List of Illustrations |
|
xiii | |
List of Acronyms and Abbreviations |
|
xv | |
Introduction |
|
1 | (4) |
Part I. Foundations |
|
|
Chapter 1 Emblematic Attacks |
|
|
5 | (14) |
|
Cybercrime and Other System Intrusions |
|
|
5 | (4) |
|
The Advanced Persistent Threat |
|
|
9 | (2) |
|
Distributed Denial-of-Service Attacks |
|
|
11 | (3) |
|
Stuxnet and Other Destructive Attacks |
|
|
14 | (5) |
|
Chapter 2 Some Basic Principles |
|
|
19 | (13) |
|
|
20 | (3) |
|
|
23 | (3) |
|
|
26 | (2) |
|
Most Cyberattacks Have Transitory Effects |
|
|
28 | (4) |
|
Chapter 3 How to Compromise a Computer |
|
|
32 | (9) |
|
Abuses by Authorized Internal Users |
|
|
32 | (2) |
|
Abuses by Everyday External Users |
|
|
34 | (1) |
|
Altered Instructions via Supply Chain Attack |
|
|
35 | (1) |
|
|
36 | (5) |
|
Chapter 4 The Search for Cybersecurity |
|
|
41 | (18) |
|
Applications Are Often the Weak Links in the Security Chain |
|
|
41 | (1) |
|
The Role of Input Filtering |
|
|
42 | (1) |
|
The Role of Operating Systems |
|
|
43 | (1) |
|
|
43 | (1) |
|
|
44 | (2) |
|
|
46 | (3) |
|
|
49 | (1) |
|
Relationships among Machines, Systems, and Engineering |
|
|
50 | (2) |
|
Mixing and Matching Security Actions |
|
|
52 | (4) |
|
Measures and Countermeasures |
|
|
56 | (1) |
|
|
57 | (2) |
|
Chapter 5 Defending Against Attacks of High and of Broad Consequence |
|
|
59 | (11) |
|
Attacks of High Consequence |
|
|
59 | (1) |
|
Identifying Near-Catastrophes to Get Ahead of Catastrophes |
|
|
60 | (1) |
|
Hedging to Deal with Exceptions to the Power-Law Rule |
|
|
61 | (1) |
|
Scalability Influences How Well a Near-Catastrophe Predicts a Catastrophe |
|
|
62 | (1) |
|
Attacks of Broad Consequence |
|
|
63 | (3) |
|
Implications for Learning |
|
|
66 | (2) |
|
Is Information Sharing a Panacea? |
|
|
68 | (2) |
|
Chapter 6 What the Government Can and Cannot Do |
|
|
70 | (19) |
|
First, Why Should the Government Do Anything? |
|
|
70 | (3) |
|
What the Wise Men Recommended |
|
|
73 | (1) |
|
|
74 | (3) |
|
|
77 | (3) |
|
|
80 | (5) |
|
On Using Extraordinary Incentives to Juice the Cybersecurity Workforce |
|
|
85 | (2) |
|
Can Governments Cope with Surprise? |
|
|
87 | (2) |
Part II. Policies |
|
|
Chapter 7 What Should Be Secret |
|
|
89 | (11) |
|
|
89 | (1) |
|
Denying an Adversary Something |
|
|
90 | (1) |
|
Affecting Adversary Knowledge |
|
|
91 | (1) |
|
Affecting Adversary Decisionmaking |
|
|
91 | (2) |
|
|
93 | (1) |
|
Some Implications of Logical Classification Rules |
|
|
93 | (2) |
|
The Importance of Aggregate Privacy |
|
|
95 | (2) |
|
The Benefits of Discretion |
|
|
97 | (1) |
|
Conclusions and Implications |
|
|
98 | (2) |
|
Chapter 8 What Does China's Economically Motivated Cyberespionage Cost the United States? |
|
|
100 | (14) |
|
|
101 | (3) |
|
How Much Trade Is at Issue? |
|
|
104 | (1) |
|
|
105 | (4) |
|
Displaced Value Added by U.S. Corporations |
|
|
109 | (1) |
|
|
110 | (3) |
|
|
113 | (1) |
|
Chapter 9 Return to Vendor |
|
|
114 | (6) |
|
What Should the NSA Do About Zero Days? |
