Feeds

Cyberwarriors on the Eastern Front: In the line of fire packet floods

Former senior Estonian defence official talks cyberwar

Top three mobile application threats

Preparing for the next cyberwar

Preparations for cyber-defence include running cybersecurity exercises and establishing what Almann described as "matrices of co-operation". He said: "It's better to have many people working together, and the ability to delegate decisions, than a cyber-czar," adding that Estonia was establishing an independent cyber unit in its equivalent of the voluntary part-time Territorial Army (the US equivalent would be National Guard).

Russia, by contrast, appears to have used a militia of criminal hackers to fight its battles, at least if rumours over the cyber-conflict in Estonia and Georgia are to be believed. Almann said this approach was dangerous.

"Provide the [modern equivalent] of letters of mark to cyber-profiteers, entitling them to loot or pillage when they are not working for you, is dangerous," Almann said. "Criminals can easily turn against you."

But what are cyber-defenders preparing for, exactly? The UK's defence review last year placed cyberattacks on a par with international terrorism as the greatest threats facing the UK, a judgment Almann agreed with.

Almann argued that "every military conflict is going to have a cyber-component" in future. "There are sophisticated attack scenarios but normally you never want to truly knock out your enemies' network because then you eliminate the battlefield. Instead you want to create confusion and misinformation," he said.

Cyberwar would not be limited to nation-state against nation-state conflicts, with insurgency-style cyber-conflicts also more than possible.

"The opportunities to attack in cyberspace are huge for anyone with imagination," he said.

The former top-ranking civil servant turned lawyer and university lecturer spoke to us of phishing, espionage and attacks more sophisticated than those faced by Estonia as among the threats, which might come from terrorist groups such as Al Queda as well as state-sponsored hackers or intelligence agencies. "You should never prepare for the last war," he concluded.

Some have criticised the debate on cyberwar for focusing on Hollywood-style attack scenarios of lone hackers taking out power grids, for example. However Almann reckon that cyberdefence brainstorming sessions are best run in an open environment where even "crazy ideas" can be suggested.

"You need to come up with the meanest scenarios before you discuss whether they are realistic or not," Almann said.

Almann, an experienced lawyer and diplomat, would be the first to admit he's not a technologist. For an expert take on what the real – as opposed to Hollywood-inspired – threats in cyberspace might be, we asked Chris Wysopal (AKA Weld Pond), a former member of Boston-area hacking collective L0pht, turned founder of the application security firm VeraCode. Members of the group famously testified before Congress in May 1998 that they would be able to take down the internet in 30 minutes using shortcomings of the BGP routing protocol that were endemic in international telecom networks at the time.

Although that particular hole has long been plugged, it remains the case that critical infrastructure systems are wide open to attack, Wysopal told El Reg. "The only safe way is to air-gap critical infrastructure systems," he said, adding that removable media also posed a big threat from information leakage, as the WikiLeaks case illustrates.

Wysopal agreed with Almann that most countries are developing offensive cyber-capabilities, even if they don't like to talk about it. "The equivalent of special forces units are building [cyberwar] tools. Meanwhile countries are training soldiers, the equivalent of infantry, to use those tools," Wysopal said, adding that he reckons any country with nukes is also likely to have offensive cyberwarfare capability.

"Cyber-weapons can be used to amplify the effects of other attacks or carry out cyber-sabotage, like Stuxnet. It takes an army to carry out cyberwar because there are hundreds of targets."

Attackers have a built-in advantage over cyber-defenders because of the "asymmetrical" nature of cyberwar, he concluded.

"Defence needs to plug all the holes, while those on the offence only need to find one," he said. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Burnt out on patches this month? Oracle's got 104 MORE fixes for you
Mass patch for issues across its software catalog
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
Oracle working on at least 13 Heartbleed fixes
Big Red's cloud is safe and Oracle Linux 6 has been patched, but Java has some issues
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.