Search

Begin New Search Topic Cybersecurity Publication Year within 10 Years

21. Cyber-incident Management: Identifying and Dealing with the Risk of Escalation

Author:
Fei Su, Dr Vincent Boulanin, and Johan Turell
Publication Date:
09-2020
Content Type:
Working Paper
Institution:
Stockholm International Peace Research Institute
Abstract:
The ever-increasing dependence on information and communication technologies (ICTs) in all aspects of society raises many challenges for national crisis management agencies. These agencies need to prepare not only for new cyberthreats and cyber vulnerabilities, but also for the fact that the aftermath of a cyber incident affecting critical infrastructure has its own challenges. On the one hand, the practical disruptions caused by an isolated incident can be hard to predict and control and, on the other hand, the consequences and perceptions of an incident whose cause is not yet determined can be equally hard to manage. Uncertainty around the cause of the incident and remedial actions being taken often lead to public speculation and political pressure to respond in ways that could create political tensions, and possibly conflict, between countries. This policy paper is the result of a nine-month research project that was jointly conducted by SIPRI and the Swedish Civil Contingencies Agency (MSB) on cyber-incident management. It explores what national crisis management authorities can do to improve their cyber-incident prevention, detection and response strategies and also how they can do better to deal with the larger societal and potentially political aftermath. It investigates why and how cyber incidents may lead to escalatory scenarios and how these scenarios can be avoided and contained using various de-escalatory approaches. It comprises an introduction providing background and the inspiration of this report (section I); four sections that explore the dynamics of escalation and de-escalation from conceptual (section II), analytical (sections III–IV) and empirical (section V) standpoints; and two sections that present the main findings and recommendations (sections VI–VII).
Topic:
Security, Science and Technology, Military Affairs, and Cybersecurity
Political Geography:
Sweden and Global Focus

22. Exposing the Financial Footprints of North Korea’s Hackers

Author:
Jason Bartlett
Publication Date:
11-2020
Content Type:
Special Report
Institution:
Center for a New American Security
Abstract:
North Korea conducts intricate and sweeping cyberattacks against the United States and its allies to acquire funds to support its illicit nuclear proliferation efforts. Unlike more economically advanced nuclear states possessing domestic research, development, and deployment capacities to establish weapon of mass destruction (WMD) programs, the Democratic People’s Republic of Korea (DPRK) must seek financial resources, assistance, and institutional knowledge, at least initially, from overseas. It has developed its cyber capabilities in order to circumvent financial sanctions and global safeguards, conducting elaborate online bank heists and hacking attacks; stealing funds through fraudulent bank transfers, Society for Worldwide Interbank Financial Telecommunications (SWIFT) transactions, and ATM cash-outs; launching ransomware attacks demanding payment in cryptocurrency; and hacking cryptocurrency exchanges. The scale and sophistication of these innovative sanctions evasion tactics create a challenge that calls for stronger measures to confront them. In addition to providing policy recommendations for U.S. leadership and financial institutions, this report will outline the ways North Korea supports, expands, and utilizes cyber operations to acquire funds for its nuclear weapons program.
Topic:
Science and Technology, Cybersecurity, and Finance
Political Geography:
Asia, North Korea, North America, and United States of America

23. Defense Technology Strategy

Author:
Paul Scharre and Ainikki Riikonen
Publication Date:
11-2020
Content Type:
Special Report
Institution:
Center for a New American Security
Abstract:
The Department of Defense’s (DoD) ever-shifting technology priorities jeopardize its ability to win a long-term technology competition. The DoD needs a systematic approach—a technology strategy—for how to prioritize technology investments. The dominant global tech trend today is the information revolution, which is leading to exponential growth in digital capabilities. The top priority of the DoD’s technology strategy should be rapidly spinning in and militarizing digital technologies generated in the private sector. The DoD should invest in key military-specific technologies, such as hypersonics or directed energy weapons, when there is clear operational value but should expect advancements to be incremental.
Topic:
Defense Policy, Science and Technology, Cybersecurity, and Investment
Political Geography:
North America and United States of America

