CyberInsecurity May 6-7, 2010 • Washington, D.C.

  BOB LUCKY 9S CONFERENCE REFLECTIONS John Negroponte, Cyberwarfare: The new WMD?       People with scientific knowledge and those in policy need to work together at the earliest time Geopolitics and cybersecurity The geopolitical situation today is amazingly benign Cyberwarfare examples 3 Russia in the Baltic States and against Georgia We have to build a base of experience, and build an international community in this area The big players in cyber 3 US, Russia, China, Israel, France Maybe they should get together to reach an understanding cI 9m not sure that we should spend a lot of time worrying about bin Laden getting cyber capability 3 criminals yes. d Individuals should be deterred so that capabilities of nation states are required for cyber attack Question 3 which is more important to national security 3 offense or defense? We 9ll work on both, but we have tread carefully on what international agreements we enter into Question about diminished international scientific collaboration Alan suggests ecological metaphors instead of warfare metaphors for cyber   Marisa Randazzo, Threat Assessment Resources 3 Cyber Insider Threats in the Financial Sector     She has interviewed a lot of malicious people The insiders are us, not a matter of having a fox in the henhouse We don 9t have a lot of information about motivations, and the reason is embarrassment The insiders are not the technical folks They could only study a small number of events, events in the financial sector of seven years They looked for pre-attack behaviors, communications, and motives Are these good folks gone bad?<br><br> Comment about statistics on insider threats 3 said to be one third of cases Findings on insiders No common profile, including technical skill Most employed simple, legitimate means Most planned actions in advance Many knew about plans Did not consider consequences Question about difference between cyber perpetrators and other criminals The anonymity of cyber versus the personal confrontation In 80% of cases there were signs beforehand Post Sarbanes-Oxley, companies can have confidential reporting mechanisms Sign in John Resnick 9s office 3 cIt 9s only money, and it 9s not even ours d Implications Hiring procedure not sufficient Encourage reporting Threat assessment approach Multi-disciplinary groups Offline as much as online Comment about false alarms from reporting Len observes that perhaps they haven 9t uncovered the really sophisticated attackers   Mikko Hypponen, F-Secure 3 Tales of Cyber Espionage       Cyber Espionage Targeted attacks 3 your organization is the only one attacked Military contractors, governments, NGOs (who get hit the most) In 2008 there were 1968 attacks that were known They are growing, but not exploding Most infections are through attachments to email Pdf files are most common   Spoofed messages from colleagues Pdf file crashes Adobe reader and starts a backdoor file, then opens a different pdf file He recommends getting rid of Adobe reader They haven 9t seen a single attack against another reader Even though another reader could be attacked, it raises the cost for the attacker Firefox now gets as many attacks (in proportion) as IE Eric raises the issue of the tension between isolation and value Comment 3 what does it say about us Mac and Linux users that no one wants to attack us? Windows isn 9t being targeted on mobile phones, because it isn 9t the gorilla The case for diversity, instead of monoculture Takeaways These attacks are real and have been going on for years Technical safeguards are hard to build Education is key In many cases isolation is the only solution   Jeffrey Carr, GreyLogic 3 Espionage, Repression, and Assassination: The Multi-Modal Stae of Cyber Conflict in 2010   This talk is going to generate some fear in the next few minutes Firewalls and antivirus cannot protect you The people who are attacking you are smarter than you The only person who can protect you is you You must segregate your most important data You must limit exposure Until 2007 denial of service was the most popular attack Then multi-modal attacks came along Examples Kyrgyz journalist assassinated by GSNB Email account was cracked, and was lured out of the country and thrown off a roof Iranian Revolutionary Guard cracks US-hosted web servers belonging to opposition movements Made 30 arrests of dissidents Barrio Azteca gang targets US law enforcement along border for assassination (video posted on net) Used Facebook and Twitter for intimidation Point made that cyber attacks now must result in something happening in physical space Social media exploitation Linkdin employees of DEA and USNorthCom Triangulation through Facebook and Twitter Social networking can identify other employees What would you do if you got an email with a picture of your child? Social media as a self-funding medium for intelligence DST, Russian company, with connections to Facebook and other media Emerging threat from little lawless groups with a lot of money Eastern Europe groups with a lot of skills Operations are done now cunder the US redline d Doubts we will see a big attack Doubts that bin Laden would do a cyber attack; doesn 9t see the potential cMy point is don 9t worry about denial of service d Eric says that you can 9t turn back social media; you can 9t tell your kids not to use it US is not closing down bad ISPs Andrew Odlyzko, University of Minnesota 3 How to Live and Prosper with an Insecure Cyber Infrastructure We have evidence that we cannot build secure systems Furthermore, we can 9t live with secure systems cThis virus works on the honor system 3 forward this message to everyone you know and delete all the files on your hard disk d Problem with secure systems 3 secretaries cannot forge their bosses 9 signatures People and formal methods don 9t work well together His solution: Build messy, not clean (security through obscurity) The dog that did not bark: Cyberspace is horribly insecure But no big disasters!