Home Station

RAND Issues New Report on Cybersecurity

The RAND Corp. has released "Cyberdeterrence and Cyberwar," a new look at the protection of cyber infrastructure.  Pointing out that the protection of cyberspace has become a national priority since cyberspace is now the dominant information medium, the report argues that cyberwar and cyber defense are nothing like traditional defense and warfare.  "Cyberspace has its own laws; for instance, it is easy to hide identities and difficult to predict or even understand battle damage, and attacks deplete themselves quickly. The author explores these in detail and uses the results to address such issues as the pros and cons of counterattack, the value of deterrence and vigilance, and other actions the United States and the U.S. Air Force can take to protect itself in the face of deliberate cyberattack."

To read the full report, click here.

INSA Calls for Public-Private Partnership to Address Cyber Security

The Intelligence and National Security Alliance (INSA) has just released a white paper on cyber security, "Addressing Cyber Security Through Public-Private Partnership."  The paper proposes that a public-private partnership is the best approach for addressing cyber security issues and examines three existing models as examples of successful partnerships. The paper argues that private industry should set cyber security standards, while the federal government -- led by DHS -- should be responsible for cyber regulation, enforcement of laws, defense against threats, and response to threats.  INSA believes that a public-private partnership for cyber security can be initiated by private industry, presidential initiative, or Congresssional initiative, but stresses that no matter who takes ownership, it is crucial that one entity take ownership now and begin to systematically address the cyber security issue through a partnership comprised of all stakeholders.

To read the entire paper, click here.

Executive director of EMP Commission submits testimony to House committee

Dr. Michael J. Frankel, executive director of the EMP Commission, recently submitted testimony to the U.S. House Homeland Security Committee concerning threats to the nation's power grid and to cyber security.

• Download the testimony as a four-page PDF.

New report: 'Identify Theft: Trends and Issues'

The Congressional Researech Service has issued a new report, "Identify Theft: Trends and Issues."

From the introduction:

In the wake of the economic downturn, policymakers are increasingly concerned with securing the economic health of the United States—including combating those crimes that threaten to further undermine the nation’s financial stability. Identity theft is one such crime. It is the fastest growing type of fraud in the United States; in 2008 about 9.9 million Americans were reportedly victims of identity theft, an increase of 22% from the number of cases in 2007. In addition, the Federal Trade Commission (FTC) estimates that it costs consumers about $50 billion annually. Identity theft is often committed to facilitate other crimes such as credit card fraud, document fraud, or employment fraud, which in turn can affect not only the nation’s economy but its security. Consequently, in securing the nation and it’s economic health, policymakers are also tasked with reducing identity theft and its impact.

Download the report as a 31-page PDF.

New report from Deloitte on need for global cybersecurity

Deloitte Touche has released a report, "Cybersecurity: Everybody’s Imperative -- Protecting our economies, governments, and citizens":

From the introduction:

Governments around the world need to address cybersecurity urgently so organizations can survive, thrive, and enable economic growth. Cyberspace, which began as an electronic adjunct to other domains such as commerce, today is a domain unto itself, and organizations of all types must be able to function effectively in cyberspace in order to survive.

The problem is that cyber culture is growing faster than cybersecurity, so everything that depends on cyberspace is at risk. Private data, intellectual property, infrastructure and even military and national security can be compromised by deliberate attacks, inadvertent security lapses, and the inherent vulnerabilities of the Internet. On top of this, the current global economic crisis is amplifying these threats.
Governments need to partner with the private sector, citizens, and other governments to work on a holistic, transnational solution that goes beyond technology to combat these threats and enable global commerce, greater transparency in government, and improved data protection. The stakes are high but the risks are even higher: isolation, cyber protectionism, and an inadequate balance between security and civil liberties.

The solution: We must address cybersecurity and the changes in habits and lifestyle that go with it, because there’s no way back.

• Download the report as a 16-page PDF

FBI assesses impact of Internet fraud in newly released annual report

The FBI has released its annual report on Internet crime.

From the summary:

"This report provides a snapshot of the prevalence and impact of Internet fraud. Care must be taken to avoid drawing conclusions about the 'typical' victim or perpetrator of these types of crimes. Anyone who utilizes the Internet is susceptible, and IC3 has received complaints from both males and females ranging in age from ten to one hundred years old. Complainants can be found in all fifty states, in dozens of countries worldwide, and have been affected by everything from work-at-home schemes to identity theft."

