Last week the Langner Group published
a blog post by Perry Pederson talking about the need for nationalizing
cybersecurity for critical infrastructure. Perry very clearly outlined the
reasons why individual companies did not have the resources to take on nation
state backed entities in the cybersecurity realm. Citing the ‘provide
for the common defense’ clause {§8} in the US Constitution he argues that
at some level cyber defense is purely governmental function.
In a brief
twitversation I asked where the line should be drawn between national cyber
defense and daily operations security and that is the topic that I would like
to look at today.
National Defense
In a classical sense a nation state provides for the common
defense in a couple of ways. First it maintains a military of sufficient size,
equipment and training that potential adversaries are forced to decide that
attacking the state would cost more than the potential benefits. Where
potential adversaries are right at the border in neighboring states
fortifications are constructed and manned to ensure that there will be enough
delay of the enemy forces to allow the full strength of the military to rally
to the defense of the point of attack while remaining prepared for attack at
other points along the border.
On the other hand nation states also under take diplomacy as
a means of reducing tensions with potential adversaries to lessen the need for
taking up arms.
In extremis nation states conduct pre-emptive attacks on
their adversaries so that they can set the time and place for armed conflict to
best suit their needs and capabilities. Establishing a well understood
capability to conduct pre-emptive strikes provides potential adversaries with
an additional incentive to use diplomacy to address tensions that could lead to
armed conflict.
Cyber Defense
Until recently cyber defense was more of a police type
action against individuals rather than a military type activity against nation
states. Individual owners of cyber infrastructure took minimal security
protections to ensure that the common criminal had to have a minimal level of
skill and ingenuity to gain access to the owner’s cyber infrastructure. In the
event of a break in police were notified, rudimentary investigations were
conducted, and the occasional high-profile arrest and subsequent conviction of
the cyber criminal served as a deterrent of sorts to further cyber crime.
As more wealth has been moved into the cyber realm criminals
have become more sophisticated in their abilities to attack that wealth. In
response the owner’s capability to defend against breaches has become more
complex; the law enforcement effort has become more sophisticated; and the
courts’ response has become more intense.
Enemies not Criminals
Since the public discovery of Stuxnet just a little over two
years ago it has become apparent that the nation state has discovered the
capability of surreptitiously attacking an adversary’s critical infrastructure.
Nation states have the resources to pull together a comprehensive development
team to fashion and operate cyber tools and techniques to execute attacks that
are practically undetectable in the short term.
The cyber attack objectives of these nation state actors may
include the gathering of intelligence (spying) that has been a common tool of
statecraft and warfare for millennia, gaining a political or economic advantage
by destabilizing critical infrastructure in an adversarial state, stealing
technological innovation to allow for economic advancement at reduced cost, or
just weakening an adversary as a prelude to a physical attack.
The point that Pederson makes so clearly in 7 points is that
in an unequal contest between a nation state and most private sector owners,
the private sector will almost certainly loose. Now this is bad for the economy
if it is just the random facility that is attacked, but nation states will be
conducting targeted attacks ultimately against critical infrastructure
facilities. The only other target of worthy of their effort is the military and
suppliers of the military.
What does the
Government Defend?
It is quite clear that the Government does not have the unlimited
funds to provide for an absolute defense of all cyber assets within the
country. It will have to pick and choose those cyber assets which provide some
level of existential threat to the country if damaged or destroyed. This is the
essential definition of ‘critical infrastructure’. A political decision will
have to be made about what requires protection, what needs protections and what
cannot be protected.
Since cyber operations are an integral part of the
operational and management of most all critical infrastructure (I would say all
but someone would come up with some off-the wall counter example to prove me
wrong) does this mean that the Government will have to take complete control of
an enterprise to defend it against a nation state attack? There are many people
that would make that argument, but any real assessment of the situation would
show that the government does not have the manpower, expertise or will to
manage all aspects of the varied infrastructure that goes into providing critical
support for the day-to-day operation of the country.
So the government, if it is to be even moderately successful
at defending critical infrastructure against catastrophic cyber attack, is
going to have to carefully pick and choose the cyber battles that it chooses to
fight. To do that it is going to have to understand exactly what portions of
the national infrastructure require national defense. This understanding has
both strategic and tactical implications.
Under strategic considerations it must be remembered that all
infrastructure is critical at some level; see the old story about the want of
nail. The government (and that includes the governed) will have to prioritize
the national cyber defense to what can be afforded (to spend) and what can’t be
afforded (to loose). And it must be remembered that those priorities will
change frequently as the economy grows and contracts and as adversaries change.
On the tactical level is not necessary to defend every inch
of the cyber coastline. The national level cyber defense only requires that
only those portions of critical infrastructure that pose the threat of catastrophic
failure (call it Catastrophically Critical Infrastructure or CCI) if attacked
on the cyber battlefield need the limited attention and resources of the
Government defense. The Government will find it less expensive and more effective
to respond to non-catastrophic damage to critical cyber infrastructure than to
try to defend it all.
How do you defend
CCI?
Once CCI are identified the planning for the cyber defense
of CCI will begin by prioritizing the protection of CCI assets based upon their
critical failure nodes (CFN); a CFN is any operation where a minimal change in
control could cause a catastrophic incident. The most critical failure nodes will get first
attention. This will be determined by looking at the level of catastrophe that
would result from the worst case failure of the node and the likelihood that a
cyber attack could cause the failure of that node.
Once the CFN are identified then the cyber failure modes for
those nodes would have to be identified. This would be done in a cooperative
effort between the Government and the owner of the CFN; the fewer cyber
protective resources available to the owner the more those resources would have
to be supplied by the Government. The cost of reliance on Government resources
would be the partial loss of control over the use and employment of those
assets. This potential loss of control would be the incentive for business
owners to develop their own cyber protective resource capability because the
Government use of those resources would not necessarily align with the business
interests of the owner.
For the highest risk CFN, the government would retain the
ability to monitor the cyber protective resources to detect probing and attacks
on those resources. The purpose of the monitoring capability would detect the
early stages of a cyber attack with the intent to trace them back to their
origins. Political, electronic or physical counter-attacks would then be used
to dissuade adversaries from pursuing their attacks.
The Government would also share information about attacks
against CFN with other CFN defenders so that they could use that information to improve
the defenses of their cyber assets.
Protecting the Rest
of Critical Infrastructure
While the Government has the highest level of interest in
protecting CFN, the protection of all critical infrastructure is of legitimate
concern to the Government. Instead of the Government taking an active role in
the defense of non-CCI facilities, the Government would require the
identification and minimum protection of CFN at non-CCI facilities. It would
also require reporting of all attempts to compromise those protections, which
the Government would then investigate and take appropriate actions against the
perpetrators.
The protection of all non-catastrophic failure nodes would
be the sole responsibility of the owner of the facility. Owners most Government
regulated facilities would be required to report detected cyber attacks to a
Government agency that would then investigate those suspected attacks with the
view towards identifying the perpetrators and the techniques that they used.
Broad Outline
This is, of course, only the broad outline of how the
Government could address the protection of critical infrastructure against
cyber attacks. As it becomes more and more obvious that nation states are
undertaking cyber operations against their adversaries, it becomes clearer that
the Government needs to be actively involved in the defense of the most
critical infrastructure from such operations.
Serious discussion needs to begin on how this type of
defense of private sector facilities can be best implemented.
Posts