<br><br> Putting financial losses into perspective with repect to bank robberies, insider thefts, and the financial meltdown What bank has gone bust because of cyber insecurity? Peter observes that any parasite doesn 9t want to kill its host Security is not the goal, just an enabler The bad guys want to protect their capabilities too, just like Hollywood 1980s the Golden Age of civilian cryptography and security It was also the age of fax, including fax signatures Now we see scanned, emailed checks So why does a fax signature work? Hard to do serious damage with a single forged fax Fax usually just one of many elements of an interaction Advantages of messy 3 Apple experience Apple says jailbreaking is a source of instabilities Does Apple want clean, modular software?<br><br> If you can barely keep your system running, how useful will it be to your opponent? cOn the Internet nobody knows you 9re a dog d 3 but not only do they know you 9re a dog, they know your breed, your dogfood, and the fleas that you have The Internet is a tapestry, where anyone who wants to cut it has difficulty and leaves traces Research possibility: obscuring clean software Contraian lessons Learn from spammers, phishers Build messy, not clean Create web of ties Marc Dacier, Symantec 3 Attack Attribution The number of new signatures for attacks is growing exponentially Is the number of attackers growing similarly? Getting profiles of the attackers and understanding whether they are new, whether you are being targeted, and so forth There are good and bad neighborhoods on the Internet, and you might want to choose where you go Have process running to identify sources of rogue AV software and map them on the Internet Attack attribution is about identifying the root causes of observed attacks Like serial killers, cybercriminals have a ritual that leaves traces They automate the various steps of their attack workflow You can 9t jump to conclusions about what is the reality Ceci n 9est pas un pipe.<br><br> Data visualization isn 9t enough, and clustering alone isn 9t the answer Wombat project at Symantec Collected data that they could share about attacks You can participate and it 9s free Give you honey pot software for an old machine and be a sensor for their network In exchange you get all the data from everyone else They have 30 different partners around the world Now you have three platoons of attack First scans the system Then used by other machines After finding open ports, then third machines attack there with a back door They collect the sequence of events and the malware pushed on the machine What to worry about 3 short-lived attacks by a limited number of attackers, against a small number of destinations Connecting the dots 3 getting clusters Lots of IP addresses registered the same day by the same owner They have redundant servers and hop from target to target All the names had five random characters and were cn Craig Gentry, IBM 3 How the Cloud can Process Data without Seeing It Delegate the processing of your data without giving away access to it Do a private Google search Encrypt the query so that Google can 9t see it Google process your query, you get an encrypted response and decrypt it You store your files on the cloud Encrypt them to protect your information Later you want to retrieve files containing a subphrase Files matching are returned in encrypted form This is a fully homomorphic encryption scheme and solves a 30 years old problem But the scheme is slow, and though it operates in polynomial time, the increase in computation is larger than a million An analogy 3 Alice 9s Jewelry Store How can Alice delegate processing of the gold without giving away her secrets? She puts the raw materials in an impenetrable box, and the workers put their hands in the box, without seeing the contents The time for a Google search for this would be linear in the data that Google has, which would be practically impossible             Jim Gosler, Himself 3 Capabilities of Advanced Adversaries       There is an enormous gap between offensive capabilities and defensive capabilities Graph of level of competence versus class of adversary, hacker, criminal, nation-state Enemies can 9t go toe-to-toe against the US, so they need tricks We 9re designing systems as if they will be operating in an adversary-free environment If he had a policy/law knob, setting it to zero would be a game-changer Ken Thompson 3 cYou can 9t trust code that you did not totally design yourself. d Jim Gosler 3 cYou may not even be able to trust code that you wrote yourself. d The small subverted code where no one could find the subversion Access is everything, and it 9s all foreign The subverted IBM Selectric typewriter The one idea as a keeper 3 The innovative application of offensive capabilities to support defensive objectives An observation 3 probability of detection, probability of attribution, impact of defensive failure, and consequence