
Vats of newspaper ink have been spilled about what are generally
accepted to have been State Sponsored Cyber-attacks against companies and
governments around the world. Some of
these attacks include the DDoS attacks against the U.S. Banking System; attacks
against Japanese Banks and other companies operating in China; the attack
against the Saudi Aramco computer system; the infiltration of the networks of
The New York Times, The Wall Street Journal, and The Washington Post by China;
Stuxnet; and the regular reporting of advanced persistent threats achieved by
multiple countries into other country’s cyber networks. These events
demonstrate a gap between current cyber security practice of addressing
symptoms such as an attack or infiltration, and the actual chronic problem
confronting the entire cyber domain: State Sponsored activity in cyber is an
attempt to achieve a political outcome. Cyber Security is a component of
National Security and must be addressed as such rather than in isolation.
The problem is not simply a technical problem resolvable
with a technical solution. No matter how
many firewalls, NetFlow tools, network infiltration reports, trainings on how
not to click on spear fishing attacks, and attempts to stop social engineering
take place, the problem will continue to exist.
Every effort at countering the problem through these technical
approaches will continue to meet with at best mediocre temporal success with
diminishing returns over time. Cyber-attacks by State Sponsors may be slowed,
but will not be stopped technically. These events represent political
initiatives by the state sponsor, and thus are a political problem that will
only be overcome through all levers of politics.
Although Cyber is a relatively new domain for warfare, it is
still just another way to achieve politics by other means. Looking at each of
the cases mentioned above one can draw a direct link between a political
objective by the state actor sponsoring the cyber event to the event itself. For the DDoS attacks against the U.S. banks
this was a way for (presumably) Iran to inflict harm on the United States
economy in a tangential enough way to counter the sanctions on Iran without
suffering a kinetic response. The attacks on Japanese banks and other companies
operating in China was due to an ongoing territorial dispute and very negative
history between China and Japan over the Daiyu/Senkaku islands. The attack
against Saudi Aramco was an attempt by (presumably) Iran to do economic harm to
Saudi Arabia due to Saudi support of the rebels in Syria who are fighting
against an Iranian supported regime. The infiltration of major U.S. newspapers
(which most likely did not stop at the ones listed here, or even in the U.S.)
was an attempt to both find sources for information that could discredit
Communist Party leaders in China, and to potentially blackmail the newspapers
into refraining from reporting negatively on China in exchange for continuing
their operations. Stuxnet, as has been widely reported, was an attempt to stall
the Iranian nuclear program. The list goes on, but the point should be
clear. Each cyber event was an attempt
at achieving a particular political outcome.
These attempts were likely not the only means by which the state sponsor
chose to attempt that outcome, but simply one of possibly several domains in
which actions were taken to achieve the desired results.
There is a parallel in history that demonstrates the point I
am making very well. Before World War II
much ink was spilled discussing the threat that bombers posed to
countries. The experience of World War I
showed that aircraft could have a devastating effect on a country. The inter-war years brought out new
technology and capabilities to the point where most public opinion was that the
new threat posed by the Bomber was unprecedented and that war should be avoided
out of fear of the destruction that bombers would cause. What was missed in these calculations,
especially for France in its preparations for World War II, was that bombers
were a tool used in a new domain of warfare (the air), but that the strategic
objectives of the country (a stable Europe) far outweighed the threat of this
one tool. France and the United Kingdom surrendered Czechoslovakia for fear of
a war, driven by a fear of German bombers. When war did come, and the German
bombers were dropping their payloads over France and the United Kingdom, they caused
extensive damage, but a funny thing happened.
Yes, they were somewhat effective, but they did not destroy the country
or its ability to fight. Even the allied
24hour bombing of Germany later in the war did not destroy that country, or
even reduce its production capability to support the war effort until 1945 when
the country was occupied by ground troops.
The fear instilled in this one new domain had been proven to be far
beyond the value that domain had as compared to the other domains of achieving
strategic political outcomes. Today the
bomber is a component of the nuclear triad for several countries, but a fading
one as new means by which to achieve the same or better results are available.
What this says is that addressing cyber through technical
means, although very important on a tactical basis, is not an answer at the
operational or strategic level.
Operationally, companies and countries need to at least understand who
is interested in them and why; opening this situational awareness far beyond
the cyber network into every aspect of the organization’s or country’s
operations wherever these take place. Strategically,
organizations and countries need to focus on the outcomes they desire to
achieve. The means by which they achieve
those outcomes will include the cyber domain from here on out. Yet, there are
multiple other domains, to include: Public Affairs, Diplomacy, Defense,
Disaster Response, Development, Track 1.5 and Track 2 interactions. Addressing
political differences through all of these domains at the same time, depending
on which set is most effective for that particular issue and time, will be a
far more effective approach to solving cyber security problems in the long-term
than any technical only approach.
It is only through integrating the technical approach
tactical solutions available with the operational and strategic level
perspectives of achieving desired outcomes through all means available, can an
organization or country truly attain security; with the cyber component playing
a contributing, but not exclusive, role.