Cyber Security

Cyber Security

1. Issues for Consideration

   • Quantity of data held
   • Access to data held
   • Permissions to hold or access data – privacy rights, duties and legal frameworks
   • Control of data
   • Deletion of data
   • Positive uses for cyber technology e.g. health information, ethical hacking
   • Artificial Intelligence and future developments

2. What it's About

   • About the very essence of knowledge itself
   • It is about networks and human, societal linkages – not just technology
   • It is about ‘seamless connectivity’ and situational awareness at every level – international, state, organisational & individual
   • Information security as a virtual ecosystem – Internet is just one part
   • Cyberspace is ‘that place where computers, communications systems, and those devices that operate via radiated energy in the electromagnetic spectrum meet and interact.’
   • Cyber security relates to the insecurities created by this new ‘space’; Relates to: activities, data, practices & processes
   • It is evolutionary, dynamic, complex & unmanageable
   • Terminology echoes that of security and threat

3. But...

   • The character of perceived threat is radically altered. Threats perceived to originate from cyberspace are global in nature. Threats can come from anywhere and at an instant
   • Need to differentiate between ‘failures’, ‘accidents’ & ‘attacks’ in terms of intent as well as outcome
   • Failure can include design errors, system degradation, human error – usually internally generated
   • Accidents can be random, result from natural disasters and usually externally generated
   • Attacks can be passive or active and relate to threat (hackers etc) and human interventions
   • Internet was never created or built with security in mind – quite the reverse if security presupposes control

4. 3 Interlocking Discourses - Technical

   • Viruses, Worms etc
     • Computer Emergency Response Teams (CERTs) set up globally to counteract malware attacks and intrusions
     • Risks are pervasive and invasive and impact on individuals, organisations and governments alike
     • Hence heightened sense of vulnerability and vigilance behaviours
     • Wide range of targets and motivations
     • Becoming increasingly professionalised and specifically targeted

5. 3 Interlocking Discourses - Cyber Espionage

   • Closely related to technological discourse & development of IT law
   • Latter allows prosecution of miscreants but internationally agreed definitions and legal parameters are hard to agree and harder to enforce
   • National security dimension where cyber espionage aligns with traditional espionage
   • Motivations are complex but there are 3 basic trends:
     • Tech-savvy individuals (often teenagers) mischief making or money making
     • Semi professional OC (bank looting, ID theft, fraud, money laundering, forgery, extortion)
     • State sponsored attacks (Chinese attempts at government penetrations, business and industrial penetration) often motivated by wish to level the playing field as much as intelligence gathering
   • Problem of attribution – how easily those responsible can be identified or brought to book. Cui bono logic is often applied but may not be relevant
   • Hactivism is gaining currency (WikiLeaks) aligned to concept that all cyber data should be free to access, which challenges national and international security networks and organisations and those of business and industry
   • This last leads to issues of control, surveillance, personal liberty, and information sensitivity

6. 3 Interlocking Discourses - Cyber Conflict and Vital System Security

   • 1991 Gulf War watershed – first information age conflict where physical force was not sufficient – ‘information dominance’ was essential
   • Need for an information ‘edge’ balanced by perceptions of increased vulnerabilities – political, economic and military boundaries permeable
   • DDoS attacks employed (Distributed Denial of Service) – Milosevic’s bank accounts were hacked by US armed forces
   • Chinese and US hackers frequently engage in battle since a recon and surveillance plane was forced to land on Chinese territory following a collision with a Chinese jet fighter in 2007
   • Labelling occurrences as ‘cyber war’ carries inherent danger of creating insecurity and heightening tension – fuels a cyber-security dilemma likely differentially to advantage/disadvantage states, organisations, individuals

7. Reducing Insecurity

   • Each discourse raises specific types of counter measures and concepts, each with different foci and referent objects
   • Common issue is information assurance ie basic information security
   • Concept of critical infrastructure protection (CIP) and how critical infrastructure is defined and identified
   • Challenge here of privatisation and de-regulation, especially of parts of public sector since 1980s and since globalisation of 1990s
   • Market forces are not sufficient to provide sufficient security but neither are state and government agencies. PPPs (Public-Private Partnerships) exist but with varying success
   • Many are not geared as much towards information/systems security as information exchange which involves some sophisticated risk assessment, analysis and management

8. Cyber-deterrence

   • Often involves military instruments
   • Requires that one party is willing and able to act against another
   • That other must be identifiable as an attacker
   • That other must fear the retaliation or deterrence will not apply
   • Cyber-deterrence requires a theoretically wide range of offensive & defensive capabilities working alongside a robust and uncontested legal framework

9. Debates Over Revolutions in Military Affairs

   • There is a great deal of contemporary theoretical and operational debate over so-called revolutions in military and in strategic affairs
   • Debates are centred, respectively, upon innovations in military technology and a dissolving of the traditional strategic autonomy of the military realm from that of the societal
   • Attention increasingly has been given to the potential impact of new technologies for ‘information warfare’, ‘cyberwar’, and ‘netwar’ – the language is that of ‘war’ and ‘conflict’
   • A ‘revolution in military affairs’ (RMA) is taking place as a result of the shift from an industrial to an information society – note not a knowledge society
   • Future warfare will involve a central role for the struggle for information and intelligence perhaps taking the place of the struggle for geographical position held in previous conflicts
   • Information superiority is emerging as a newly recognised, and more intense, area of competition
   • Future conflict will be characterised by what Lawrence Freedman called a ‘lack of fixed form'

10. How Useful is Cyberwar?

    • The degree to which cyberwar is actually useful against an adversary depends upon the degree of operational information networking or ‘connectivity’
    • This is particularly so with respect to command, control, communications, computers and Information (C4I) cyberwar defensive capacity
    • Utility of cyberwar also reflects the degree of wider transition towards becoming an information or knowledge networked society
    • Information warfare comprises three dimensions:
      • (1) the attainment of battlespace knowledge superiority and dominance
      • (2) the capacity to mount offensive societal information network interdiction and to defend one’s own information network
      • (3) the manipulation of societal knowledge – ie propaganda dissemination
    • Information warfare is particularly suited to ‘lower order’ hostilities
      • 1) The surreptitious nature of information warfare and thus relative ‘invisibility’ of this military medium
      • 2) The high potential for military and societal dislocation and disruption (harassment capability) at low or even non-existent cost in terms of combat platforms, armed personnel, or political ‘fallout’
      • 3) The relatively limited escalatory implications for generalised regional conflict
      • 4) Information and knowledge become critical as the character of this arena is different in kind from those of previous arenas; Just as the 19th century industrial revolution rendered the seasonal character of warfare outdated, spatial and temporal factors of conflict such as land, sea and air influencing the conflicts of the industrial era are rendered irrelevant other than as potential sources of conflicts between rival claimants.

11. Agencies of Attack

    • Agencies of attack are no longer just armies but individual hackers, terrorists, disaffected employees or service personnel or cyber-insurgents; Threshold of access is minimal
    • Second generation’ weapons are focused upon the manipulation of information in the target society or emergent psychotronic weapons intended to incapacitate human information network operators
    • Traditional notions of ‘victory’ and ‘defeat’ may be obsolete. Peterson makes the point that ‘the most sophisticated and important information warfare battles may be waged against adversaries who never learn that they have been “defeated”
    • The inventory of ‘first generation’ cyberwar and netwar includes designer ‘viruses’; ‘worms’; ‘logic bombs’; ‘trojan horses’; ‘trapdoors’ and ‘backdoors’; ‘spy chips’; high energy radio frequencies (HERF) and electromagnetic pulses