Feeds

Cyberwarriors on the Eastern Front: In the line of fire packet floods

Former senior Estonian defence official talks cyberwar

Choosing a cloud hosting partner with confidence

Preparing for the next cyberwar

Preparations for cyber-defence include running cybersecurity exercises and establishing what Almann described as "matrices of co-operation". He said: "It's better to have many people working together, and the ability to delegate decisions, than a cyber-czar," adding that Estonia was establishing an independent cyber unit in its equivalent of the voluntary part-time Territorial Army (the US equivalent would be National Guard).

Russia, by contrast, appears to have used a militia of criminal hackers to fight its battles, at least if rumours over the cyber-conflict in Estonia and Georgia are to be believed. Almann said this approach was dangerous.

"Provide the [modern equivalent] of letters of mark to cyber-profiteers, entitling them to loot or pillage when they are not working for you, is dangerous," Almann said. "Criminals can easily turn against you."

But what are cyber-defenders preparing for, exactly? The UK's defence review last year placed cyberattacks on a par with international terrorism as the greatest threats facing the UK, a judgment Almann agreed with.

Almann argued that "every military conflict is going to have a cyber-component" in future. "There are sophisticated attack scenarios but normally you never want to truly knock out your enemies' network because then you eliminate the battlefield. Instead you want to create confusion and misinformation," he said.

Cyberwar would not be limited to nation-state against nation-state conflicts, with insurgency-style cyber-conflicts also more than possible.

"The opportunities to attack in cyberspace are huge for anyone with imagination," he said.

The former top-ranking civil servant turned lawyer and university lecturer spoke to us of phishing, espionage and attacks more sophisticated than those faced by Estonia as among the threats, which might come from terrorist groups such as Al Queda as well as state-sponsored hackers or intelligence agencies. "You should never prepare for the last war," he concluded.

Some have criticised the debate on cyberwar for focusing on Hollywood-style attack scenarios of lone hackers taking out power grids, for example. However Almann reckon that cyberdefence brainstorming sessions are best run in an open environment where even "crazy ideas" can be suggested.

"You need to come up with the meanest scenarios before you discuss whether they are realistic or not," Almann said.

Almann, an experienced lawyer and diplomat, would be the first to admit he's not a technologist. For an expert take on what the real – as opposed to Hollywood-inspired – threats in cyberspace might be, we asked Chris Wysopal (AKA Weld Pond), a former member of Boston-area hacking collective L0pht, turned founder of the application security firm VeraCode. Members of the group famously testified before Congress in May 1998 that they would be able to take down the internet in 30 minutes using shortcomings of the BGP routing protocol that were endemic in international telecom networks at the time.

Although that particular hole has long been plugged, it remains the case that critical infrastructure systems are wide open to attack, Wysopal told El Reg. "The only safe way is to air-gap critical infrastructure systems," he said, adding that removable media also posed a big threat from information leakage, as the WikiLeaks case illustrates.

Wysopal agreed with Almann that most countries are developing offensive cyber-capabilities, even if they don't like to talk about it. "The equivalent of special forces units are building [cyberwar] tools. Meanwhile countries are training soldiers, the equivalent of infantry, to use those tools," Wysopal said, adding that he reckons any country with nukes is also likely to have offensive cyberwarfare capability.

"Cyber-weapons can be used to amplify the effects of other attacks or carry out cyber-sabotage, like Stuxnet. It takes an army to carry out cyberwar because there are hundreds of targets."

Attackers have a built-in advantage over cyber-defenders because of the "asymmetrical" nature of cyberwar, he concluded.

"Defence needs to plug all the holes, while those on the offence only need to find one," he said. ®

Intelligent flash storage arrays

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Managing SSL certificates with ease
The lack of operational efficiencies and compliance pitfalls associated with poor SSL certificate management, and how the right SSL certificate management tool can help.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.