|
|
114 | (1) |
|
Retain or Return: Some Criteria |
|
|
115 | (1) |
|
After How Long Should a Zero Day Be Returned to Vendor? |
|
|
116 | (2) |
|
Irrelevant Considerations |
|
|
118 | (1) |
|
|
119 | (1) |
|
Chapter 10 Cybersecurity Futures |
|
|
120 | (9) |
|
|
120 | (1) |
|
|
121 | (2) |
|
|
123 | (2) |
|
|
125 | (1) |
|
A Three Mile Island in Cyberspace |
|
|
126 | (3) |
|
Chapter 11 Operational Cyberwar |
|
|
129 | (12) |
|
|
129 | (2) |
|
|
131 | (1) |
|
|
132 | (2) |
|
Hiding the Attack to Facilitate Its Repetition |
|
|
134 | (1) |
|
An Operational Cyberwar Scenario |
|
|
135 | (1) |
|
Would China Use Operational Cyberwar the Same Way? |
|
|
136 | (1) |
|
Why Supremacy Is Meaningless and Superiority Unnecessary |
|
|
137 | (1) |
|
Coda: A Note of Skepticism on the Potential of Operational Cyberwar |
|
|
138 | (3) |
Part III. Operations |
|
|
Chapter 12 Organizing a Cyberwar Campaign |
|
|
141 | (7) |
|
|
141 | (2) |
|
The Insertion of Operational Cyberwar into Kinetic Operations |
|
|
143 | (2) |
|
|
145 | (1) |
|
The Rogue Cyberwarrior Challenge |
|
|
146 | (2) |
|
Chapter 13 Prof essionalizing Cyberwar |
|
|
148 | (10) |
|
|
148 | (3) |
|
|
151 | (4) |
|
|
155 | (1) |
|
Programming and Budgeting for Cyberwar |
|
|
156 | (2) |
|
Chapter 14 Is Cyberspace a Warfighting Domain? |
|
|
158 | (10) |
|
Cyberwar Operations Are About Usurping Command and Control |
|
|
159 | (1) |
|
Cyberspace as Multiple Media |
|
|
160 | (1) |
|
Defend the Domain or Ensure Missions? |
|
|
160 | (1) |
|
As for Offensive Operations |
|
|
161 | (1) |
|
It Raises the Attention to DDOS Attacks |
|
|
162 | (2) |
|
Other Errors from Calling Cyberspace a Warfighting Domain |
|
|
164 | (1) |
|
No Domain, No Cyber Equivalent of Billy Mitchell |
|
|
165 | (2) |
|
|
167 | (1) |
|
Chapter 15 Strategic Implications of Operational Cyberwar |
|
|
168 | (11) |
|
Influencing Others Against Digitization |
|
|
168 | (5) |
|
The Importance of Conventional Dissuasion |
|
|
173 | (3) |
|
The Challenge of Alliance Defense in Cyberspace |
|
|
176 | (3) |
|
Chapter 16 Stability Implications of Operational Cyberwar |
|
|
179 | (8) |
|
|
179 | (2) |
|
|
181 | (2) |
|
The Risks of Acting Are Reduced |
|
|
183 | (1) |
|
The Risks of Not Acting Are Increased |
|
|
184 | (2) |
|
A Missing Element of Caution |
|
|
186 | (1) |
|
|
186 | (1) |
|
Chapter 17 Strategic Cyberwar |
|
|
187 | (9) |
|
Strategic Cyberwar May Focus on Power Grids and Banks |
|
|
187 | (2) |
|
How Coercive Can a Strategic Cyberwar Campaign Be? |
|
|
189 | (1) |
|
Strategic Cyberwar as Information War |
|
|
190 | (1) |
|
|
191 | (1) |
|
|
192 | (1) |
|
Managing the Effects of Cyberwar |
|
|
193 | (1) |
|
|
194 | (1) |
|
|
195 | (1) |
Part IV. Strategies |
|
|
Chapter 18 Cyberwar Threats as Coercion |
|
|
196 | (6) |
|
A Limited Cyberwar Campaign |
|
|
196 | (2) |
|
|
198 | (3) |
|
Conclusions and Implications for Mutually Assumed Disruption |
|
|
201 | (1) |
|
Chapter 19 The Unexpected Asymmetry of Cyberwar |
|
|
202 | (8) |
|
