22 ms·

I hardly think this problem is unique to the US, media just talks about it more openly. Despite their "cyber-war" offensive units, I venture that the Chinese a

by heresy 16y ago

I hardly think this problem is unique to the US, media just talks about it more openly. Despite their "cyber-war" offensive units, I venture that the Chinese are just as vulnerable, if not more so. At least the military culture in the US allows admission of shortcoming and failure. Try talking about the weakness of Russia or China against "cyber" attacks in those countries and see how long it is that you get to remain alive and out of jail. And while I think the US may be initially surprised by the enemy capability were a "cyber" blitzkrieg to eventuate, I think the experience the US has with conducting war and the adaptability of US forces would far outweigh the advantages of initial surprise. US wars since WWII are no indication of US behavior in an engagement where it matters. Not that Vietnam, Korea, Iraq, Afghanistan, etc did not matter to the people who lived there, far from it. But they were not really wars where the US felt its very survival under threat, or really had much skin in the game. Things are different in such a war.

hga 16y ago
Agreed on all your points. Traditionally the US military, especially the Army, has started out the greenest and learned the fastest. The tragedy of Vietnam is that the learning part was short-circuited. In the case of a "cyberwar", or more likely it being part of a greater action, say "The Battle of the Taiwan Straits" or whatever, things would be messy but it's silly to say that we're either 100% unprepared or sitting ducks. As for "skin in the game", one analysis I like is that the intensity of the nation's commitment to a war goes like this, based on the three cultural groups that matter in this area: The Jacksonians are always ready and willing to fight. Next are the New England Moralists. And if the Midwestern Pragmatists decide that fighting the enemy is better than continuing to do business with him, well, it's all over (for the enemy). You can find at least one good essay out there discussing this.
- tptacek 16y ago
  Regarding whether or not we're sitting ducks: support that argument with evidence. In opposition to your argument, I supply this assertion: our commercial and industrial IT infrastructure is riddled with horrible vulnerabilities. Virtually no penetration test against any entity running critical infrastructure fails.
  - hga 16y ago
    Well ... how about "not all of the country's targets are sitting ducks"? There has been a variety of hardening, in part due to the many attacks that have already been made by a variety of actors. Part of it is that the defense will be active and I have some faith in our ability to respond to and recover from attacks. But what you're saying and most especially implying could well be true, but we won't really know unless and until we're seriously attacked. I do say that we won't start to get serious about this sort of thing only after a particular software bug or vulnerability kills thousands of Americans.
    - tptacek 16y ago
      I just don't know what you're trying to get at here. Are there "targets" that are adequately defended? I'm sure. I have no insight, for instance, into theater military communications. Actually, I have very little insight into DoD or the agencies at all. What I have a fair bit of insight into is the industrial and commercial infrastructure which this article about Clarke is talking about. When Clarke suggests that a foreign actor could cause targeted blackouts, he's simply not wrong. If you want to allude to defenses, I'm going to have to ask you to be specific, because I don't know what you're talking about. Shutting the whole Internet off might not totally remediate the threat.
      - hga 16y ago
        By defenses I mean people like you and me fixing things, in a less violent way than shutting off the whole Internet. Ad hoc, on the fly ... hard if your part of the grid isn't up ... I'm just saying that in a timetable measured in hours to days the defenses against such an attack won't be entirely static.
        tptacek 16y ago
        It often takes months to deploy fixes inside of enterprises for known problems. The idea that we're going to be crazy ninjas dealing with nationally distributed attacks using vectors most people haven't even thought of yet strikes me as deeply unrealistic.

by heresy 16y ago

hga 16y ago

Agreed on all your points. Traditionally the US military, especially the Army, has started out the greenest and learned the fastest. The tragedy of Vietnam is that the learning part was short-circuited. In the case of a "cyberwar", or more likely it being part of a greater action, say "The Battle of the Taiwan Straits" or whatever, things would be messy but it's silly to say that we're either 100% unprepared or sitting ducks. As for "skin in the game", one analysis I like is that the intensity of the nation's commitment to a war goes like this, based on the three cultural groups that matter in this area: The Jacksonians are always ready and willing to fight. Next are the New England Moralists. And if the Midwestern Pragmatists decide that fighting the enemy is better than continuing to do business with him, well, it's all over (for the enemy). You can find at least one good essay out there discussing this.

tptacek 16y ago
Regarding whether or not we're sitting ducks: support that argument with evidence. In opposition to your argument, I supply this assertion: our commercial and industrial IT infrastructure is riddled with horrible vulnerabilities. Virtually no penetration test against any entity running critical infrastructure fails.
- hga 16y ago
  Well ... how about "not all of the country's targets are sitting ducks"? There has been a variety of hardening, in part due to the many attacks that have already been made by a variety of actors. Part of it is that the defense will be active and I have some faith in our ability to respond to and recover from attacks. But what you're saying and most especially implying could well be true, but we won't really know unless and until we're seriously attacked. I do say that we won't start to get serious about this sort of thing only after a particular software bug or vulnerability kills thousands of Americans.
  - tptacek 16y ago
    I just don't know what you're trying to get at here. Are there "targets" that are adequately defended? I'm sure. I have no insight, for instance, into theater military communications. Actually, I have very little insight into DoD or the agencies at all. What I have a fair bit of insight into is the industrial and commercial infrastructure which this article about Clarke is talking about. When Clarke suggests that a foreign actor could cause targeted blackouts, he's simply not wrong. If you want to allude to defenses, I'm going to have to ask you to be specific, because I don't know what you're talking about. Shutting the whole Internet off might not totally remediate the threat.
    - hga 16y ago
      By defenses I mean people like you and me fixing things, in a less violent way than shutting off the whole Internet. Ad hoc, on the fly ... hard if your part of the grid isn't up ... I'm just saying that in a timetable measured in hours to days the defenses against such an attack won't be entirely static.
      - tptacek 16y ago
        It often takes months to deploy fixes inside of enterprises for known problems. The idea that we're going to be crazy ninjas dealing with nationally distributed attacks using vectors most people haven't even thought of yet strikes me as deeply unrealistic.