Cyberwar, Cybercrime, Cyberterror, and Espionage

1. Cyberwar, Cybercrime, Cyberterror, and Espionage Getting Organized For: Four threats in the 21st Century Marcus J. Ranum <mjr@ranum.com>

2. Who am I? • Author of “The Myth of Homeland Security” • Industry “insider” with over 20 years work in security • System designer • Teacher • Manager of coders • CTO, CSO, CEO

3. What is this talk about? • Some questions: • Does putting “cyber-” in front of something automatically mean it’s new, different, or interesting? • What are the different “battlefield doctrines” of attack and defense in each of these focus areas: • Cyberwar / Cybercrime • Cyberterror / Cyberespionage

4. How we will proceed • First, we will analyse our focus areas • Secondly, we will examine the properties of attack and defense in each of those areas • Thirdly, we will consider positive/negative overlaps or synergies between attack and defense • Finally, we will conclude with some recommendations

5. Cybercriminal • Agenda: • Diffuse and profit-driven • Tactical: short-term • The threat: • Profitably “hit and run” • Cannot eradicate: more will take their place • Creative • Rapidly shift to where the money is

6. Cyber Spy • Agenda: • Surreptitiously get secrets from target • Suborn and manage trusted agents in critical positions • Strategic: long-term • The threat: • The cyber-era simplifies some technical aspects of espionage a bit while complicating others a bit

7. Cyberterrorist • Agenda: • Ideological maximum-damage maximum-profile highly visible attacks with no restraint • Tactical: “Hit and run” to Cause Fear • The threat: • Targets will be critical infrastructure that results in explosions, destruction and death • Power, water, oil, shipping, vehicle control

8. Cyberwarrior • Agenda: • Be prepared to attack/degrade/penetrate enemy command and control systems as an adjunct to physical military operations • Strategic: Long-term covert warfare • The threat: • Targets will be high-value, high-cost, and will have varying “hardness” against attack

9. Agenda Alignment • Cybercriminal: Tactical Profit • Cyberspy: Strategic Surreptitious • Cyberterrorist: Tactical Maximum-profile • Cyberwarrior: Strategic Destructive

10. Agenda Mis-Alignment Cybercriminal Cyberspy Cyberterrorist Cyberwarrior Compete Provide cover Interfere with ops Provide cover May provide tech Provide cover Interfere with ops Cybercriminal No effect No effect Counterintelligence May detect May compromise ops Cyberspy No effect No effect No effect No effect Cyberterrorist No effect May interfere with ops during a conflict No effect Direct engagement during a conflict Cyberwarrior

11. Some Things • Some things jump out at us immediately, namely: • Cybercriminals and Cyberterrorists operational needs are isolated; therefore they will tend to be very robust • Cyberspies and cyberwarriors operational needs are overlapped; therefore they need to coordinate carefully to prevent “cyber friendly fire incidents”

12. A Mis-Alignment Scenario • It’s cyber-attack day, H hour, and we’re in the war-room • The order to attack is given • The cyberattack teams take down the enemy’s command and control systems • Out cyberspy force is now blinded and unable to communicate • This can be avoided; but: cyberwarriors must coordinate with cyberspies

13. Another Mis-Alignment Scenario • It’s cyber-attack day, H minus 10 hours • Because of cybercriminal activity the target performs a crucial security update • The update also happens to disable, expose, or compromise the impending cyberattack • This can be avoided, also, but with increased logistical costs for the attacker at no additional cost to the defender • Balance of opportunity favors defender

14. Defense Strategies Response, by target Government Private Sector “typical computer security” (firewalls, antivirus, patch management, IDS, system log analysis) “typical computer security” Cybercriminal Counterintelligence + “typical computer security” Expect the government to deal with it Cyberspy “typical computer security” “typical computer security” Cyberterrorist Counterintelligence + “typical computer security” Expect the government to deal with it for anything beyond “typical computer security” Cyberwarrior

15. Some Things • Some things jump out at us immediately, namely: • Defensive approaches almost entirely overlap; what helps protect the target from cybercrime is likely to help protect the target • The only other thing that can usefully be thrown at the problem is counterintelligence • There aren’t any super cool government-specific defensive technologies for cybersecurity; they’d already be part of “normal internet security”

16. Overlap of Attack and Defense • By definition: • cyberespionage and cyberwar tools will need to be different from the “run of the mill” attack tools being used by cybercriminals and hackers • Because, otherwise, a security fix (and there is a constant stream of them!) designed to fix one of the “run of the mill” problems could disable an entire cyberespionage or cyberwar effort • Realistically that is not the case; but it raises the question of logistics and life-span of cyberweapons

17. Overlap of Attack and Defense - II • Therefore: • It stands to reason that counterintelligence would be one of the most valuable tools for mooting an enemy’s specialized cyberweapons • Additionally, since the weapons almost certainly have to be pre-fielded against the target, they are subject to identification, analysis, and dissection

18. Overlap of Attack and Defense - III • In fact: • One might theorize the scenario in which a defender discovers that they are being subjected to a deep penetration tool… • They then dissect the tool • Intercept its command and control • Subvert its command and control • …and are prepared to nullify it instantly • The attack tool is now a warning system for the defender

19. Stuxnet • Was Stuxnet: • State-sponsored terrorism • A violation of international humanitarian law • Both

20. Case Study: Bushehr • Stuxnet “Art 56. Protection of works and installations containing dangerous forces 1. Works or installations containing dangerous forces, namely dams, dykes and nuclear electrical generating stations, shall not be made the object of attack, even where these objects are military objectives, if such attack may cause the release of dangerous forces and consequent severe losses among the civilian population.” • The control systems attacked were coolant pumps * Protocol 1, addition to Geneva Conventions of 1949, June 1977

21. Reprisal • During conflict (not necessarily a declared state of war) under the GC a limited deliberate violation of the laws of war may be taken in reprisal • Not to be confused with retorsions which are legal retaliations like punitive tariffs • Generally reprisals are limited by proportionality because of the danger of involving civilians

22. Reprisal for Stuxnet? • Would Iran be justified in launching a cyber attack against the US or Israel in response to Stuxnet? • This is a serious question • Especially if the answer is “yes” • Let’s dismiss that as a hypothetical, though

23. Stuxnet a War Crime? • It was either: • State-sponsored terrorism • War crime • There is no 3rd alternative • Arguing it was state-sponsored terrorism (I.e: outside of an armed conflict) is “better” because it removes justification for reprisal

24. Conclusions I • There is insufficient intellectual gap between cyberwarfare and cyberespionage • They are nearly the same thing, just fulfilling two different purposes, tactical versus strategic • Treat them as the same thing! • Counterintelligence is the defense in both cases • Effective counterintelligence can render the enemy’s weapons inert

25. Conclusions II • There is insufficient intellectual gap between cyberwarfare and cybercrime • At least in terms of the tools used • The best defense is a good defense!

26. Conclusions III • Due to the logistical problem of maintaining secured, fielded, cyberweapons in place, or up-to-date, I seriously question the utility of offensive cyberwarfare • The utility of strategic intelligence and counter-intelligence is disproportionately increased

27. Summary • Spies will win the next war, not warriors • Maintain vigilance using “typical internet security” techniques • Counterintelligence should include cyberespionage as a critical hit-point • Not much has changed, really