to the attacker are way out of balance John Zic, CSIRO 3 The Trust Extension Device         Trust in behavior Trust 3 who, when, why? An entity can be trusted by a user when The device can be unambiguously identified The device operates unhindered The user has first-hand experience of the device 9s consistent good behavior or access to a trusted third party that can vouch for the device 9s behavior They made a prototype system to transfer data from doctor to doctor But it was unmanageable because of constant changes in the computers, whose behavior was captured by the TPM chip The trust extension device (TED) USB device owned by user, has a processor and TPM In contrast to an RSA key, this device gives you behavior confirmation Only the TED device is authenticated, not the laptop Some discussion about role of laptop (not trusted) and device (trusted) Daniel Kimmage, Homeland Security Policy Institute 3 Virtual Conflicts, Real Consequences       How do you know what you know?<br><br> Often seen through the prism of the media Information warfare Al-Qaeda An identifiable brand A body of media messages and a network The Islamic State of Iraq Similar to Al-Qaeda Failed completely and disappeared Made a claim in virtual space that couldn 9t be done The Putin regime in Russia Controls TV to stay in power Websites that manipulate news A tree falling in the forest that no one hears Factors: content, narrative, emotion, brand A story, instant association, hope, rage Words, images, music Delivery: Twitter, Tribal elders, drivers of minibuses Ricochet of information   Iraqi insurgents forced media to go to their websites Information is both permanent and mutable online Accessible, rather than available Platforms that are accessible: Google, YouTube, LiveJournal Virtual and real Information warfare hinges on real effects The future: the cloud accessed from a mobile device, geolocation Russia: It 9s not about freedom of speech, it 9s about freedom after speech Eric Haseltine 3 Reflections on the day       Cyber warfare isn 9t a zero sum game 3 you lose and I lose, but I lose less We can 9t close down commerce, because that would hurt us too Externalities in cyber The value of diversity; a monoculture is efficient, but you don 9t know the costs Is messy better than clean? They know all about you We can 9t trust what we see Go for the bank shot 3 the ricochet What does offense mean to a business? We 9re all honest, but we 9ve all done stupid things on the network Lax behavior creates a noise floor on which malicious behavior is difficult to recognize                               General Michael Hayden, NSA, CIA, etc.<br><br> 3 Why is this so Hard? Thinking about the Cyber Domain A general officer who isn 9t going to use any slides He 9ll know if you 9re surfing the net He 9ll talk from a policy perspective The liberating concept of cyber as a domain 3 land, sea, air, space, and cyber The creator made the first four, and we didn 9t do as good a job on the last It was about movement, speed, and agility over security Nothing to do about known and trusted nodes Cultural pathologies that make it difficult Not everyone agrees with the paradigm Knife fight on who the cyber czar would report to cWe don 9t buy this cyber threat thing. d Don 9t have general recognition of issues Tripping across someone 9s conception of civil liberties cThe US government cannot protect you on the Internet unless they can monitor you on the Internet. d The space is incredibly fractured We should put this cyber thing under commerce We should put this under DHS We haven 9t beaten paths in the forest on this Only the DoD has their act together on this Attack, defense, and exploitation are technologically the same but organizationally different The technologists sound like rainman to the policy makers (when you can 9t solve a particular problem, make it bigger) Thinks we should push some of these issues into the global forum, but this is an adult problem Analog is the law of the seas conference, which took a decade We had an attitude about the seas, but we don 9t have an attitude about cyber Secretary Clinton hinted at an attitude 3 freedom of navigation (flow of ideas) We could agree that the Internet needs more security He had a hard sell with Wall Street 3 what will it cost? 10,000 apps on the iPhone is not an unalloyed good 3 it 9s a threat to the entire web We need a sense of governance over this; maybe we don 9t need 10,000 apps We need to move in a direction to get better organized in government We need a COP (common operational picture) What 9s happening out there?<br><br> We need to engage the big ideas What does deterrence look like in this domain Attribution and retaliation in the other domains Can you create deterrence without attribution? Internationalize the problem Council on Foreign Relations will release a paper on this shortly Don 9t enter into treaty negotiations, but begin discussion on what constitutes conflict Agree, for example, that similar to hospitals and churches in physical space, financial systems shouldn 9t be attacked in cyberspace Comment: instead of MAD we should have mutually assured dependence Phrase he hears is ccyber commons d Idea that states self-limit their activities on the net, so that the activity underneath, which is truly malevolent, is made more visible Question about short tenures of policy makers Over time, doctrine will evolve But the personality issue never goes away Right now personality really matters