EXPERT PERSPECTIVE / OPINION – After the early 2021 cyberattacks against Colonial Pipeline leading to widespread gas shortages on the US East Coast, the US government (USG) has taken concrete steps to ensure that ransomware attacks on critical infrastructure are treated as national security issues. USG tapped additional resources within the Department of Defense and leveraged foreign and private sector partners to battle one of the most damaging ransomware gangs, REvil, in October 2021.
The entire USG approach is to work closely with the private sector and many countries’ efforts to modernize defenses and disrupt the infrastructure and actions of cyber actors. and malicious ransomware gang. It must be acknowledged that the confrontation with cyber adversaries is not directly the driving force, but rather a mixed “war”.
Unlike previous repeated wars, the methods used by opponents today to undermine the stability of the United States are economic. Competitors are targeting the private sector, among other things, and stealing our intellectual property, attacking our supply chains and disrupting operations, often critical infrastructures – 80% of which is held by private companies.
In early 2021, New Yorkers reports that 90% of US companies have been hacked. In September 2021, Fox News reported that the number of organizations affected by ransomware attacks has increased by 102% compared to the beginning of 2020. The percentage of the cyber insurance industry has increased to the point that companies are now dealing with the issue as an issue. Business Challenge: Do they spend millions on defense and insurance, or do they spend millions on ransom payments?
A defense is certainly important but still not enough: no football team has ever won a game playing in the defensive third of their field. Likewise, a strategy built on the expectation of submission will not win the day. One thing is clear – the risk of doing nothing and continuing with the status quo is inevitable given explosive attacks on the US private sector and disastrous economic consequences. Ours is huge.
The exponential growth of hacking events against the US private sector raises the question of how we should respond. Whether this is a terrorist attack or not, the rules of participation will be clear. But cyberspace is an unregulated playing field that can be exploited by adversaries. Normally, there is an assumption that there is a rule-based order in cyberspace, but the truth is that there is no. The narrative that imposing our values in determining the way forward will somehow destabilize the world hacking order, is false.
In fact, since technology is agnostic, and it is human motivations and intentions that determine how technology is used, the United States and the foreign partners involved must impose their own values. in developing rules of engagement. We have a responsibility to establish our stance and enforce our values toward a framework that is acceptable to the United States. We must remember that China and Russia outnumber us – the values that drive the use of technology forward must replicate our core values of respecting civil liberties and human rights.
Cryptographic Brief Subscribers + Members receive exclusive expert meetings from members of our expert network. Upgrade to Subscriber + today.
The central themes of the discussion were all about one thing: The winner of this hybrid “war” in cyberspace will be the one who comes up with their opponents. Breaking down the barriers between the public and private domains and academia will provide many opportunities to leverage the best technology, capabilities, and approaches at any given time. A governance framework that is effective in providing a method for coordination and problem solving among partners, most likely with intelligent support, and clearly defined roles and responsibilities will allow The partner is best positioned to respond on behalf of the collective in a coordinated manner. This increase in gray noise will have its pros and cons. For example, the activities of IC CNO/CNA may be easier to integrate into the environment, but may increase instances of false attribution for innocent third parties. These are the complexities that the governance framework will aim to address and repeat.
Modernizing our laws so that they provide us with responsiveness while protecting civil rights and privacy is a key component moving forward. We have a duty to modernize the law and regulatory framework to address current and future threats to our democracy posed by exponential growth and democratization of technology. This will not be easy in the field of cyberspace. There is much controversy surrounding the concept of hacking back and active defense. Questions around accountability, attribution, and retribution are not easy to answer.
Join the Network Initiative Group for the First Summit of 2022 with Principals including General Keith Alexander, The Hon. Susan Gordon, Dmitri Alperovitch, General David Petraeus, CISA Founding Director Chris Krebs and more. Registration is free for this February 9 virtual event. Be prepared to think differently.
We’ve done this before by building a framework to help us overcome our toughest challenges including how to manage the rational use of nuclear energy. In short, the US has not achieved anything close to deterrence in cyberspace. Despite recent efforts to combat hacking criminal groups and bring them to justice, hackers are still targeting our nation’s critical infrastructure and the private sector without punished. Our elections, corporations, and state, local, and federal governments are all within the sights of our opponents.
We need leadership from Congress, a partnership with the White House, and bipartisan commitment to craft a cybersecurity strategy that will enable our nation to defend, prevent, and counter cyberattacks. threat to our national security. This is not what our government advisers often say, like some fine wines get better over time. Our elected officials from both sides of the aisle need to step out intelligently and with the acumen that these threats require.
Listen to The Cipher Brief’s Open Source Reporting Podcast – an open source weekday collection of stories that impact national security with your hosts Brad Christian and Suzanne Kelly. Subscribe wherever you listen to podcasts.
Read more expert-driven national security insights, perspectives, and analysis in Summary of ciphers