The Third World Disadvantage |
|
|
202 | (2) |
|
The Particular U.S. Advantage |
|
|
204 | (2) |
|
Was This All an Exercise in Nostalgia? |
|
|
206 | (1) |
|
A Silver Lining Arising from Kerckhoff's Principle |
|
|
207 | (1) |
|
The Influence of Third Parties on the Balance of Power in Cyberspace |
|
|
208 | (2) |
|
Chapter 20 Responding to Cyberattack |
|
|
210 | (11) |
|
First-Strike Cyberattacks May Have a Variety of Motives |
|
|
210 | (2) |
|
Some Supposed Attacks Are Not |
|
|
212 | (1) |
|
Should the Target Reveal the Cyberattack-and When? |
|
|
213 | (2) |
|
Non-Retaliatory Responses |
|
|
215 | (1) |
|
|
216 | (1) |
|
|
217 | (3) |
|
Doing Nothing Is Also an Option |
|
|
220 | (1) |
|
|
220 | (1) |
|
Chapter 21 Deterrence Fundamentals |
|
|
221 | (8) |
|
Cyberdeterrence Differs from Nuclear and Criminal Deterrence |
|
|
222 | (1) |
|
The Rationale for Deterrence |
|
|
223 | (1) |
|
What Makes Deterrence Work? |
|
|
224 | (2) |
|
The Core Message of Deterrence |
|
|
226 | (3) |
|
Chapter 22 The Will to Retaliate |
|
|
229 | (9) |
|
|
229 | (1) |
|
|
230 | (1) |
|
There May Be Bigger Issues on the Table |
|
|
230 | (1) |
|
Credibility May Not Be Easy to Establish |
|
|
231 | (1) |
|
The Signals Associated with Carrying Out Reprisals May Get Lost in the Noise |
|
|
232 | (1) |
|
The Impact of Good Defenses on Credibility Is Mixed |
|
|
233 | (1) |
|
Can Extended Deterrence Work in Cyberspace? |
|
|
233 | (2) |
|
Why Credibility Makes Attribution an Issue |
|
|
235 | (2) |
|
|
237 | (1) |
|
|
238 | (13) |
|
|
238 | (2) |
|
How Good Would Attribution Be? |
|
|
240 | (1) |
|
When Attribution Seems to Work |
|
|
241 | (1) |
|
What Could Make Attribution So Hard? |
|
|
242 | (1) |
|
When Can Countries Be Blamed for What Started Within Their Borders? |
|
|
243 | (3) |
|
Will the Attacker Always Avoid Attribution? |
|
|
246 | (1) |
|
Why an Attacker May Favor Ambiguous Attribution over None at All |
|
|
247 | (1) |
|
What Should Be Revealed about Attribution? |
|
|
248 | (3) |
|
Chapter 24 What Threshold and Confidence for Response? |
|
|
251 | (11) |
|
|
251 | (1) |
|
|
252 | (2) |
|
Should Pulled or Failed Punches Merit Retaliation? |
|
|
254 | (1) |
|
What About Retaliating Against Cyberespionage? |
|
|
254 | (2) |
|
|
256 | (2) |
|
Other Advantages of a Probabilistic Deterrence Posture |
|
|
258 | (2) |
|
The Choice to Retaliate Under Uncertainty |
|
|
260 | (2) |
|
Chapter 25 Punishment and Holding Targets at Risk |
|
|
262 | (6) |
|
|
262 | (1) |
|
|
262 | (2) |
|
The Temptations of Cross-Domain Deterrence |
|
|
264 | (1) |
|
Will Targets Actually Hit Back at All? |
|
|
265 | (1) |
|
Summary Observations on Cyberdeterrence |
|
|
265 | (3) |
|
Chapter 26 Deterrence by Denial |
|
|
268 | (5) |
|
What Is Being Discouraged? |
|
|
268 | (3) |
|
Complicating Psychological Factors |
|
|
271 | (1) |
|
Dissuading Cyberattack by Defeating Its Strategy |
|
|
271 | (2) |
|
Chapter 27 Cyberwar Escalation |
|
|
273 | (13) |
|
|
273 | (1) |
|
Escalation and Operational Cyberwar |
|
|
274 | (1) |
