COMMENTARY

Former DHS chief: Cyber ShockWave exposed missing links in US security

Former DHS Secretary Michael Chertoff, who took part in the event, offers steps government and industry should take

In mid-February the Bipartisan Policy Center hosted Cyber ShockWave, a simulation of how our nation might respond to a catastrophic cyber event. The simulation was conducted through the lens of a notional National Security Council (NSC) meeting convened to advise the president on how the federal government should respond to the crisis and what the president should communicate to the American people to reassure them.


Related story:

Cyberattack simulation highlights vulnerabilities


The presentation of Cyber ShockWave was well timed. Right now, the U.S. government is involved in a significant debate: How important is cybersecurity among the many security matters competing for attention?

My view is that cybersecurity issues transcend the protection of personal data or networks from hackers or even organized crime. Rather, cyber warfare is a major national security issue — protecting the security and freedom of our networks is as critical as protecting freedom of the seas and space. As Congress debates competing legislative proposals to marshal our government’s resources in this critical conflict, Cyber ShockWave provided important benchmarks to guide these deliberations.

It was my privilege to play the role of the national security adviser during the Cyber ShockWave NSC meeting. From that vantage point, here is my perspective of what we learned.

  • First, the United States does not have well-defined responsibilities for maintaining common situational awareness of emerging critical operational developments in cyberspace.
  • In a cyber crisis, our nation lacks an effective decision-making framework below the Cabinet level for coordinating the government's response and recovery from a devastating cyber event.
  • There is not in place a user-friendly process to allow government cyber defenders to effectively collaborate with the private sector to take advantage of their expertise and knowledge during the response to a cyberattack.
  • Current policy, legal and organizational constraints drive us to only a binary response: the traditional domestic-focused law enforcement approach on one hand and, at the other extreme, the compulsion to respond internationally to neutralize the attack.

Two key real-world elements arose, however, to complicate NSC’s consideration of response actions. First, it is difficult to establish evidence that proves beyond a reasonable doubt that a particular entity staged an attack — the issue of attribution. Not only is it difficult to identify and prove whether the attacker is sanctioned by a foreign government, it is also hard to distinguish between active direction by foreign officials and mere tolerance or lax enforcement. Consequently, accountability for cyberattacks is extremely difficult to determine.

Furthermore, even if there were an ability to demonstrate a specific entity's or a foreign government's complicity in an attack, what are the options for response? The United States has long declared that a physical attack on us is an act of war that will be met with retaliation. How should that same principle be contemplated in the context of attacks in cyberspace? Should our cyber policies hold a hosting state responsible for attacks launched by its agents, sanctioned or not? Is our response to a cyberattack limited to the cyber world, or are physical responses on the table? Cyber ShockWave demonstrated that these decisions need to be debated and translated into a national declaratory policy to govern future U.S. cyber response actions.

In spite of these complications, the notional NSC meeting concluded with surprising unanimity that we needed to authorize very aggressive, vigorous response actions, and from the outset, Congress needed to be involved and on board. Additionally, we recognized that timely public buy-in was critical.

In the aftermath of Cyber ShockWave, it is clear that there are concrete, practical steps that government and the private sector need to address. These include:

  • Developing clear policies with regard to what the government can and cannot do in these kinds of emergencies.
  • Arriving at a broad national understanding of what constitutes a reasonable expectation of privacy on the Internet during such crises.
  • Creating more robust and regularized public/private cybersecurity partnerships for the purpose of timely information exchange to enable improved mutual situational awareness.
  • Building on the national declaratory policy I mentioned earlier to formulate a strategy for deterrence and response to state-sponsored cyberattacks that parallels the national security strategies we developed for dealing with nuclear threats during the Cold War.
  • Complementing a deterrence and response strategy with a broadly accepted international regime of what constitutes acceptable and unacceptable behavior in cyberspace. This regime should parallel the traditional international laws that govern transiting land, maritime and air domains.

Finally, we must recognize that everyone is a combatant in the world of cyber warfare. Civilians are on the front lines because our personal communications and network systems are the conduits for Internet warfare. This means that the responsibility for cybersecurity must be a joint effort involving not only our government’s national security and homeland security elements and private enterprise but also individuals who must do their part to practice safe computing. To be responsible Internet citizens, we must each commit to employing well-documented security techniques, such as creating and renewing passwords for protecting our individual computing resources. The Web site (www.uscert.gov) of the Homeland Security Department's U.S. Computer Emergency Readiness Team provides very useful information to this end.

Additionally, in this regard, I would note the well-known sports adage: “While offense wins games, defense wins championships.” Each of us must resolve to make our individual contributions to the defense of cyberspace.

Featured

Reader comments

Wed, Oct 13, 2010 Hugo Fort Monroe VA

Is "cloud computing" the answer to endangered or vulnerable infrastructure? Where is the protection to be applied to insure the reliability and availability of "cloud computing"? Indeed, precisely where is the "cloud computing" capability that services our critical needs located? Don't you have to know where your infrastructure is located physically as well as logically in order to protect it?

Wed, Mar 17, 2010 Kidsysco

Totally agree with this article. It also supports Federal Chief Information Officer Vivek Kundra's words, "The path we are on does not make sense... cloud computing could be a solution"

http://gcn.com/articles/2010/02/26/government-specific-clouds-a-boon-to-feds-kundra-says.aspx

Fri, Mar 12, 2010 Timbalionguy

Of course, there are another dangers that seems to accompany these 'sweeping new policies', especially these days. the first is the government trying to tell us how to run our daily lives. Nothing wrong with good security practices, but do we need to do it the government's way only? The second is a possible unnecessary, unreasonable and unconstitutional invasion of people's privacy, all in the name of 'security'. At first face this looks fairly benign, but there is always some ugly detail lurking beneath the surface. Another thing to bear in mind is that if a wide mix of security procedures are used independently of each other, you will have a system that is much less vulnerable to attack than if one homogeneous, government-mandated approach is used.

Fri, Mar 12, 2010 JC

Why is it that when Chertoff was heading DHS, he was clueless about cyber security and did absolutely nothing to move the ball? Now a mere year+ later, he is all of a sudden a cyber security expert. Cyber ShockWare was an ill-informed media stunt between CNN, BPPI and the Chertoff Group where individuals who have been colossal failures as policy makers got together and potificated about things they know little about and certainly didn't help solve when they were in government service.

Fri, Mar 12, 2010 Papa_K US

This is the big picture. But the main reasons from my pov is quite simply that most of the people who manage these infrastructures are clueless. They have no idea what security is. Ask anyone of them to define the role of security and I'll bet 80% of them give you a basic answer that you can relate to the security guard in the lobby. Government and private sector managers think their interpretation of security is the right one. We can fire teachers in an entire school district. Why can't we make these clueless managers accountable? Believe me it's simple. But the other problem is if you let someone like me go out and put their problems on the table image the embarrassment when 80% of the individuals responsible for these Governments systems are found to be incompetent in understanding security?

Show All Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above