CYBERSECURITY
U.S. already at war in cyberspace, experts say
SAN FRANCISCO — Cyber warfare is a reality, and the United States already has been engaged by a number of adversaries, a panel of experts said today at the RSA Security Conference.
“There is no question we are in the midst of a cyberwar,” added Dmitri Alperovitch, vice president of threat research at McAfee.
Because the war involves infiltration, espionage and sabotage rather than conventional weapons, it looks much like the Cold War waged by the United States and the Soviet Union in the post-World War II 20th century. But there are important differences, the panelists said. The Cold War was bipolar, with just two sides; there are many players in the cyberwar, and they each can have different goals.
“We knew what the rules of engagement were during the Cold War,” said Ed Giorgio, president of Ponte Technologies, who worked at the National Security Agency for 30 years. But no one knows what rules we are playing by now. “If we play the game by a different set of rules than our adversaries, we are going to lose. The rules of engagement are important.”
One of the greatest differences between the Cold War and the current cyber war is that we knew our Cold War adversaries. Today, we do not necessarily know the source of the cyberattacks that are hitting and sometimes penetrating our information systems.
“Direct technical attribution is difficult, if not impossible,” said Ed Skoudis, a senior security consultant at InGuardian, who is working at the National Defense University on a project on the use of cyber power. The lack of knowledge has an impact on the kind of response the United States can make. Although an attack may appear to come from one country, “You can’t jump to the obvious conclusion that the country is behind it.”
Alperovitch said that although attribution may be difficult, it is not impossible. “We have a number of capabilities to determine attribution,” he said, including diplomatic and intelligence channels.
Keeping the cyber war from evolving into a shooting war ultimately will depend on developing a set of rules to play by, said Thomas Fuhrman, a partner at Booz Allen Hamilton who works with the Defense Department. “Looking forward, what we need are cyber war rules,” Fuhrman said. “Today, there are no rules.”
Issues of state sovereignty, privacy rights, and criminal and international law have not been addressed in this arena. Rules and norms for this new type of war eventually will emerge, Fuhrman said. “The question is, can they be accelerated,” so that we don’t end up in a shooting war while we’re waiting.
About the Author
William Jackson is a senior writer for GCN.