Welcome!

@BigDataExpo Authors: Pat Romanski, Liz McMillan, Carmen Gonzalez, Elizabeth White, Harry Trott

Blog Feed Post

My Infosec Wish for 2013: A Balanced Cyberwarfare Debate

By

CybersoldiersI can already hear the chuckling. “Cyber warfare? Balanced? And I’d like partisanship in Washington to end, a double date with Mila Kunis and Scarlett Johansson, and some fries with that!” Yes, my desire is utopian, but the fact that I would have to qualify it with a self-deprecating remark suggests the distance that we have yet to travel before we can get more value out of our present conversation on the topic of cyber warfare.

First, let’s start with the unfortunate fact that little is really new. As CTOVision head honcho Bob Gourley notes, we’ve had so many “cyber wake up calls” as to render the phrase meaningless. If these are wake-up calls, someone keeps hitting the snooze button. We know that our SCADA systems are vulnerable, and have been vulnerable for a while. We know that air-gapping will not protect our systems, and that our systems can be attacked through their subsystems. We also understand that espionage and covert operations pose a fundamental attribution problem worsened by the fact that investigation requires cooperation from governments with something to hide. Anonymous and other decentralized hacking collectives? Predicted and analyzed 20 years ago. Finally, we also (should) get that everything from vendors to human psychology provides a multitude of attack surfaces for a potential attacker. Clearly, we’ve had plenty of forewarning for the calamities we’re suffering and have yet to suffer.

But knowing is unfortunately not, as I learned from watching GI JOE cartoon shows, half the battle. On one hand, much cyber warfare conversation these days boils down to endless repetition of civilization-destroying “cyber-doom” scenarios involving genius hackers that never face intelligence, targeting, and weapon customization problems inherent in any kind of attack capable of causing meaningful kinetic damage. That might be what James Bond faces in Skyfall, but it’s not a realistic idea of the future threat. Cyberhype is endemic, and clouds meaningful assessment of dangers and the resources necessary to combat the problem. Much of what we know in other fields about the dynamics of coercion is completely overlooked in even sound technical assessments that neglect the motives and politics of potential attackers. Attribution, for example, is variable upon an actor’s desire to coerce vs. steal or damage. But while cyber-doom is not on the horizon, attention to the intersecting fields of cyber warfare, cyber conflict, and the broader issues of cyberpower yields some discomforting realizations.

For starters, the line between espionage and warfare is never clear to policymakers in practice. Solar Sunrise occurred in the middle of a standoff between the United States and Iraq, and policymakers faced uncertainty over whether the intrusion was part of the geopolitical drama. Long range cyber-reconnaissance can identify weak points. The ability to cause damage to civilian and military infrastructure may not coerce on its own but can cause cumulative damage when combined with other sources of national power. Zero-day markets and a vigorous underground may not challenge the dominance of custom-designed single shot weapons built by states but add an unstable element to the mix. Knowledge that one’s networks are vulnerable to other powers may help tilt the overall balance in larger peacetime strategic competitions. While no piece of malware has yet killed anyone, military cyberpower has helped states coordinate and employ fearsome conventional weapons.

Stuxnet, while unique, also is at times underrated. As Jason Healey noted, Stuxnet had features of autonomy and mirrors an environment in which computational agents are delegated increasingly broad cognitive powers. The way we make war often mirrors the way we make wealth, and future cyberweapons are being dreamt up in an environment characterized by the rise of a “Second Economy” built on a vast and increasingly automatic infrastructure. Cyberspace, once the humble child of the 19th century telegraphic revolution, is increasingly conquering almost every aspect of everyday life and even reaching inside the human body. It’s not surprising that many cybersecurity ideas are drawn from science fiction, even if they often mislead. Science fiction is, after all, a vehicle for commenting on destabilizing changes in the present.

The ground is shifting. DARPA’s Plan X heralds the rise of military-industrial cyber weapon complexes with streamlined cyberweapon acquisition and deployment, and potentially new kinds of cyber weapons that move beyond the network base of contemporary cyber offense and defense. Trends in computing may shift towards biological and analog computing, complicating current technical assumptions. Big data as a form of cyberpower can aid in uncovering patterns of vulnerability that targets may be entirely unaware of. New methods of password cracking challenge old assumptions about password strength and the user vector for targeting. Finally, if the operational repertoire of cyber warfare in and of itself is limited, cyberpower’s capacity to intersect with other operational environments and modify their features makes attack endlessly customizable.

The idea that the offense is dominant should be held to rigor. But so is the idea that eternal principles of cyber conflict and geopolitics can be derived from the study of an extremely limited set of cases. History is important, and is sadly overlooked in the information security and warfare fields. The Cyber Conflict Studies Association, thankfully, is seeking to remedy this. Certain essential aspects of security and war never change, and a disruption-focused tech industry ignores this at its own peril. But assumptions based on modern Internet Protocol technologies will fail to be of strategic value when attackers bypass them or the technologies change. Want an example? Take a gander at the vulnerabilities inherent in your own car. The answer is not an “everything is new” attitude, but a richer and more detailed effort to think about what precisely cyberspace is. A solid understanding of cyberspace, separate from the domination of any one kind of technology, can not only inform about the nature of cyberpower and cyber threat but also hedge against technological change. That conversation is far from finished, and hopefully 2013 will auger a more useful debate about war and other forms of conflict in cyberspace.

Read the original blog entry...

