüne dair yaklaşım farklı verilerle de desteklenmiştir.
Topic:
International Relations, Crime, International Law, and Cybersecurity
Political Geography:
Global Focus

75. The Cybersecurity Workforce Gap

Author:
James Andrew Lewis and William Crumpler
Publication Date:
01-2019
Content Type:
Working Paper
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
As cyber threats continue to grow in sophistication, organizations face a persistent challenge in recruiting skilled cybersecurity professionals capable of protecting their systems against the threat of malicious actors. With cybercriminals now responsible for billions in losses per year and state-sponsored hacking groups posing an ever-greater threat, the need for individuals capable of securing networks against attackers has never been greater. However, education and training institutions in the United States have so far found it difficult to keep pace with the growing need for cyber talent. This paper highlights the gaps that exist in the nation’s current cybersecurity education and training landscape and identifies several examples of successful programs that hold promise as models for addressing the skills gap. It then highlights recommendations for policymakers, educators, and employers. A recent CSIS survey of IT decisionmakers across eight countries found that 82 percent of employers report a shortage of cybersecurity skills, and 71 percent believe this talent gap causes direct and measurable damage to their organizations.1 According to CyberSeek, an initiative funded by the National Initiative for Cybersecurity Education (NICE), the United States faced a shortfall of almost 314,000 cybersecurity professionals as of January 2019.2 To put this in context, the country’s total employed cybersecurity workforce is just 716,000. According to data derived from job postings, the number of unfilled cybersecurity jobs has grown by more than 50 percent since 2015.3 By 2022, the global cybersecurity workforce shortage has been projected to reach upwards of 1.8 million unfilled positions.4 Workforce shortages exist for almost every position within cybersecurity, but the most acute needs are for highly-skilled technical staff. In 2010, the CSIS report A Human Capital Crisis in Cybersecurity found that the United States “not only [has] a shortage of the highly technically skilled people required to operate and support systems already deployed, but also an even more desperate shortage of people who can design secure systems, write safe computer code, and create the ever more sophisticated tools needed to prevent, detect, mitigate and reconstitute from damage due to system failures and malicious acts.”5 At the time, interviews indicated that the United States only had about 1,000 security specialists with skills and abilities to take on these roles, compared to a need for 10,000 to 30,000 personnel. In the nine years since that report, these challenges have persisted. In 2016, CSIS found that IT professionals still considered technical skills like intrusion detection, secure software development, and attack mitigation to be the most difficult to find skills among cybersecurity operators.6 A 2018 survey of California businesses revealed that a lack of required technology skills was one of the greatest challenges facing organizations when hiring cybersecurity candidates.7 These challenges were particularly acute for mission critical job roles, with over a third of organizations reporting a lack of technology skills in candidates for vulnerability assessment analyst positions and half of employers reporting deficiencies for cyber defense infrastructure support candidates. Employers today are in critical need for more cybersecurity professionals, but they do not want more compliance officers or cybersecurity policy planners. What organizations are truly desperate for are graduates who can design secure systems, create new tools for defense, and hunt down hidden vulnerabilities in software and networks.8
Topic:
Security, Science and Technology, Cybersecurity, and Information Technology
Political Geography:
Global Focus

76. Financial Sector Cybersecurity Requirements in the Asia-Pacific Region

Author:
William A. Carter and William Crumpler
Publication Date:
04-2019
Content Type:
Working Paper
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
As the threat of cyberattacks has risen in recent years, financial institutions (FIs) and regulators have taken a range of steps to strengthen the security and resilience of the financial system to cyber threats. In the Asia-Pacific region (APAC), regulators have introduced a raft of new regulations and controls to bolster the resilience of FIs in their jurisdictions. While greater attention to—and engagement on—these issues is important, the development of new regulatory regimes across APAC has created challenges for multinational FIs and regulators, and could hinder the growth of the financial services and fintech industries within the region. We reviewed the cybersecurity requirements impacting the financial industry in five key jurisdictions, including the largest regional financial centers and consumer markets in APAC: Singapore, Hong Kong, Japan, China, and India. Through a combination of open-source research and on-the-ground interviews—with regulators; local, regional, and global FIs; policymakers; technology experts; and academics—we sought to understand the range of requirements and approaches from different regulators across the APAC region, and the ways in which they impact cyber risks to the regional financial system. Harmonizing regulators’ approaches to cybersecurity regulation in the region could help reduce systemic risks, improve regulatory efficiency, and make it easier for FIs across APAC to grow. This will not be easy and will require sustained engagement on multiple levels. Cyber threats are a transnational issue and will require a transnational response, particularly in highly integrated regions like APAC. Strengthening the security and resiliency of financial networks across the region will require looking at FIs from an enterprise perspective and understanding the cyber risks they face from the perspective of defenders, not the narrow lens of national borders. This will require principles-based approaches that allow for the wide range of business models and capacities of FIs and regulators across the region, and consolidated auditing, examination, and testing procedures to ensure that regulators have an accurate picture of the risks and controls at institutions under their care. Ultimately, regulators’ goals must be to ensure that strong security and resilience, not redundant compliance, is the focus for FIs.
Topic:
Security, Cybersecurity, and Financial Markets
Political Geography:
Global Focus

