Search

Begin New Search Topic Cybersecurity Publication Year within 25 Years

281. The Army Role in Achieving Deterrence in Cyberspace

Author:
Jeffrey L. Caton
Publication Date:
03-2019
Content Type:
Special Report
Institution:
The Strategic Studies Institute of the U.S. Army War College
Abstract:
publication cover In 2015, the Department of Defense (DoD) released the DoD Cyber Strategy which explicitly calls for a comprehensive strategy to provide credible deterrence in cyberspace against threats from key state and nonstate actors. To be effective, such activities must be coordinated with ongoing deterrence efforts in the physical realm, especially those of near-peers impacting critical global regions such as China in the Asia-Pacific region and Russia in Europe. It is important for the U.S. Army to identify and plan for any unique roles that they may provide to these endeavors. This study explores the evolving concept of deterrence in cyberspace in three major areas: • First, the monograph addresses the question: What is the current U.S. deterrence posture for cyberspace? The discussion includes an assessment of relevant current national and DoD policies and concepts as well as an examination of key issues for cyber deterrence found in professional literature. • Second, it examines the question: What are the Army’s roles in cyberspace deterrence? This section provides background information on how Army cyber forces operate and examines the potential contributions of these forces to the deterrence efforts in cyberspace as well as in the broader context of strategic deterrence. The section also addresses how the priority of these contributions may change with escalating levels of conflict. • Third, the monograph provides recommendations for changing or adapting the DoD and Army responsibilities to better define and implement the evolving concepts and actions supporting deterrence in the dynamic domain of cyberspace.
Topic:
Defense Policy, Government, Non State Actors, Cybersecurity, and Army
Political Geography:
Russia, China, Europe, Asia-Pacific, and United States of America

282. Implications of Service Cyberspace Component Commands for Army Cyberspace Operations

Author:
Jeffrey L. Caton
Publication Date:
02-2019
Content Type:
Special Report
Institution:
The Strategic Studies Institute of the U.S. Army War College
Abstract:
The first 7 years of U.S. Cyber Command operations are paved with milestones that mark the steady operationalization of modern cyberspace as the newest domain of military conflict as well as a realm of international power. The creation of the Cyber Mission Force and Joint Force Headquarters-Cyber are significant steps toward improving the timeliness and effectiveness of cyberspace operations that directly support combatant commands and the whole-of-government responses to cyberspace threats. It focuses on the central question: “What is the context in which different military services approach cyberspace component operations internally as well as with the Department of Defense?”
Topic:
Defense Policy, Military Affairs, Cybersecurity, and Army
Political Geography:
North America and United States of America

283. Examining the Roles of Army Reserve Component Forces in Military Cyberspace Operations

Author:
Jeffrey L. Caton
Publication Date:
01-2019
Content Type:
Special Report
Institution:
The Strategic Studies Institute of the U.S. Army War College
Abstract:
Cyberspace operations have become pervasive in the United States, and they enable many aspects of modern life for the average citizen, such as entertainment, communication, education, transportation, banking, and voting. The continuing development of the U.S. Army and Department of Defense (DoD) Reserve component cyberspace units can leverage the capabilities and experience of industry and academia to help protect critical information infrastructure and enhance national security. What opportunities and challenges surround the integration of these forces into a still-evolving joint cyberspace force?
Topic:
Defense Policy, Armed Forces, Military Affairs, Cybersecurity, and Army
Political Geography:
North America and United States of America

284. Cyber Risk Scenarios, the Financial System, and Systemic Risk Assessment

Author:
Lincoln Kaffenberger and Emanuel Kopp
Publication Date:
09-2019
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
Cyber risk has become a key issue for stakeholders in the financial system. But its properties are still not precisely characterized and well understood. To help develop a better understanding, we discuss the properties of cyber risk and categorize various cyber risk scenarios. Furthermore, we present a conceptual framework for assessing systemic cyber risk to individual countries. This involves analyzing cyber risk exposures, assessing cybersecurity and preparedness capabilities, and identifying buffers available to absorb cyber risk–induced shocks.
Topic:
Science and Technology, Cybersecurity, Finance, Internet, and Risk
Political Geography:
Global Focus

285. Patching Our Digital Future Is Unsustainable and Dangerous

Author:
Melissa Hathaway
Publication Date:
06-2019
Content Type:
Working Paper
Institution:
Centre for International Governance Innovation (CIGI)
Abstract:
In recent years, the world has witnessed an alarming number of high-profile cyber incidents, harmful information and communications technology (ICT) practices, and internationally wrongful acts through the misuse of ICTs. Over the last 30 years, a unique and strategic vulnerability has been brought to society — by allowing poorly coded or engineered, commercial-off-the-shelf products to permeate and power every aspect of our connected society. These products and services are prepackaged with exploitable weaknesses and have become the soft underbelly of government systems, critical infrastructures and services, as well as business and household operations. The resulting global cyber insecurity poses an increasing risk to public health, safety and prosperity. It is critical to become much more strategic about how new digital technologies are designed and deployed, and hold manufacturers of these technologies accountable for the digital security and safety of their products. The technology industry has fielded vulnerable products quickly — now, it is crucial to work together to reduce the risks created and heal our digital environment as fast as society can.
Topic:
Security, Science and Technology, Cybersecurity, Digital Economy, and Surveillance
Political Geography:
Global Focus

