Rising cyber attacks across the globe have been a menace and threatening to targets. From 2005 to 2015, federal agencies reported a 1,300 percent jump in cyber security incidents. Recently, Russia was accused of interfering and manipulating the whole US election results by hacking into Democratic Party computers. Then in October several high-profile websites were knocked offline when thousands of internet-connected devices, such as digital video recorders and cameras were compromised by Mirai malware.
It’s high time we think of better ways for addressing these threats. Amid this, the idea of cyber-deterrence has started emerging. Deterrence has long been effective to counter the threat of nuclear weapons, so can it even work against cyber weapons?
Deterrence focuses on making potential adversaries think twice about attacking; firstly, by making them consider the cost of their act and the consequence of counterattack and second is punishment by making sure the adversaries know there will be a strong response that might inflict more harm than they are willing to bear.
Unlike nuclear weapons which are there only in a few countries and only significant resources need to invest in them, cyber weapons can be quickly developed by individuals or small groups and they can be easily replicated and distributed across networks. Cyber weapons are often deployed under a cloak of anonymity, making it difficult to figure out who is really responsible and it also leaves a broad range of effects, most of which is disruptive and costly, but not catastrophic.
However, this does not imply that cyber deterrence cannot work.
There are three things we can do to strengthen cyber deterrence: Improve cybersecurity, employ active defences and establish international norms for cyberspace. The first two of these measures will significantly improve our cyber defences so that even if an attack is not deterred, it will not succeed.
Improving cyber security
If the protection is geared up, the attack will be stopped before the hackers can achieve their goal. For this, login security should be beefed up, data and communications need to be encrypted, viruses and malware need to be fought and software should be regularly updated to patch any weakness found.
A more pressing protection issue today is the shipping and selling of cheap Internet-of-Things devices which lead to many attacks. While some companies like Microsoft, heavily invest in product security, may others do not do so.
Cybersecurity expert, Bruce Schneier advises that regulation should be imposed on manufacturers to put in basic security standards in devices, failing which they should be held liable when they are products are used in attacks.
Employ active defences
Action against attackers can be taken by monitoring, identifying and countering adverse cyberattacks. These active cyber defences are similar to air defence systems. Network monitors that watch for and block hostile packets are one example, as are honeypots that attract or deflect adversary packets into safe areas. There, they do not harm the targeted network, and can even be studied to reveal attackers’ techniques.
Another set of active defences involves collecting, analysing and sharing information about potential threats so that network operators can respond to the latest developments and if any malware is found, they could disconnect the devices from the network and alert the devices’ owners to the danger.
An active cyber defence can often unmask the people behind them, leading to punishment. Nongovernment attackers can be shut down, arrested and prosecuted; countries conducting or supporting cyber warfare can be sanctioned by the international community.
Establish international norms
International norms for cyberspace can aid deterrence if national governments believe they would be named and shamed within the international community for conducting a cyber attack.
It’s difficult to completely get rid of cyberspace but at least the attacks can be minimised to a certain level if strong security, cyber defences and international cyber norms are actively used.