77. Aviation cybersecurity: Scoping the challenge

Author:
Pete Cooper, Simon Handler, and Safa Shahwan Edwards
Publication Date:
12-2019
Content Type:
Special Report
Institution:
Atlantic Council
Abstract:
In the past decade, the aviation industry has reaped the benefits of digitization. With the aircraft efficiency gains and enhancements to the passenger experience catalyzed by new technologies, we have to acknowledge the corresponding new risks, including social and technical vulnerabilities never before addressed. In 2017, the Atlantic Council released its ground-breaking report, Aviation Cybersecurity—Finding Lift, Minimizing Drag. The report raised awareness on the state of cybersecurity in the aviation industry, sparking public dialogue on the intersection of cybersecurity and aviation. This created a foundation for the aviation community to convene around protecting the traveling public. Since then, it has become evident that anticipating, identifying, and mitigating cyberspace vulnerabilities in aviation will require the buy-in of all stakeholders in this ecosystem. Two years on, Thales is honored to continue its support for the Atlantic Council and this crucial initiative that aims to map perspectives on cybersecurity across this diverse industry and highlight the growing need for collaboration across stakeholders. Ultimately, there is no silver bullet for aviation cybersecurity, and confronting cyber risk in aviation will require a global approach, working across safety, security, cybersecurity, and enterprise IT. This report and the accompanying global survey developed by the Atlantic Council will increase our holistic understanding of aviation cyber risk and drive meaningful engagement across the aviation community. This effort to broaden the community of stakeholders examining cybersecurity in aviation will increase our collective security, safety, and resilience. When it comes to the trust of travelers, we are all only as strong as those most vulnerable among us. It is only through mutual understanding and collaboration that we can continue to challenge one another, grow, and improve. I applaud the Atlantic Council for embracing this topic and am proud Thales has the chance to support this work.
Topic:
International Organization, Science and Technology, Infrastructure, Cybersecurity, Innovation, and Aviation
Political Geography:
Global Focus

78. What do we know about cyber escalation? Observations from simulations and surveys

Author:
Benjamin Jensen and Brandon Valeriano
Publication Date:
11-2019
Content Type:
Policy Brief
Institution:
Atlantic Council
Abstract:
Do cyber operations alter how states respond to international crises in a way that creates incentives for decision makers to cross the Rubicon and use military force to settle disputes? This question is central to current cyber strategy debates and the idea of persistent engagement and defending forward in cyberspace. The answer is surprising: no. Based on the evidence, cyber operations offer a valuable escalatory offramp.
Topic:
Security, Science and Technology, Cybersecurity, and Crisis Management
Political Geography:
Global Focus

79. Cyber Risk Scenarios, the Financial System, and Systemic Risk Assessment

Author:
Lincoln Kaffenberger and Emanuel Kopp
Publication Date:
09-2019
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
Cyber risk has become a key issue for stakeholders in the financial system. But its properties are still not precisely characterized and well understood. To help develop a better understanding, we discuss the properties of cyber risk and categorize various cyber risk scenarios. Furthermore, we present a conceptual framework for assessing systemic cyber risk to individual countries. This involves analyzing cyber risk exposures, assessing cybersecurity and preparedness capabilities, and identifying buffers available to absorb cyber risk–induced shocks.
Topic:
Science and Technology, Cybersecurity, Finance, Internet, and Risk
Political Geography:
Global Focus

80. Patching Our Digital Future Is Unsustainable and Dangerous

Author:
Melissa Hathaway
Publication Date:
06-2019
Content Type:
Working Paper
Institution:
Centre for International Governance Innovation (CIGI)
Abstract:
In recent years, the world has witnessed an alarming number of high-profile cyber incidents, harmful information and communications technology (ICT) practices, and internationally wrongful acts through the misuse of ICTs. Over the last 30 years, a unique and strategic vulnerability has been brought to society — by allowing poorly coded or engineered, commercial-off-the-shelf products to permeate and power every aspect of our connected society. These products and services are prepackaged with exploitable weaknesses and have become the soft underbelly of government systems, critical infrastructures and services, as well as business and household operations. The resulting global cyber insecurity poses an increasing risk to public health, safety and prosperity. It is critical to become much more strategic about how new digital technologies are designed and deployed, and hold manufacturers of these technologies accountable for the digital security and safety of their products. The technology industry has fielded vulnerable products quickly — now, it is crucial to work together to reduce the risks created and heal our digital environment as fast as society can.
Topic:
Security, Science and Technology, Cybersecurity, Digital Economy, and Surveillance
Political Geography:
Global Focus