Question on equivalent of sending the fleet through the straits of Formosa Where are the marines, where are the carriers? A demonstration, but we don 9t know how to do a demonstration I 9ve been asked that question before, by people interested in doing something right now Question about adjusting the technology instead of policy We 9ve created the technology to look like the German plain, but we got Poland 3 there are no natural barriers Are there ways to engineer the geography to change the geography without giving up the agility Comment about 10,000 apps 3 a balance between ecology for survival and We 9ve put all of energy into the ease of use leg instead of the security leg (of a 3-legged stool) Comment about reluctance of US industry to lose money to fix infrastructure Over time there are ways to fix this, maybe regulatory The word that comes to mind is liability The degree of openness in the private sector, not talking to themselves A sequence of decisions, each of which was correct, but in ensemble is bad It 9s like seat belts 3 who will be first manufacturer to put them in?<br><br> John Perry asks if we have made significant movement towards collaboration (the DNI as ca work in progress d -- to be charitable) But we 9ve made progress short of csignificant d What is it about the net that makes it like the north German plain?   Doug Soloman, Ideo 3 Collaboration at Scale           We need to create tools that don 9t suck How do you know if they suck? If the user experience comes at the end You see lots of work-arounds If you use the word 8compliance 9 If you see blank pages in your wikis If people chuckle when you use words like 8sharepoint 9 Collaboration principles Build pointers to people Typical paradigm 3 suck all the information out the smart people and put it in a data base But it 9s the tacit knowledge that is important Inspired by Facebook, they created people pages Only three bullet points about yourself to share Room for a personal blog Tagging system for your interests Automatic creation of the page Project pages Pull out the time scale on a project to see who 9s available Reward individual participation Inspired by Delicious, get bookmarks from the web People are looking for recognition, getting staff, and to develop their careers The fly on the urinal 3 men are competitive and want to hit the target 3 it reduces spillage by 80% Demand intuitive interfaces His Comcast remote with 50 buttons, compared with Apple remote with 6 functions One company really thought about the user experience The iPhone, which makes up 14% of smart phones, but 66% of mobile web browsing Their interface for the Ford Fusion Customizeable Put information in a place where people can find it They called their wiki cSpaces d, because they 9d had four failure of wikis in the past Required zero training Len asks about security They aren 9t as concerned about security as others at this meeting There is no anonymity, but they haven 9t had any problems The new system they are building has a lot of hooks for flexibility about compartmenting information Now they have 40,000 pages Build, buy, or download?<br><br> -- this was a buy Adoption versus friction Add any blockage and adoption drops Great video about Facebook in reality!! Take the road more traveled When people are reading and watching, there is incentive to contribute Make it fun cSorry Milton. Time to upgrade. d Iterate early and often Four people on team, and they iterate every Thursday Constantly prototyping Not just software, but human interactions They are taking their system to market as a cloud-based service Question about effects on productivity They haven 9t yet tried to measure this, only surrogate measures like use             Chris Hankin, Imperial College 3 A Multidisciplinary Approach to Security   Reflections on yesterday Criticisms of geographic model Biological perspective Solutions are unlikely to be purely technical and we need diversity CS-educated people are ill-equipped to deal with the biological perspective Thesis Technological progress creates new security challenges that should be addressed as early as possible in the system life cycle Security is not binary New governance structures to promote interdisciplinary working A new foundation Henzinger and Sifakis make case for reappraisal of the foundation fo computing Systematically integrate computation and physicality Aspects of security Model security in a changing, distributed, mobile world Policies either grant or deny certain actions Quantitative semantics Model program behavior, with a view to more realistic security modeling Approximate confinements Doug comments on oversimplification, given all the dimensions of security This is purely focused on information flow within programs Joel Brenner, NSA 3 Security and the Public-private Sector       (He 9s on a lease and not speaking for NSA or the government) The Counterintelligence threat in the government and in the private sector have converged to a surprising extent Increasing interpenetration of the sectors Widespread understanding that national strength, including military, depend on private companies Intellectual property is much more susceptible to theft Public-private interpenetration Few secrets are spread across the sectors, they don 9t exist in a single place and on paper Global emphasis on economic growth Economic strength as an underpinning to military strength The Insider threat has intensified, partly due to the recession A