MAD About Cyber-Security

While the decades of the Cold War were witness to various and sundry proxy fights in discrete, far-flung battlefields, as well as rare moments of frightening brinksmanship, the relationship between the U.S and the Soviet Union was largely governed by the very real-world military doctrine of mutually assured destruction (MAD). Simply put, given the massive nuclear arsenals on both sides, it would have been, well, mad, to contemplate mutual annihilation - neither side had any rational incentive to initiate a full-scale conflict because retaliation would ensure that victory was utterly unachievable.

Key to the tacit superpower “agreement” was the need to ensure that the precarious balance not be upended, for instance, by the spread of the technology capable of enabling unstable powers to enter the game. With NATO and the Soviets and Satellites in an effective stand-off (excepting “controllable” proxy spats), the imperative was to manage proliferation, hence the 1970 Non-Proliferation Treaty (NPT). While history has demonstrated that the NPT was only marginally effective, it complemented MAD in precluding escalation to any world-devastating conflict.

Flash forward to today’s era of cyber-insecurity. While the landscape is not as well-defined as during the black and white, us-vs.-them Cold War days (State and non-State sponsored cyber activity is common worldwide), the two biggest actors, the U.S. and China, are caught up in a maddening (as it were) dance. While various States and non-States – Russia, Israel, Anonymous, WikiLeaks (to name a few) - are wielding their cyber-tools with only sporadic and superficial notice, the U.S. and China are ratcheting up their bilateral cyber-tension, in terms of both action and rhetoric.

Not a day goes by that we don’t read of Chinese cyber-incursions into U.S. networks. Not a week passes that we don’t hear one or another strident Government Agency or Congressional voice decrying Chinese theft of secrets and threats to U.S. critical infrastructure. Presumably, the Chinese have the same concerns about American activity inside their cyber-borders and networks – they are perhaps just less publicly vocal on the topic. In Washington, however, cyber has become the scare de jour.

What’s lost in the fear-mongering hullaballoo is the fact that both sides are mutually vulnerable, to each other, and to other actors in what is essentially a borderless cyber-world. National governments and globalized industry struggle – in frustrating fits and starts - to define best practices to secure supply chains and to develop technologies and tools to monitor and analyze digital traffic to detect, quarantine and quash the potentially nefarious. Flash back to the early Cold War: Would the signatories to the NPT have even had a treaty to sign in the absence of Superpower MADness?

Fragmented (national) solutions to cyber-threats will not effectively address what is intrinsically a global phenomenon. Indeed, beyond being ineffective in managing cyber-threats, such initiatives will ultimately result in further fragmentation and disruption – in terms of global information and communications technology (ICT) supply chains, digital commerce, and, ultimately, innovation and economic recovery and growth.

The facts are – as anyone engaged in any intellectually honest discussion must acknowledge – that effective solutions to cyber-security concerns must be universal because cyber-vulnerabilities are shared across the entire ICT industry and every country because the ICT industry – ALL players – is transnational. But, until and unless the U.S. and China come to some accord in terms of acceptable ("controllable") cyber behavior, a fact-based, rational and effective solution to our cyber-worries may well remain elusive. MADdening isn’t it?

It’s time to borrow from the past, and not in terms of Cold War, knee-jerk, “they’re all evil” sentiments, but, rather, in terms of settling into a MAD-like Nash Equilibrium. The U.S. and China must agree to certain behaviors, and then project adherence to those behaviors via some latter-day NPT-like global cyber regime. (Please don’t read that wrong – it’s obviously too late to stop proliferation of tools of digital mischief, if it was ever possible. And, just as the criminalization of hacking is a pipe dream - which even if achieved would fall flat in terms of enforcement - so too are UN cyber-inspectors).

Bottom line: All of today's inflammatory cyber-rhetoric and cyber-political flailing about is serving no-one’s true cyber-interests. Globalization is real. The ICT industry is global. Our digital economies are increasingly interdependent. Cyber-threats do not respect - or even recognize - national borders (e.g. Stuxnet did some collateral damage outside Iran). Today's superpowers must acknowledge that their bilateral (and mutual multilateral) tension and conflict are not going away and, as such, should at the very least strive to manage common vulnerabilities in such a manner that both sides can continue to maintain their respective national AND economic securities, to their mutual benefit.

Just sayin'...

