thinking sensibly about today's issues
TwitterTwitter FacebookFacebook RSSRSS

The Threat of Cyber Attacks

US Deputy Defense Secretary William Lynn has warned, “new disruptive cyber attacks are on the near-term horizon (emphasis added).” Some organizations have rated the likelihood of cyber attacks on the USA to “between 4.0 to 4.3? on a scale of 0 to 5. Deputy Secretary Lynn further warns “we will” see “much destruction” from cyber attacks in the future. (http://stevenmcollins.com/WordPress/?p=4224)

Deputy Secretary Lynn, in remarks made to Congress, (http://www.defense.gov//transcripts/transcript.aspx?transcriptid=4842) has said: “One of the most consequential aspects of our present and future security environment is the threat posed by computer network attacks. To date, the most prevalent cyber threat has been exploitation of our networks. By that, I mean the theft of data from both government and commercial networks. On the government side, foreign intelligence services have ex-filtrated military plans and weapons systems designs. Commercially, valuable source code and intellectual property has likewise been stolen from business and universities.

More recently, a second cyber threat has emerged — and that is disruption of our networks. In this type of attack intruders seek to deny or degrade the use of important government or commercial network. The denial of service attacks against Estonia in 2007 and against Georgia in 2008 are examples of this kind of threat. Along similar lines, the hacker group Anonymous targeted eBay and PayPal.

The third and most dangerous cyber threat is destruction, where cyber tools are used to cause physical damage. This development — which would mark a strategic shift in the cyber threat — is only just emerging. But when you look at what tools are available, it is clear that this capability exists. It is possible to imagine attacks on military networks or on critical infrastructure — like the transportation system and energy sector — that cause severe economic damage, physical destruction, or even loss of life. Al Qaeda, which has vowed to unleash cyber attacks, has not yet done so. But it is possible for a terrorist group to develop cyber attack tools on their own or to buy them on the black market. The nature of cyber is that a couple dozen talented programmers, using off the shelf equipment, can inflict a lot of damage.

Moreover, with few tangible assets to lose in a confrontation, terrorists groups are very difficult to deter. We have to assume that in cyber as in other areas, if terrorists have the means to strike, they will do so. In the U.S., as in Europe, our military bases and installations are part of — and not separate from — the civilian infrastructure that supports our towns and cities. Ninety-nine percent of the electricity the U.S. military uses comes from civilian sources. Ninety percent of U.S. military voice and Internet communications travel over the same private networks that service homes and offices. We also rely on the nation’s transportation system to move military freight, we rely on commercial refineries to provide fuel, and we rely on the financial industry to pay our bills. Disruptions to any one of these sectors would significantly impact defense operations. A cyber attack against more than one could be devastating. In short, secure military networks will matter little if the power grid goes down or the rest of government stops functioning. Protecting the networks that undergird critical infrastructure must be part of our national security and homeland defense missions.”

As we look at the top risks to the security of the United States of America, it seems clear that the probability of continued attacks, escalating in frequency and severity, is extremely high – in fact, it is a veritable certainty. As Defense Secretary Panetta recently said: “This is the battleground for the future. The next Pearl Harbor may very well be a cyber attack.” (http://www.politicsdaily.com/2011/02/10/u-s-vulnerable-to-terrorism-especially-cyber-attacks-intellig/) The real risk is ineffectiveness on the part of our own defenses.

In addition, it is widely suspected that the United States has been involved in a cyber attack that set the Iran nuclear weapons development program, inserting a “worm” into Iranian information systems known as the “Stuxnet Worm”, which has been described in recent New York Times articles as “the most sophisticated cyberweapon ever deployed.” (http://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html?pagewanted=all) This cyber attack is widely believed to have been the product of US and Israeli science weapons development, and is speculated to have set back the Iranian development of nuclear weapons through domestic enrichment of uranium by as much as 15 years. For this reason, countries like Iran have an ax to grind with the United States, and are among several likely candidates for cyberspace based retaliatory attacks. There are two primary factors that have prevented severe incursions thus far: Lack of sophistication on the part of US enemies (which is rapidly diminishing as a barrier to them, and US defenses (which even US officials are warning us about repeatedly.)

A number of fronts pose vulnerabilities to the US, including the theft of sensitive – to – secret information ranging from leading edge R&D to current and planned deployment of US military assets, Debilitating technical data introduced into A&D supplier systems that could compromise the performance of our defense and weapons systems, the transmission of espionage-enabling messaging as embedded data or metadata, and the disabling of critical systems spanning the gamut from emergency response to health care to mass media to power grids.

The criticality of this situation will only worsen through the foreseeable future. Over half of US scientists and engineers are nearing retirement, and other countries are educating far more of them than US, with generally superior skills. Those retirees cannot be replaced without introducing increased numbers of foreign scientists. In addition, major US corporations continue to move their IT services offshore, increasing the exposure of their data to potential sabotage and espionage.

The advance of technology and technologically dense processes and products increases vulnerability and sheer fragility throughout our economy. As one article by futurist Marvin Cetron points out: “Information systems are another category of attack that Muslim radicals could mount against their chosen enemies in the West> One likely source of such an attack would be India, a land with a substantial Muslim minority (about 150 million people) and strong computer and communications industries.” He goes on to point out: “Until the terrorist problem is brought under control – which will probably not happen for at least a generation – we will face growing threat that Muslim extremists will master computer and Internet technologies and use their skills to disrupt essential communications and data. The impact will be seen in US corporations, research laboratories, utilities companies, and manufacturing.” (http://findarticles.com/p/articles/mi_go2133/is_200909/ai_n35627734/pg_6/)

Given all of these factors, and other overarching environmental factors such as the sheer volume of data transmission and storage and the shift in scientific and engineering skills away from the United States, the threat of cyber attacks based on an evaluation of likelihood of occurrence (100%) and severity of the attacks (which is certain to continue to escalate), I assess this risk to US continuity as high, especially in the 5 to 10 year time frame.

What do you think?

Leave a Reply

Notify me of followup comments via e-mail. You can also subscribe without commenting.

Powered by WordPress | Designed by Elegant Themes