Feeds

Cyberwarriors on the Eastern Front: In the line of fire packet floods

Former senior Estonian defence official talks cyberwar

Next gen security for virtualised datacentres

Preparing for the next cyberwar

Preparations for cyber-defence include running cybersecurity exercises and establishing what Almann described as "matrices of co-operation". He said: "It's better to have many people working together, and the ability to delegate decisions, than a cyber-czar," adding that Estonia was establishing an independent cyber unit in its equivalent of the voluntary part-time Territorial Army (the US equivalent would be National Guard).

Russia, by contrast, appears to have used a militia of criminal hackers to fight its battles, at least if rumours over the cyber-conflict in Estonia and Georgia are to be believed. Almann said this approach was dangerous.

"Provide the [modern equivalent] of letters of mark to cyber-profiteers, entitling them to loot or pillage when they are not working for you, is dangerous," Almann said. "Criminals can easily turn against you."

But what are cyber-defenders preparing for, exactly? The UK's defence review last year placed cyberattacks on a par with international terrorism as the greatest threats facing the UK, a judgment Almann agreed with.

Almann argued that "every military conflict is going to have a cyber-component" in future. "There are sophisticated attack scenarios but normally you never want to truly knock out your enemies' network because then you eliminate the battlefield. Instead you want to create confusion and misinformation," he said.

Cyberwar would not be limited to nation-state against nation-state conflicts, with insurgency-style cyber-conflicts also more than possible.

"The opportunities to attack in cyberspace are huge for anyone with imagination," he said.

The former top-ranking civil servant turned lawyer and university lecturer spoke to us of phishing, espionage and attacks more sophisticated than those faced by Estonia as among the threats, which might come from terrorist groups such as Al Queda as well as state-sponsored hackers or intelligence agencies. "You should never prepare for the last war," he concluded.

Some have criticised the debate on cyberwar for focusing on Hollywood-style attack scenarios of lone hackers taking out power grids, for example. However Almann reckon that cyberdefence brainstorming sessions are best run in an open environment where even "crazy ideas" can be suggested.

"You need to come up with the meanest scenarios before you discuss whether they are realistic or not," Almann said.

Almann, an experienced lawyer and diplomat, would be the first to admit he's not a technologist. For an expert take on what the real – as opposed to Hollywood-inspired – threats in cyberspace might be, we asked Chris Wysopal (AKA Weld Pond), a former member of Boston-area hacking collective L0pht, turned founder of the application security firm VeraCode. Members of the group famously testified before Congress in May 1998 that they would be able to take down the internet in 30 minutes using shortcomings of the BGP routing protocol that were endemic in international telecom networks at the time.

Although that particular hole has long been plugged, it remains the case that critical infrastructure systems are wide open to attack, Wysopal told El Reg. "The only safe way is to air-gap critical infrastructure systems," he said, adding that removable media also posed a big threat from information leakage, as the WikiLeaks case illustrates.

Wysopal agreed with Almann that most countries are developing offensive cyber-capabilities, even if they don't like to talk about it. "The equivalent of special forces units are building [cyberwar] tools. Meanwhile countries are training soldiers, the equivalent of infantry, to use those tools," Wysopal said, adding that he reckons any country with nukes is also likely to have offensive cyberwarfare capability.

"Cyber-weapons can be used to amplify the effects of other attacks or carry out cyber-sabotage, like Stuxnet. It takes an army to carry out cyberwar because there are hundreds of targets."

Attackers have a built-in advantage over cyber-defenders because of the "asymmetrical" nature of cyberwar, he concluded.

"Defence needs to plug all the holes, while those on the offence only need to find one," he said. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.