24. Rebooting Congressional Cybersecurity Oversight

Author:
Carrie Cordero and David Thaw
Publication Date:
01-2020
Content Type:
Special Report
Institution:
Center for a New American Security
Abstract:
Cybersecurity oversight is due for a reboot. This paper explores the need for refreshed congressional oversight of cybersecurity. After laying out why cybersecurity oversight presents special challenges, this paper suggests that the disparate nature of the cybersecurity policymaking legal framework is mismatched to the nature of the cybersecurity problem, resulting in difficulty legislating in this space. It then provides two key recommendations to guide a congressional cybersecurity oversight reboot. Cybersecurity is a broad challenge spanning many disciplines and industries. This paper argues that the current “patchwork” legal framework is ill suited to address cybersecurity questions either for legislative oversight or effective policymaking. The paper provides an overview of the nature and scope of the cybersecurity problem, with a focus on how the complexity of the field affects congressional oversight activities. Congress has been conducting a substantial amount of oversight in this area in recent years. Those efforts, however, have not yet resulted in legislative actions that have demonstrably improved national cybersecurity. This paper seeks to aid the effort to craft legal authorities that deal with an increasingly complex set of cyberthreats. This short exposition provides a path to rebooting Congress’ approach to cybersecurity oversight in a way that would allow these issues to be addressed more comprehensively.
Topic:
Security, Science and Technology, and Cybersecurity
Political Geography:
Global Focus

25. Cybersecurity: State Attack and Response Strategies

Author:
Josephine Wolff and Ta-Chun Su
Publication Date:
07-2020
Content Type:
Journal Article
Journal:
Fletcher Security Review
Institution:
The Fletcher School, Tufts University
Abstract:
. One of the questions that has always been very interesting to me is “Who do we hold responsible when something goes wrong with cybersecurity?” While that is a technical question—because often when something goes wrong, there is a technical component since you are dealing with a computer and the Internet—it also very much has to do with what our liability regimes say, what our policies say, what our social norms and expectations say about who we hold accountable and who is expected to pay for the damage. So for me, I think cybersecurity is about trying to understand what we mean when we talk about the "secure Internet,” what it looks like to have a secure Internet, and who we hold responsible for all the different components of how you get there. To whom do we say “It’s your job not to answer the phishing emails,” or “It’s your job to look for bug traffic on the network.” How do we piece together that entirely complicated ecosystem of different stakeholders, and how do we identify what their different roles and responsibilities should be? ...
Topic:
Security, Science and Technology, Cybersecurity, and Interview
Political Geography:
Global Focus

26. Two Superpandemics for One Humanity Is Too Many!

Author:
A. Krutskikh
Publication Date:
01-2020
Content Type:
Journal Article
Journal:
International Affairs: A Russian Journal of World Politics, Diplomacy and International Relations
Institution:
East View Information Services
Abstract:
Interview woth Andrei Krutskikh, Special Representative of the Russian President on International Cooperation in the Field of Information Security, Director of the Department of International Information Security at the Ministry of Foreign Affairs of the Russian Federation.
Topic:
Cybersecurity, Public Health, Pandemic, COVID-19, and Health Crisis
Political Geography:
Global Focus