Download the 28-page report as a pdf

Suspected cyber espionage network is documented in new report

A new report from the Information War Monitor claims to document the GhostNet - a suspected cyber espionage network of more than 1,295 infected computers in 103 countries, 30% of which are high-value targets, including ministries of foreign affairs, embassies, international organizations, news media, and NGOs.

From the web page:

"The capabilities of GhostNet are far-reaching. The report reveals that Tibetan computer systems were compromised giving attackers access to potentially sensitive information, including documents from the private office of the Dalai Lama. The report presents evidence showing that numerous computer systems were compromised in ways that circumstantially point to China as the culprit. But the report is careful not to draw conclusions about the exact motivation or the identity of the attacker(s), or how to accurately characterize this network of infections as a whole. The report argues that attribution can be obscured.

"The report concludes that who is in control of GhostNet is less important than the opportunity for generating strategic intelligence that it represents. The report underscores the growing capabilities of computer network exploitation, the ease by which cyberspace can be used as a vector for new do-it-yourself form of signals intelligence. It ends with warning to policy makers that information security requires serious attention."

• View the report online.
• Read related article in New York Times.

Part one of report 'Cyberspace and the National Security of the United Kingdom' is now online

Chatham House has issued the first part of a major project on cybersecurity entitled "Cyberspace and the National Security of the United Kingdom." From the project's web page:

"This report provides a general overview of the problem of cybersecurity. The aim of the report is to inform debate and to make the case for a more coherent, comprehensive and anticipatory policy response, both nationally and internationally.

"In every area, society is becoming increasingly dependent upon information and communications technology (ICT). With dependency come exposure and vulnerability to misuse, criminality and even attack. Criminals and extremists are able to take advantage of the same 'global technological commons' upon which society is becoming so dependent. Cybersecurity has become a fast-moving and complex security challenge, one which requires a coordinated, agile and mutually reinforcing response from all those who benefit from the global ICT infrastructure.

"This report forms the first part of a major project on cybersecurity undertaken by Chatham House in conjunction with Detica Ltd. The project aims to engage government, private-sector, academic and other specialists in high-level analysis of cybersecurity challenges and responses."

• Download the 46-page report as a pdf.

Report explores role of Congress in national cyber security

A new report from the Congressional Research Service explores the role of Congress in establishing and overseeing national cyber security. From the introduction:

"In January 2008, the Bush Administration established the Comprehensive National Cybersecurity Initiative (the CNCI) by a classified joint presidential directive. The CNCI establishes a multipronged approach the federal government is to take in identifying current and emerging cyber threats, shoring up current and future telecommunications and cyber vulnerabilities, and responding to or proactively addressing entities that wish to steal or manipulate protected data on secure federal systems.

"On February 9, 2009, President Obama initiated a 60-day interagency cybersecurity review to develop a strategic framework to ensure the CNCI is being appropriately integrated, resourced, and coordinated with Congress and the private sector.

"In response to the CNCI and other proposals, questions have emerged regarding: (1) the adequacy of existing legal authorities—statutory or constitutional—for responding to cyber threats; and (2) the appropriate roles for the executive and legislative branches in addressing cybersecurity. The new and emerging nature of cyber threats complicates these questions. Although existing statutory provisions might authorize some modest actions, inherent constitutional powers currently provide the most plausible legal basis for many potential executive responses to national security related cyber incidences. Given that cyber threats originate from various sources, it is difficult to determine whether actions to prevent cyber attacks fit within the traditional scope of executive power to conduct war and foreign affairs. Nonetheless, under the Supreme Court jurisprudence, it appears that the President is not prevented from taking action in the cybersecurity arena, at least until Congress takes further action. Regardless, Congress has a continuing oversight and appropriations role. In addition, potential government responses could be limited by individuals’ constitutional rights or international laws of war. This report discusses the legal issues and addresses policy considerations related to the CNCI."

• Download the report.

'Terrorists' New Domain: Virtual Worlds in Cyberspace,' a new report from Corporate Risk International

From the introduction:

"With the widespread use of technology, unprecedented numbers of people are gaining access to the internet, increasing global connectivity.  Although people use numerous formats to connect to each other, the use of virtual worlds for communication is becoming exceedingly popular.  What began as text-only chat rooms, virtual worlds have developed into three-dimensional environments, with users socializing, communicating, learning, and in some cases, conducting commercial activities.  This multi-functional environment has sparked fears among intelligence and security experts that virtual worlds are also becoming a new meeting point for criminal and terrorist organizations.  Criminals and terrorists can meet anonymously to recruit, organize, plan, and even potentially train for attacks and criminal operations.  In addition, users' actions inside a virtual world can sometimes have dire consequences in the real world."

Download the report as a pdf.