More Stories By Bob Gourley

Bob Gourley writes on enterprise IT. He is a founder and partner at Cognitio Corp and publsher of CTOvision.com

@BigDataExpo Stories
Providing secure, mobile access to sensitive data sets is a critical element in realizing the full potential of cloud computing. However, large data caches remain inaccessible to edge devices for reasons of security, size, format or limited viewing capabilities. Medical imaging, computer aided design and seismic interpretation are just a few examples of industries facing this challenge. Rather than fighting for incremental gains by pulling these datasets to edge devices, we need to embrace the i...
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo 2016 in New York. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place June 6-8, 2017, at the Javits Center in New York City, New York, is co-located with 20th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry p...
"We're bringing out a new application monitoring system to the DevOps space. It manages large enterprise applications that are distributed throughout a node in many enterprises and we manage them as one collective," explained Kevin Barnes, President of eCube Systems, in this SYS-CON.tv interview at DevOps at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
In his General Session at 17th Cloud Expo, Bruce Swann, Senior Product Marketing Manager for Adobe Campaign, explored the key ingredients of cross-channel marketing in a digital world. Learn how the Adobe Marketing Cloud can help marketers embrace opportunities for personalized, relevant and real-time customer engagement across offline (direct mail, point of sale, call center) and digital (email, website, SMS, mobile apps, social networks, connected objects).
SYS-CON Events announced today that Catchpoint, a leading digital experience intelligence company, has been named “Silver Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Catchpoint Systems is a leading Digital Performance Analytics company that provides unparalleled insight into your customer-critical services to help you consistently deliver an amazing customer experience. Designed for digital business, C...
A look across the tech landscape at the disruptive technologies that are increasing in prominence and speculate as to which will be most impactful for communications – namely, AI and Cloud Computing. In his session at 20th Cloud Expo, Curtis Peterson, VP of Operations at RingCentral, will highlight the current challenges of these transformative technologies and share strategies for preparing your organization for these changes. This “view from the top” will outline the latest trends and developm...
"There's a growing demand from users for things to be faster. When you think about all the transactions or interactions users will have with your product and everything that is between those transactions and interactions - what drives us at Catchpoint Systems is the idea to measure that and to analyze it," explained Leo Vasiliou, Director of Web Performance Engineering at Catchpoint Systems, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York Ci...
The 20th International Cloud Expo has announced that its Call for Papers is open. Cloud Expo, to be held June 6-8, 2017, at the Javits Center in New York City, brings together Cloud Computing, Big Data, Internet of Things, DevOps, Containers, Microservices and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportunity. Submit your speaking proposal ...
"Avere Systems is a hybrid cloud solution provider. We have customers that want to use cloud storage and we have customers that want to take advantage of cloud compute," explained Rebecca Thompson, VP of Marketing at Avere Systems, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
SYS-CON Events announced today that Dataloop.IO, an innovator in cloud IT-monitoring whose products help organizations save time and money, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Dataloop.IO is an emerging software company on the cutting edge of major IT-infrastructure trends including cloud computing and microservices. The company, founded in the UK but now based in San Fran...
20th Cloud Expo, taking place June 6-8, 2017, at the Javits Center in New York City, NY, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy.
SYS-CON Events announced today that Linux Academy, the foremost online Linux and cloud training platform and community, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Linux Academy was founded on the belief that providing high-quality, in-depth training should be available at an affordable price. Industry leaders in quality training, provided services, and student certification passes, its goal is to c...
The unique combination of Amazon Web Services and Cloud Raxak, a Gartner Cool Vendor in IT Automation, provides a seamless and cost-effective way of securely moving on-premise IT workloads to Amazon Web Services. Any enterprise can now leverage the cloud, manage risk, and maintain continuous security compliance. Forrester's analysis shows that enterprises need automated security to lower security risk and decrease IT operational costs. Through the seamless integration into Amazon Web Services, ...
In the next five to ten years, millions, if not billions of things will become smarter. This smartness goes beyond connected things in our homes like the fridge, thermostat and fancy lighting, and into heavily regulated industries including aerospace, pharmaceutical/medical devices and energy. “Smartness” will embed itself within individual products that are part of our daily lives. We will engage with smart products - learning from them, informing them, and communicating with them. Smart produc...
"What is the next step in the evolution of IoT systems? The answer is data, information, which is a radical shift from assets, from things to input for decision making," stated Michael Minkevich, VP of Technology Services at Luxoft, in this SYS-CON.tv interview at @ThingsExpo, held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA.
SYS-CON Events announced today that Catchpoint Systems, Inc., a provider of innovative web and infrastructure monitoring solutions, has been named “Silver Sponsor” of SYS-CON's DevOps Summit at 18th Cloud Expo New York, which will take place June 7-9, 2016, at the Javits Center in New York City, NY. Catchpoint is a leading Digital Performance Analytics company that provides unparalleled insight into customer-critical services to help consistently deliver an amazing customer experience. Designed ...
Internet of @ThingsExpo, taking place June 6-8, 2017 at the Javits Center in New York City, New York, is co-located with the 20th International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. @ThingsExpo New York Call for Papers is now open.
Every successful software product evolves from an idea to an enterprise system. Notably, the same way is passed by the product owner's company. In his session at 20th Cloud Expo, Oleg Lola, CEO of MobiDev, will provide a generalized overview of the evolution of a software product, the product owner, the needs that arise at various stages of this process, and the value brought by a software development partner to the product owner as a response to these needs.
Smart Cities are here to stay, but for their promise to be delivered, the data they produce must not be put in new siloes. In his session at @ThingsExpo, Mathias Herberts, Co-founder and CTO of Cityzen Data, discussed the best practices that will ensure a successful smart city journey.
In 2014, Amazon announced a new form of compute called Lambda. We didn't know it at the time, but this represented a fundamental shift in what we expect from cloud computing. Now, all of the major cloud computing vendors want to take part in this disruptive technology. In his session at 20th Cloud Expo, John Jelinek IV, a web developer at Linux Academy, will discuss why major players like AWS, Microsoft Azure, IBM Bluemix, and Google Cloud Platform are all trying to sidestep VMs and containers...