perfect insider threat storm 3 laid off employees are a great threat   Systematic targeting not only by criminals, but state-sponsored Price of information has plummeted The Chinese agent had been in place for 25 years Had been a sub-contractor, not a government employee Not just a US problem Poisoned USB drives, like unprotected sex, spread electronic diseases In aftermath of Google affair, private companies are coming to the government for help Feeling like they 9re playing in a new ballpark Not just hunting political/military secrets Press coverage of Google focused on censorship, but what pushed Google over the line was the loss of source code Not just a case of what was taken out, but what was left behind David Reed starts discussion on what Google actually lost Pointed out that attacks can be simplified by having source code Soft targets in scientific, academia circles Buying back our own technology Every branch of government has been significantly penetrated If you can exfiltrate information from thousands of miles away, you don 9t need spies, nor do you need to target the CEO The definition of cinsider d has changed Anyone with access The equipment itself becomes an insider The supply chain problem Nobody knows how to deal with it Counterintelligence is no longer people in sunglasses and cloaks, but the protection of information So what do we do?<br><br> Vulnerabilities 3 technological, cultural, managerial Human tendency to entropy isn 9t going to change 3 convenience trumps security every time Then you add stupidity and malevolence Most corporate systems are easy to penetrate They don 9t measure the hardware connected Rules must be technically-expressed to be meaningful Trading is done automatically and compliance is done manually David Reed asks about international companies and the role of NSA and government in helping We don 9t want to put our intelligence agents in charge of the networks Yet no one has the level of expertise that exists in NSA cExcuse me; if NSA has the expertise, why is the US in the state it is? d cFoul d But NSA is not omnipotent We give people responsibility, but no power                               Yousef Khalidi, Microsoft 3 Security in the Cloud       Cloud computing is popular now, but it does pose security problems Cloud computing 3 agility through highly-shared infrastructure But when you have competing companies sharing infrastructure, you have problems You need a spectrum of clouds with different kinds of sharing Public clouds will grow, but private clouds won 9t go away Dimensions of cloud computing Application model, hardware model, operations model High-scale sharing is the key Challenges: security, targeting apps, leveraging the various clouds Location and access Private clouds often don 9t have the scale Public cloud with highest scale but most sharing One size doesn 9t fit all Evolving into hybrid clouds What we need Data synch and caching, application connectivity, federated identity and access control, secure network connectivity Regulation and national boundaries Clouds span national boundaries Many governments regulate where data can live In Azure, they are in 3 locations and they insure that data stays (with high probability) where the customer wants 3 in US, Europe, and Asia David Reed points out conflict with Eric 9s opening comment about boundaries going away Comment that yesterday we heard that isolation was the only solution, so why is sharing such a good idea? Isn 9t the idea of isolation akin to putting your money under the mattress The answer should be to put the data in a number of places Question: why should we believe you about the data being where we 9ve specified? They have agreements with large network providers, and what happens when the network fails They have to expose all of their policies and agreements to their customers Question about getting their data out of the cloud some years later You should consider multiple providers from day one You should understand policies like what we do with your data when you haven 9t paid your bill     John Adams, University College, London 3 Managing Risk in a Hypermobile, Low-trust World       What are trying to manage, how are you managing it, and who is cyou? d Different kinds of risk Perceived through science (studied) Perceived risk (climbing a tree) Virtual risk (scientists either don 9t know or can 9t agree) This is liberating, and everyone can argue Example of a risk manager 3 a toddler learning to walk Instinctive, wired by evolution, intuitive Taking a risk carries a probability of accidents Which leads to perception of risks Bottom loop bias Stopping bad things from happening The opportunity cost of rewards foregone Top loop bias The cGoldman-Sachs model d Risks are both voluntary and imposed Numbers almost don 9t matter The bombing in London killed 52 people, which was 6 days of road deaths Imputed motive versus self-imposed, you act differently Typology of bias Egalitarian -- If you can 9t prove it 9s safe, assume it 9s dangerous Individualist Fatalist Hierarchist 3 most of the government The fault tree and event tree Can you fill in the numbers?