286. Spies, Election Meddling, And Disinformation: Past And Present

Author:
Calder Walton
Publication Date:
09-2019
Content Type:
Research Paper
Institution:
Brown Journal of World Affairs
Abstract:
Spies, election meddling, disinformation, influence operations, data har- vesting: at present, it seems barely a moment passes without another intelligence scandal breaking on our news feeds. Following Russia’s “sweeping and systematic” attack on the 2016 U.S. presidential election—which was intended to support Moscow’s favored candidate, Donald J. Trump, and undermine his opponent, Hillary Clinton—the media frequently labeled the operation “unprecedented.” The social-media technologies that Russia deployed in its cyber-attack on the United States in 2016 were certainly new, but Russia’s strategy was far from unusual. In fact, the Kremlin has a long history of meddling in U.S. and other Western democratic elections and manufacturing disinformation to discredit and divide the West. Russia’s leader, Vladimir Putin, a former KGB officer, has reconstituted and updated the KGB’s old Cold War playbook for the new digital age. This paper, an exercise of applied history, has two aims: first, to understand the history of Soviet disinformation, and second, to make sense of Western efforts to counter it during the Cold War. Doing so provides policy-relevant conclusions from history about countering disinformation produced by Russia and other authoritarian regimes today.
Topic:
Elections, Cybersecurity, Democracy, Election watch, and Espionage
Political Geography:
Russia, United States, and Soviet Union

287. The Need for Countries to Establish Robust and Transparent Vulnerabilities Equities Processes

Author:
Sharon Bradford Franklin
Publication Date:
07-2019
Content Type:
Journal Article
Journal:
Fletcher Security Review
Institution:
The Fletcher School, Tufts University
Abstract:
In 2017, leaders of the U.S. Intelligence Community warned that “more than 30 nations are developing offensive cyberattack capabilities.”1 This means that more than 30 countries may be conducting hacking operations as a method for surveillance, disruption, or destruction. Unregulated cyber surveillance and cyberattacks by government actors can pose risks not only to a government’s foreign adversaries, but also to its own citizens. Thus, as the United States and other nations work to enhance their own offensive cyber capabilities, as well as to develop strategies to defend against potential attacks, it is critical that these countries establish legal regimes to govern such conduct in cyberspace. Although Germany has established a legal framework to regulate government hacking activities,[2] few countries have done so.[3] ​ To bring government hacking operations within the rule of law, a crucial step is to design rules regarding the management of vulnerabilities that governments discover or acquire. As with other cyber actors, when governments conduct hacking operations, this frequently involves exploiting vulnerabilities in computer hardware and software systems. But these same flaws can also be manipulated by a government’s foreign adversaries or other malicious actors. Therefore, when countries consider their abilities to rely on hacking as an investigative tool, as well as their interests in exploiting vulnerabilities for military and intelligence operations, they must also evaluate the capacity of information and communications technology providers to repair bugs and protect the cybersecurity of all users. Determining whether to exploit a vulnerability or disclose it to a vendor for patching involves balancing a variety of different security concerns against each other. ​ Some countries have made progress in formalizing the rules for making these decisions and in publicizing these rules to promote public accountability. In November 2017, the United States released a charter governing its Vulnerabilities Equities Process (VEP), which outlines how the U.S. government weighs the various competing equities.[4] The charter delineates which components of the government will participate in determinations regarding whether to disclose or retain each newly discovered vulnerability, and it sets forth the criteria to be used and the process to be followed in making such assessments. One year later, the United Kingdom (UK) announced its Equities Process, which follows a similar approach.5 Most recently, in March 2019, Australia released its “Responsible Release Principles for Cyber Security Vulnerabilities,”[6] and Germany is currently working to develop a VEP and is expected to make information about its process public in early 2019.[7] However, as described below, the VEP procedures revealed to date need further improvement,[8] and most of the nations with offensive cyber capabilities have not developed—or at least have not announced—any such framework...
Topic:
Security, Intelligence, Science and Technology, and Cybersecurity
Political Geography:
North America and United States of America

