Cyberwarriors on the Eastern Front: In the line of
fire packet floods
Former senior Estonian defence official talks cyberwar
Preparing for the next cyberwar
Preparations for cyber-defence include running cybersecurity exercises and establishing what Almann described as "matrices of co-operation". He said: "It's better to have many people working together, and the ability to delegate decisions, than a cyber-czar," adding that Estonia was establishing an independent cyber unit in its equivalent of the voluntary part-time Territorial Army (the US equivalent would be National Guard).
Russia, by contrast, appears to have used a militia of criminal hackers to fight its battles, at least if rumours over the cyber-conflict in Estonia and Georgia are to be believed. Almann said this approach was dangerous.
"Provide the [modern equivalent] of letters of mark to cyber-profiteers, entitling them to loot or pillage when they are not working for you, is dangerous," Almann said. "Criminals can easily turn against you."
But what are cyber-defenders preparing for, exactly? The UK's defence review last year placed cyberattacks on a par with international terrorism as the greatest threats facing the UK, a judgment Almann agreed with.
Almann argued that "every military conflict is going to have a cyber-component" in future. "There are sophisticated attack scenarios but normally you never want to truly knock out your enemies' network because then you eliminate the battlefield. Instead you want to create confusion and misinformation," he said.
Cyberwar would not be limited to nation-state against nation-state conflicts, with insurgency-style cyber-conflicts also more than possible.
"The opportunities to attack in cyberspace are huge for anyone with imagination," he said.
The former top-ranking civil servant turned lawyer and university lecturer spoke to us of phishing, espionage and attacks more sophisticated than those faced by Estonia as among the threats, which might come from terrorist groups such as Al Queda as well as state-sponsored hackers or intelligence agencies. "You should never prepare for the last war," he concluded.
Some have criticised the debate on cyberwar for focusing on Hollywood-style attack scenarios of lone hackers taking out power grids, for example. However Almann reckon that cyberdefence brainstorming sessions are best run in an open environment where even "crazy ideas" can be suggested.
"You need to come up with the meanest scenarios before you discuss whether they are realistic or not," Almann said.
Almann, an experienced lawyer and diplomat, would be the first to admit he's not a technologist. For an expert take on what the real – as opposed to Hollywood-inspired – threats in cyberspace might be, we asked Chris Wysopal (AKA Weld Pond), a former member of Boston-area hacking collective L0pht, turned founder of the application security firm VeraCode. Members of the group famously testified before Congress in May 1998 that they would be able to take down the internet in 30 minutes using shortcomings of the BGP routing protocol that were endemic in international telecom networks at the time.
Although that particular hole has long been plugged, it remains the case that critical infrastructure systems are wide open to attack, Wysopal told El Reg. "The only safe way is to air-gap critical infrastructure systems," he said, adding that removable media also posed a big threat from information leakage, as the WikiLeaks case illustrates.
Wysopal agreed with Almann that most countries are developing offensive cyber-capabilities, even if they don't like to talk about it. "The equivalent of special forces units are building [cyberwar] tools. Meanwhile countries are training soldiers, the equivalent of infantry, to use those tools," Wysopal said, adding that he reckons any country with nukes is also likely to have offensive cyberwarfare capability.
"Cyber-weapons can be used to amplify the effects of other attacks or carry out cyber-sabotage, like Stuxnet. It takes an army to carry out cyberwar because there are hundreds of targets."
Attackers have a built-in advantage over cyber-defenders because of the "asymmetrical" nature of cyberwar, he concluded.
"Defence needs to plug all the holes, while those on the offence only need to find one," he said. ®