China, Russia Propose UN Cyber-Code

Concerns related to network- and cyber-security, which have increased rather dramatically in recent years, are reaching an all-new crescendo. Notwithstanding the sometimes-strident nationalist rhetoric of one or another country, what is missing from cyberspace are Geneva Convention-like international rules to standardize (and/or "govern") cyber-behavior.

And, lo (and behold), just over a week ago, on September the 12th, China, Russia, Tajikistan, and Uzbekistan asked the UN Secretary-General to circulate a proposed voluntary International Code of Conduct for Information Security at the 66th session of the General Assembly (taking place this week in NYC), and further called on UN member countries to consider the document as a framework around which to reach a near-term consensus on international norms and rules standardizing national behavior related to information, cyberspace and network security.

Bravo!

...Wait. China, Russia? Really? Aren't these the cyber-bad guys? Or, are they just the ones that get caught more often than others, or, could it be that they're just more regularly on the receiving end of Western-based media attention than other cyber-perps?...

...Ok, ok, leaving that cynical tidbit-for-thought aside for the nonce, what does the proposed Code suggest?

Well, as should be expected of any formal intergovernmental document, the preamble is chock full of "recalling," "reaffirming" and "recognizing" to set the stage for the actual proposals, but it's worthwhile to take note of some (not all) of the lofty and unobjectionable objectives outlined in the lead up to the actual (remarkably brief) proposed code. To wit:

- Recognizing the need to prevent the potential use of information and communication technologies (ICTs) for purposes that are inconsistent with the objectives of maintaining international stability and security, and may adversely affect the integrity of the infrastructure within States, to the detriment of their security...

- Highlighting the importance of the security, continuity and stability of the Internet, and the need to protect the Internet and other ICT networks from threats and vulnerabilities, and reaffirming the need for a common understanding of the issues of Internet security and for further cooperation at national and international level...

- Recognizing that confidence and security in the use of information and communications technologies are among the main pillars of the information society, and that a robust global culture of cyber-security needs to be encouraged, promoted, developed and vigorously implemented...

Good stuff. Good framework. What about the key elements of the proposed Code?

Well, each State voluntarily subscribing to the Code would pledge, among other things not related directly to network/cyber-security:

- Not to use ICTs including networks to carry out hostile activities or acts of aggression and pose threats to international peace and security;

- Not to proliferate information weapons and related technologies;

- To endeavor to ensure the supply chain security of ICT products and services, prevent other states from using their resources, critical infrastructures, core technologies and other advantages, to undermine the right of the countries...or to threaten other countries' political, economic and social security.

- To lead all elements of society, including its information and communication private sectors, to understand their roles and responsibilities with regard to information security, in order to facilitate the creation of a culture of information security and the protection of critical information infrastructures.

Again, good stuff. Cyber-motherhood and broadband apple pie, as it were...

Hey, I'm the first to admit that rhetoric is little more than nothing in the absence of action and accountability, but that's no reason to look a rhetorical gift horse in the mouth. It is in all of our best interests and the interest of global commerce and security - physical and digital - to address the proliferation of cyber-threats. Any UN member country that rejects or ignores either the call for action or the proposed Code should at the very least be challenged to deliver an alternative.

This should be interesting to watch...

Meanwhile, in other news, Network World reported yesterday on an interview/Q&A with former cyber-security czar Richard Clarke. Clarke, who served in the State Department under Reagan, as chair of the Counter-terrorism Security Group and member of the National Security Council under Bush I, as National Coordinator for Security, Infrastructure Protection, and Counter-terrorism (the chief counter-terrorism adviser on the National Security Council) under Clinton, and Special Advisor to the President on Cyber-security under Bush II, had some interesting answers to some probing questions, including:

If you had the influence, what would you change to improve U.S. cybersecurity?

"...In a regulated industry -- finance, power and telecommunications -- I'd require all the software be vetted for all kinds of mistakes."

When the question of supply-chain security comes up, and with so much manufacturing coming from China, do you think there's reason to be concerned about security of products made in foreign countries where sometimes there are political tensions?

"My attitude is whether it comes from New York state or Shanghai, it probably has the same risk in software. There are people in the U.S. who can be bribed, too."

I think that pretty much sums it up folks: cyber-security is a global issue demanding global solutions - solutions that are agnostic to infrastructure provider and/or geography...

Stay tuned.

** cross-posted to Facebook from www.mbplrcbd.blogspot.com **