288. How Much Does a “Privacy” Weigh?

Author:
Paul Rosenzweig
Publication Date:
07-2019
Content Type:
Journal Article
Journal:
Fletcher Security Review
Institution:
The Fletcher School, Tufts University
Abstract:
Benjamin Franklin is famous, in part, for having said, “Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety.” Though historical evidence suggests Franklin’s quote has been misinterpreted,[1] the aphorism has come to stand for the proposition that privacy and security stand in opposition to each other, where every increase in security likely results in a commensurate decrease in privacy, and vice versa. ​ Couched in those terms, the privacy/security trade-off is a grim prospect. We naturally want both privacy and security to the greatest extent possible. But Franklin tells us this is impossible — that privacy and security are locked in a zero-sum game where the gain of one comes only at the loss of the other. ​ Of course, this characterization is assuredly flawed; it is certainly possible to adopt systems that maximize both privacy and security in a Pareto optimal way. That is one of the reasons why so many privacy and security experts simply revile the “balancing” metaphor — it obscures more than it illuminates... ​
Topic:
Security, Science and Technology, Cybersecurity, and Privacy
Political Geography:
Global Focus and United States of America

289. The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age by David Sanger

Author:
David Sanger and Travis Frederick
Publication Date:
07-2019
Content Type:
Journal Article
Journal:
Fletcher Security Review
Institution:
The Fletcher School, Tufts University
Abstract:
In The Perfect Weapon, David Sanger argues that the nature of global power itself is undergoing dramatic changes, brought about by the proliferation of highly advanced cyber capabilities. Today, internet access is nearly ubiquitous, the cost of entry is low, and, particularly in the domain of cyberwarfare, there is one fundamental fact: offensive capabilities have critically outpaced cyber defenses. A weak and impoverished nation like North Korea can hold large swaths of public and private infrastructure in America at risk, steal military OpPlans, and pilfer millions of dollars from foreign banks. A Kremlin reeling from sanctions, low oil prices, and historically low public trust is able to threaten the very foundations of American democracy through targeted social media campaigns and hacking and leaking the emails of a major political party. But while the offensive advantage has given weaker powers greater capacity to pursue their geopolitical objectives, U.S. leadership has found that their response options have not similarly benefitted. America’s offensive cyber prowess so exceeds its own defensive capabilities that officials often hesitate to strike back for fear of establishing norms of retaliation against vulnerable infrastructure or inciting unintended escalation. Sanger argues that without an open public debate among government policy makers, military planners, and academics to coordinate a grand strategy, the United States will be forced to accept a world of constant cyberattacks, limited response options, and the greater risk of capitulating to foreign coercion...
Topic:
Security, Intelligence, Science and Technology, Cybersecurity, and Book Review
Political Geography:
North America and United States of America

290. An Effects-Centric Approach to Assessing Cybersecurity Risk

Author:
Charles Harry and Nancy Gallagher
Publication Date:
03-2019
Content Type:
Working Paper
Institution:
Center for International and Security Studies at Maryland (CISSM)
Abstract:
Faced with rapidly growing cyber threats, organizational leaders, and government officials cannot reliably secure all data and digital devices for which they are responsible. The best they can do is conduct strategic risk management. That requires a systematic way to categorize potential attacks and estimate consequences in order to set priorities, allocate resources, and mitigate losses. The 2018 U.S. National Cyber Strategy holds government officials accountable for doing cyber risk management based on the National Institute of Standards and Technology’s (NIST) Cybersecurity Framework and recommendations from not-for-profit organizations such as the Center for Internet Security (CIS) and ISACA. Yet, none of these policy documents and best practice guides actually provide the necessary analytical tools. As a result, public agencies, private companies, and non-profit groups that try to do risk assessment often feel overwhelmed rather than empowered to make strategic cybersecurity decisions. The Center for International and Security Studies at Maryland (CISSM) has developed an analytical framework that provides four essential building blocks needed to satisfy the principles in the NIST Standard Framework and other best practice guides: 1. A standardized system for classifying cyber threats and events by their effects. 2. Tools to associate organizational functions with IT topologies. 3. Algorithms to assess the severity of disruptive and exploitative cyber events. 4. A method to understand the integrated nature of risk across different parts of a simple organization, major divisions of a complex organization, or interconnected organizations in a complex system. These building blocks can be combined in different ways to answer critical questions, such as: • What is the range of cyber risks to different types of organizations? • Which threats pose the greatest risk to a specific department or organization? • How could an attack on one part of an IT network affect other organizational functions? • What is the accumulated risk across a critical infrastructure sector or geography? Using a comprehensive, consistent, and repeatable method to categorize and measure risk can enhance communication and decision-making among executives who make strategic decisions for organizations and their IT staff with day-to-day responsibility for cybersecurity. It can facilitate cooperation between public officials and private industry who share responsibility for different components of national critical infrastructure. It can inform media coverage and public debate about important policy questions, such as which decisions about cybersecurity should be purely private decisions, whether government should incentivize or mandate certain cybersecurity choices, and when a cyber attack warrants some type of military response.
Topic:
Science and Technology, Military Strategy, Cybersecurity, and Media
Political Geography:
Global Focus