27. Journal of Advanced Military Studies: Spring 2020

Author:
Donald M. Bishop, Valerie Jackson, Christopher Davis, Evan N. Polisar, Kerry K. Gershaneck, Troy E. Mitchell, James R. R. Van Eerden, Rosario M. Simonetti, Paolo Tripodi, David E. McCullin, Christopher Whyte, and Jeannie L. Johnson
Publication Date:
03-2020
Content Type:
Journal Article
Journal:
Journal of Advanced Military Studies
Institution:
Marine Corps University Press, National Defense University
Abstract:
In 2010, MCU Press published the first issue of this journal, formerly known as Marine Corps University Journal, to serve as the bridge between the military Services and the professional military educators, strategists, and historians within the greater Department of Defense community. During the ensuing years, the press and the journal have evolved to offer innovative and active content that continues to serve as a forum for interdisciplinary discussion of national security and international relations issues and how they impact the Department of Defense, the Department of the Navy, and the U.S. Marine Corps. Now, 10 years later, we see the need to evolve and offer a wider base for those conversations to take place. To celebrate this 10-year anniversary and to reflect the journal’s change in focus over time, the journal has been renamed the Journal of Advanced Military Studies (JAMS) to honor the constant innovation of our content, our authors, and the topics we present to our readers. JAMS will continue to offer readers thematic, biannual issues that encourage and continue the debates happening across Marine Corps University, the Services, and the Department of Defense. It is no coincidence then that this issue of JAMS focuses on innovation and the future of warfare. Each of the articles presented offers the readers a deep dive into a historical, current, or forward-looking perspective on innovation and the military Services. As with any discussion of the military and abstract concepts such as innovation, we must first set the parameters of our discussion. For many readers, the term innovation evokes thoughts of technology, shiny gadgets, and artificial intelligence. While innovation is not necessarily synonymous with technology, it is certainly a challenge to say what in fact it is—a thing, a concept, an action, the people involved, or all of the above. The experts may not agree on what innovation is, but they can agree that it requires change or transformation to be successful. Sun Tzu’s The Art of War compares the nature of warfare to that of water for “just as water retains no constant shape, so in warfare there are no constant conditions.” More contemporary agents of innovation include military theorists such as Earl H. Ellis, John R. Boyd, Michael D. Wyly, and John F. Schmitt. Lieutenant Colonel Earl Ellis’s work on Advanced Base Operations in Micronesia (Operation Plan 712) in 1921 clearly demonstrated his ability to forecast the future needs for amphibious warfare in the Pacific two decades prior to World War II. Though most readers will recognize former Air Force colonel John R. Boyd for his observe-orient-decide-act (OODA) decision-making loop, his more innovative work may well be seen in the energy maneuverability (E-M) theory, a mathematical study of fighter aviation. Then-major Wyly was tasked with reforming the Marine Corps concept of maneuver warfare in the wake of the Vietnam War. The work of Wyly, Boyd, and William S. Lind would serve as the foundation for Warfighting, Marine Corp Doctrinal Publication (MCDP) 1, that was later formally written by then-captain John Schmitt, along with several other doctrinal publications, including Ground Combat Operations, Campaigning, Command and Control, Planning, Expeditionary Operations, and a revision of Warfighting. The articles in this issue of JAMS continue the discussion fostered by these innovative pathfinders. Our introductory section from the Brute Krulak Center for Innovation and Creativity discusses the conception and creation of the center and some of its most innovative programs, including the award-winning Destination Unknown graphic novel and the center’s first essay contest, the U.S. Marine Corps Postmortem, and offers insight from Marine Corps leaders who consider both success and failure as critical measures for the strength of an organization. For example, Lieutenant General Loretta E. Reynolds contemplates how the Corps “must find a way to manage today’s risks while constantly readying ourselves for the emerging challenges of the future fight.”
Topic:
Security, Defense Policy, Military Strategy, Counterinsurgency, Culture, Armed Forces, Authoritarianism, Cybersecurity, Democracy, Geopolitics, History, Surveillance, Think Tanks, Propaganda, Innovation, Armed Conflict, and Game Theory
Political Geography:
Russia, China, Haiti, North America, United States of America, and Indo-Pacific

28. An Effects-Centric Approach to Assessing Cybersecurity Risk

Author:
Charles Harry and Nancy Gallagher
Publication Date:
03-2019
Content Type:
Working Paper
Institution:
Center for International and Security Studies at Maryland (CISSM)
Abstract:
Faced with rapidly growing cyber threats, organizational leaders, and government officials cannot reliably secure all data and digital devices for which they are responsible. The best they can do is conduct strategic risk management. That requires a systematic way to categorize potential attacks and estimate consequences in order to set priorities, allocate resources, and mitigate losses. The 2018 U.S. National Cyber Strategy holds government officials accountable for doing cyber risk management based on the National Institute of Standards and Technology’s (NIST) Cybersecurity Framework and recommendations from not-for-profit organizations such as the Center for Internet Security (CIS) and ISACA. Yet, none of these policy documents and best practice guides actually provide the necessary analytical tools. As a result, public agencies, private companies, and non-profit groups that try to do risk assessment often feel overwhelmed rather than empowered to make strategic cybersecurity decisions. The Center for International and Security Studies at Maryland (CISSM) has developed an analytical framework that provides four essential building blocks needed to satisfy the principles in the NIST Standard Framework and other best practice guides: 1. A standardized system for classifying cyber threats and events by their effects. 2. Tools to associate organizational functions with IT topologies. 3. Algorithms to assess the severity of disruptive and exploitative cyber events. 4. A method to understand the integrated nature of risk across different parts of a simple organization, major divisions of a complex organization, or interconnected organizations in a complex system. These building blocks can be combined in different ways to answer critical questions, such as: • What is the range of cyber risks to different types of organizations? • Which threats pose the greatest risk to a specific department or organization? • How could an attack on one part of an IT network affect other organizational functions? • What is the accumulated risk across a critical infrastructure sector or geography? Using a comprehensive, consistent, and repeatable method to categorize and measure risk can enhance communication and decision-making among executives who make strategic decisions for organizations and their IT staff with day-to-day responsibility for cybersecurity. It can facilitate cooperation between public officials and private industry who share responsibility for different components of national critical infrastructure. It can inform media coverage and public debate about important policy questions, such as which decisions about cybersecurity should be purely private decisions, whether government should incentivize or mandate certain cybersecurity choices, and when a cyber attack warrants some type of military response.
Topic:
Science and Technology, Military Strategy, Cybersecurity, and Media
Political Geography:
Global Focus