|
Escalation in Strategic Cyberwar |
|
|
275 | (1) |
|
The Difficulties of Tit-for-Tat Management |
|
|
276 | (4) |
|
Escalation into Kinetic Warfare |
|
|
280 | (2) |
|
Escalation Risks from Proxy Cyberwar |
|
|
282 | (2) |
|
|
284 | (1) |
|
|
285 | (1) |
|
Chapter 28 Brandishing Cyberattack Capabilities |
|
|
286 | (7) |
|
|
286 | (1) |
|
Your Power or Their Powerlessness? |
|
|
286 | (1) |
|
How to Brandish Cyberattack Capabilities |
|
|
287 | (1) |
|
Escalation Dominance and Brandishing |
|
|
288 | (2) |
|
|
290 | (1) |
|
|
291 | (2) |
|
Chapter 29 Cyberattack in a Nuclear Confrontation |
|
|
293 | (9) |
|
|
293 | (2) |
|
Disabling a Capability versus Thwarting a Threat |
|
|
295 | (1) |
|
Rogue State Strategies for Discrediting the Cyberwar Bluff |
|
|
296 | (1) |
|
|
297 | (2) |
|
|
299 | (1) |
|
Is There Much Point to Disarming a Target State's Nuclear Capabilities? |
|
|
299 | (1) |
|
Should Targeting the Nuclear Command and Control Systems of Major Nuclear Powers Be Abjured? |
|
|
300 | (1) |
|
|
301 | (1) |
|
Chapter 30 Narratives and Signals |
|
|
302 | (9) |
|
Narratives to Facilitate Crisis Control |
|
|
302 | (1) |
|
A Narrative Framework for Cyberspace |
|
|
303 | (1) |
|
Narratives as Morality Plays |
|
|
304 | (1) |
|
Narratives to Walk Back a Crisis |
|
|
305 | (2) |
|
|
307 | (1) |
|
What Can We Say with Signals that Would Come as News to Others? |
|
|
308 | (1) |
|
|
308 | (1) |
|
|
309 | (2) |
|
Chapter 31 Strategic Stability |
|
|
311 | (6) |
|
Would Nuclear Dilemmas Echo in Cyberspace? |
|
|
311 | (2) |
|
Misperception as a Source of Crisis |
|
|
313 | (2) |
|
Excessive Confidence in Attribution or Preemption |
|
|
315 | (1) |
|
Can There Be a Cuban Missile Crisis in Cyberspace? |
|
|
315 | (1) |
|
|
316 | (1) |
Part V. Norms |
|
|
Chapter 32 Norms for Cyberspace |
|
|
317 | (16) |
|
Norms Against Hacking in General |
|
|
317 | (1) |
|
|
318 | (2) |
|
|
320 | (1) |
|
Law of Armed Conflict: Jus in Bello |
|
|
320 | (3) |
|
Law of Armed Conflict: Jus ad Bellum |
|
|
323 | (1) |
|
From the Tallinn Manual to Las Vegas Rules |
|
|
324 | (1) |
|
What the Tallinn Manual Says |
|
|
325 | (3) |
|
|
328 | (1) |
|
|
329 | (1) |
|
Why Not Las Vegas Rules for Outer Space as Well? |
|
|
330 | (1) |
|
|
331 | (2) |
|
Chapter 33 Sino-American Relations and Norms in Cyberspace |
|
|
333 | (14) |
|
The United States Advocates Its Norms |
|
|
333 | (2) |
|
|
335 | (2) |
|
One Deterrence, Two Deterrence, Red Deterrence, Blue Deterrence |
|
|
337 | (3) |
|
Why Red and Blue Deterrence Matter to Cyberspace |
|
|
340 | (3) |
|
A Modest Proposal for Improving Cyberspace Behavior |
|
|
343 | (1) |
|
Coda: The September Agreement between President XI and President Obama |
|
|
344 | (3) |
|
Chapter 34 Cyberwar: What Is It Good For? |
|
|
347 | (5) |
|
Modeling the Influence of Cyberattack Options |
|
|
347 | (2) |
|
How Much Cybersecurity Do We Really Need? |
|
|
349 | (3) |
Acknowledgments |
|
352 | (1) |
Notes |
|
353 | (70) |
Bibliography |
|
423 | (38) |
Index |
|
461 | |