Download Cyber ShockWave exposed missing links in US security

Cyber ShockWave exposed missing links in U.S. security
Michael Chertoff
COMMENTARY
Government Computer News
March 10, 2010
Former DHS Secretary Michael Chertoff, who took part in the
event, offers steps government and industry should take
In mid-February the Bipartisan Policy Council hosted Cyber
ShockWave, a simulation of how our nation might respond to a catastrophic cyber event. The
simulation was conducted through the lens of a notional National Security Council (NSC)
meeting convened to advise the president on how the federal government should respond to the
crisis and what the president should communicate to the American people to reassure them.
Related story: - Cyberattack simulation highlights vulnerabilities
The presentation of Cyber ShockWave was well timed. Right now, the U.S. government is
involved in a significant debate: How important is cybersecurity among the many security
matters competing for attention?
My view is that cybersecurity issues transcend the protection of personal data or networks from
hackers or even organized crime. Rather, cyber warfare is a major national security issue —
protecting the security and freedom of our networks is as critical as protecting freedom of the
seas and space. As Congress debates competing legislative proposals to marshal our
government’s resources in this critical conflict, Cyber ShockWave provided important
benchmarks to guide these deliberations.
It was my privilege to play the role of the national security adviser during the Cyber ShockWave
NSC meeting. From that vantage point, here is my perspective of what we learned.




First, the United States does not have well-defined responsibilities for maintaining
common situational awareness of emerging critical operational developments in
cyberspace.
In a cyber crisis, our nation lacks an effective decision-making framework below the
Cabinet level for coordinating the government's response and recovery from a devastating
cyber event.
There is not in place a user-friendly process to allow government cyber defenders to
effectively collaborate with the private sector to take advantage of their expertise and
knowledge during the response to a cyberattack.
Current policy, legal and organizational constraints drive us to only a binary response: the
traditional domestic-focused law enforcement approach on one hand and, at the other
extreme, the compulsion to respond internationally to neutralize the attack.
Two key real-world elements arose, however, to complicate NSC’s consideration of response
actions. First, it is difficult to establish evidence that proves beyond a reasonable doubt that a
particular entity staged an attack — the issue of attribution. Not only is it difficult to identify and
prove whether the attacker is sanctioned by a foreign government, it is also hard to distinguish
between active direction by foreign officials and mere tolerance or lax enforcement.
Consequently, accountability for cyberattacks is extremely difficult to determine.
Furthermore, even if there were an ability to demonstrate a specific entity's or a foreign
government's complicity in an attack, what are the options for response? The United States has
long declared that a physical attack on us is an act of war that will be met with retaliation. How
should that same principle be contemplated in the context of attacks in cyberspace? Should our
cyber policies hold a hosting state responsible for attacks launched by its agents, sanctioned or
not? Is our response to a cyberattack limited to the cyber world, or are physical responses on the
table? Cyber ShockWave demonstrated that these decisions need to be debated and translated
into a national declaratory policy to govern future U.S. cyber response actions.
In spite of these complications, the notional NSC meeting concluded with surprising unanimity
that we needed to authorize very aggressive, vigorous response actions, and from the outset,
Congress needed to be involved and on board. Additionally, we recognized that timely public
buy-in was critical.
In the aftermath of Cyber ShockWave, it is clear that there are concrete, practical steps that
government and the private sector need to address. These include:





Developing clear policies with regard to what the government can and cannot do in these
kinds of emergencies.
Arriving at a broad national understanding of what constitutes a reasonable expectation of
privacy on the Internet during such crises.
Creating more robust and regularized public/private cybersecurity partnerships for the
purpose of timely information exchange to enable improved mutual situational
awareness.
Building on the national declaratory policy I mentioned earlier to formulate a strategy for
deterrence and response to state-sponsored cyberattacks that parallels the national
security strategies we developed for dealing with nuclear threats during the Cold War.
Complementing a deterrence and response strategy with a broadly accepted international
regime of what constitutes acceptable and unacceptable behavior in cyberspace. This
regime should parallel the traditional international laws that govern transiting land,
maritime and air domains.
Finally, we must recognize that everyone is a combatant in the world of cyber warfare. Civilians
are on the front lines because our personal communications and network systems are the conduits
for Internet warfare. This means that the responsibility for cybersecurity must be a joint effort
involving not only our government’s national security and homeland security elements and
private enterprise but also individuals who must do their part to practice safe computing. To be
responsible Internet citizens, we must each commit to employing well-documented security
techniques, such as creating and renewing passwords for protecting our individual computing
resources. The Web site (www.uscert.gov) of the Homeland Security Department's U.S.
Computer Emergency Readiness Team provides very useful information to this end.
Additionally, in this regard, I would note the well-known sports adage: “While offense wins
games, defense wins championships.” Each of us must resolve to make our individual
contributions to the defense of cyberspace.