29. Cyber-Security: The Threats from Russia and the Middle East

Author:
Ferry de Kerckhove
Publication Date:
12-2019
Content Type:
Policy Brief
Institution:
Canadian Global Affairs Institute (CGAI)
Abstract:
The art of war has changed considerably since the end of the Second World War. In the last 15 years, the centre of gravity has slowly shifted from the Atlantic to the Pacific. The West is increasingly being destabilized. Hybrid warfare and cyber-attacks have become increasingly effective alternatives to both hard and soft power. Russia is a major player in this domain; so is Iran. Other players are joining the fray, most of them hostile to the West, such as Iran and Russia’s client states. The barriers between civilian and military are fading quickly. All-out war now happens in a space that’s invisible to the naked eye. Not only is such warfare threatening us, but it also has consequences we have barely begun to assess. The divide between good and bad is blurring. Marshall McLuhan said the medium is the message. Today, the medium and the message are an undecipherable continuum where evil and lies coexist with truth and goodwill. Technological prowess increases vulnerability, but technology is also at the heart of corresponding systems of security. Thus, we have fully entered a new arms race where deterrence comes from the other side knowing what you don’t want him to discover, but what you want him to fear. Voltaire said: “If you wish to speak to me, let us start by defining the meaning of our words.” In this day and age, this mantra is particularly applicable to the definition of contemporary threats as well as of the targets, or even who is in the sights of Russian and Middle Eastern leaders. “Cyberspace is a domain characterized by the use of electronics and the electromagnetic spectrum to store, modify, and exchange data via networked systems and associated physical infrastructures. In effect, cyberspace can be thought of as the interconnection of human beings through computers and telecommunication, without regard to physical geography.” Consequently, “(c)ybersecurity is the practice of protecting systems, networks, and programs from digital attacks. These cyberattacks are usually aimed at accessing, changing, or destroying sensitive information; extorting money from users; or interrupting normal business processes. Implementing effective cybersecurity measures is particularly challenging today because there are more devices than people, and attackers are becoming more innovative.” Discussions focus on whether Russia or China is the heavyweight in terms of threat. Some argue that China is more subtle while Russia is more of a rogue. But it is undeniable that China’s attempt to change the fundamental paradigm of international relations, while using and hopefully subduing the existing international order’s mechanisms to its advantage, represents a holistic approach and is thus more threatening to the world if it even partly succeeds. Indeed, the planet’s centre of gravity is moving from the Atlantic to the Pacific and that means the global threat comes from China. If we needed a reminder, in 2014 Chinese hackers stole the personal information of more than 22 million people connected to U.S. security clearance processes. Not bad for five years ago!
Topic:
Security, Science and Technology, and Cybersecurity
Political Geography:
Russia, Iran, and Middle East

30. The Russian Military in Contemporary Perspective

Author:
Stephen J. Blank
Publication Date:
09-2019
Content Type:
Special Report
Institution:
The Strategic Studies Institute of the U.S. Army War College
Abstract:
Wherever one looks, Russia is carrying out aggressive military and informational attacks against the West in Europe, North and South America, the Arctic, and the Middle East. This “war against the West” actually began over a decade ago, but its most jarring and shocking event, the one that started to focus Western minds on Russia, was the invasion of Ukraine in 2014. Given this pattern, the National Security Council (NSC) in 2014 invited Stephen Blank to organize a conference on the Russian military. We were able to launch the conference in 2016 and bring together a distinguished international group of experts on the Russian military to produce the papers that were then subsequently updated for presentation here.
Topic:
Nuclear Weapons, War, Military Strategy, Military Affairs, Authoritarianism, Cybersecurity, and Vladimir Putin
Political Geography:
Russia, Ukraine, Asia, Syria, North America, and United States of America