<br><br> How many circles are there on the chart? Bad luck and hindsight Negligence! You assess all the risks 3 Oh, I missed that one, and that one The risk averse playground 3 no swings and no children Hypermobility In Britain 3 5 miles a day in 1950, 30 now, 60 in 2025 Now it 9s electronic mobility And this is a stimulant to physical mobility   Joe Markowitz, Self 3 The Enemy is Us       Capability equals vulnerability Your purchasing department is geared to bring you capabilities Second law 3 Confidentiality and availability Availability is the existential threat to the organization The clothes lockers that cost a quarter and no one used Encryption works against availability Third law 3 you can 9t rationalize IA costs because you have no idea of what things are worth Protocol/design weaknesses Who shaves Lord Russell 9s barber?<br><br> Paradoxes are resolved by stratification Imagine a circuit that can 9t tell which pulse arrives first Imagine that even if you fixed each and every ambiguity by fiat, there would provably always be another He 9s bringing these things up with the hypothesis that someone will prove that computer security is impossible Maybe we could save a lot of money by proving it 9s impossible Flaws Down with IP Say no to the von Neuman architecture No in-band signaling (like the security classification designation) No more TBDs What 9s plan B? If computer security is impossible, what 9s to do? Difficulties Low barriers to entry Weakest links 3 more networked, defending whole life cycle Capabilities equals vulnerabilities No economic incentives Insiders Murphy 9s law The cyber initiative Focuses on confidentiality Ignores our penchant for vulnerabilities Accepts fiction that the best defense is a good offense       Presumes you can raise the bar Flawed analogy to the Manhattan Project Puacity of good ideas SCADA systems vulnerabilities A place to start if you don 9t want to redo the Internet tomorrow   Tony Rucci, Oak Ridge 3 Protecting Against and Investigating Insider Threats       New insider threats have emerged in this new economy Layoffs, downsizing and low morale bring out the worst Customer contact lists, trade secrets and flying out the door What 9s behind the breaches?<br><br> In 2008, only 20% were caused by insiders Who are the insiders? Everybody you touch 3 contractors, consultants Motives The big three 3 greed, disgruntlement, revenge Examples of insiders that were caught Trigger Personal or professional event pushes individual to the breaking point Screen your personnel Initial counterintelligence screening and periodic reviews Financial records check IRS disclosure Records check Doug brings up the point of managing the morale of remaining employees when you implement layoffs Information technology makes it harder today to screen USB devices everywhere, and you can 9t strip search people coming in and out                   Matt Joyce, Agora Link 3 Trust Relationships and Secure Architecture in Open Research Environments         Working with hacker spaces Shared resources, both software and hardware Agora Link is an open research network STEM for the rest of us The mission 3 a network for any hacker space or lab to collaborate over Stay on line, be chill ChaosVPN Public access permanent locations and single access permanent locations Why their own network? Suppose an on-line arm swings and hits someone Suppose you want to test a 3G system in Amsterdam that wouldn 9t be legal in the US You 9re getting on this network because we know you And if we don 9t want you anymore, you 9re gone They have benign projects, fragile projects, and dangerous projects all on the net Social factors Hacker spaces are community organized and managed with little to no commonality Organizational models and different and users have different goals PKI web of trust                               Herb Lin, National Research Council 3 Offensive Aspects of Cybersecurity and Related Policy       Two aspects of cybersecurity Defensive Attack resistance, password security, etc.<br><br> Law enforcement mechanisms Offensive (generally classified) Action to destroy, degrade, disrupt adversary IT Cyberexploitation Undertaken for both defensive and offensive purposes Offensive operations May be implicated in defense before, during, or after an attack May increase threat to private sector Private sector might want to conduct offensive operations Early warning response Information on occurrence, source, scale, scope, nature, etc. Knowing attack is in progress is problematic Recognizing anomalous activity very difficult Attribution and intent Must infer intent from attack Preemption We need to be living inside the networks of adversaries What if these networks are in the US? During an attack DoD asserts authority to neutralize an incoming cyberattack that compromises mission Automated response might be provocative and outsized with respect to threat After an attack Forensics may require multiple intrusions into attacking nodes Retaliation Policy There is no official policy Used just like any other weapon, no distinction with kinetic attack Not a violation of international law Covert action 3 must be authorized and reported       Illustrative applications Suppression of air defenses Disruption of critical infrastructure Influence foreign elections Exploration of adversary command and control networks Question about sanctions Explicitly not a use of force However, a blockade is Could you use a cyber attack to enforce a sanction?<br><br> Unresolved issue The danger to private sector Adversaries could retaliate Preparations may impact private sector Laws of war may impact May require separation of military and civilian infrastructure May legitimize targeting of US communications infrastructure and power grid Why would a private entity resort to self-help?

less