10 ms·

Articles on Cyber-Warfare from the Modern War Institute at West Point

114 points by Ice_cream_suit 5y ago

chrisseaton 5y ago
Take a look at the institute's list of fellows - some very interesting people! https://mwi.usma.edu/fellows/max-brooks/ https://mwi.usma.edu/fellows/max-brooks/
- alex_anglin 5y ago
  Getting off topic here a fair bit, but you may enjoy these conversations with Max Brooks from the Commonwealth Club: -How Star Wars Explains Modern Military Conflict: https://www.commonwealthclub.org/events/archive/podcast/max-brooks-and-ml-cavanaugh-how-star-wars-explains-modern-military-conflict https://www.commonwealthclub.org/events/archive/podcast/max-... -How Game of Thrones Explains Modern Military Conflict: https://mlcavanaugh.com/2019/04/09/how-game-of-thrones-explains-modern-military-conflict-commonwealth-club/ https://mlcavanaugh.com/2019/04/09/how-game-of-thrones-expla...
1cvmask 5y ago
The biggest defense on a societal level is a pervasive use of MFA for all applications, a good patching policy and backups.
- jason-phillips 5y ago
  Those are good points, but there's quite a bit more to it than that. Off the top off my head, hunting within your network and reducing attackers' dwell time is another strong recommendation. Proxying internal network traffic with SSL-decrypt and rules-based analysis is another. Defining boundaries and firewalling off infrastructure to limit the blast radius is another. Scanning project code, dependencies and containers, and so on. It really requires a holistic approach and commitment. There is no one right answer here but it's something we all need to take seriously, imo. Disclosure: Have worked for several cyber-security startups with former .gov and .mil professionals while assisting many sensitive federal agencies myself.
  - AyyWS 5y ago
    Does SSL-Decryptand and rules-based analysis work? These are the times I've interacted with them: 1. Disabling SSL-Decrypt because it blocks HTTPS from PowerShell, bash, git, android studio and other comandline tools where I couldn't figure out how to trust our internal cert. I figured it out for Postman, but mostly I just couldn't figure it out. 2. Disabling or exempting rules that blocked our pharmacy app from going to webpages or perform SQL Queries that included legal drug names that were also illegal drug names. I think it's tough for non-security professionals who feel burdened and never get to see the benefits.
    - jason-phillips 5y ago
      Define "work". It's a layer in your overall plan. You should be able to apply it selectively and tweak as appropriate. If an internal resource is exfiltrating information somehow, the goal is to uncover that activity.
- crims0n 5y ago
  MFA and patching doesn’t help much when your perimeter gets knocked over by a zero day. There is quite a bit more that goes into security than these surface level recommendations. It’s why cybersecurity is such a hot field right now, with a massive talent shortage.
  - jvanderbot 5y ago
    Not disagreeing, but Op's 'biggest' and 'societal' is not necessarily in disagreement with what you said, and leaves lots of room for necessary measures above and beyond.
    - bitexploder 5y ago
      People get compromised with MFA all the time. It’s like 1/10th of a societal level solution. The real biggest part is also the hardest and that is education. Password managers, spotting phishing, spotting scam calls, using MFA, updating your software regularly, patching your ancient home router, etc. It takes a lot and these are all likely vectors you will get popped as a regular user in home equipment. There is no cure all and even as someone with 15 years of experience in the most technical parts of information security I have no simple solutions. Don’t use computers lol.
      - giantg2 5y ago
        Most routers today have automatic patching schedules, so at least that one is getting better.
      - jvanderbot 5y ago
        yes they do get compromised, but that doesn't mean you shouldn't use it. It also doesn't mean that's all you should use. If all of society used 2fa, we'd be much better, which is all OP was saying. Also, 1/10 can still be the biggest factor. but this is getting pedantic
        bitexploder 5y ago
- rocqua 5y ago
  I'd expect in case of actual war, prepare for commercial network connectivity to fail. Satellites? Shot down. Fiber? ISP and higher-level routers are owned or simply DDOSed Cellular? what parts of the edge are owned is down, the core networks get targeted heavily. At best this will be spotty. The big internet-interconnects? Targets for cruise missiles and any other viable attacks. BGP? Fully poisoned and needs to be cleaned up before anything works. I'd expect the DoD to have their own networks up that are much more resilient. But our current highly interconnected, triered, and multi-faceted internet is going down the moment war between the great nations breaks out. It is simply too easy, and too valuable for the enemy not to do this.
  - KineticLensman 5y ago
    Also cutting underwater cables. In the news in the last few days as a potential act of war [0], and the real-world effects have already been , e.g. [1] [0] https://www.forces.net/news/chief-defence-staff-russia-cutting-underwater-cables-could-be-act-war https://www.forces.net/news/chief-defence-staff-russia-cutti... [1] https://en.wikipedia.org/wiki/2008_submarine_cable_disruption https://en.wikipedia.org/wiki/2008_submarine_cable_disruptio...
  - jmnicolas 5y ago
    To your list I would add a nice virus that wipes clean all the hard drives in the commercial clouds. Just that would decimate the West and would need decades to recover from.
  - jnurmine 5y ago
    Unless EMPs also wipe out consumer electronics, there will likely be only islands of connectivity. I'm thinking folks with WIFI gadgets and COTS networking gear could very well build local connectivity, but those islands would be unable to talk to each other. The WIFI gadgets would have to mesh up over distances which are likely to exceed their range. Jamming and a generally dirty RF environment is likely in a war of such magnitude, so perhaps distributed laser links would work best, if one could create line of sight between the link nodes.
    - 5y ago
Borrible 5y ago
Just in the unlikely event of disarmament negotiations between cyber super powers in the future. You can count nukes and explosive power, but you can't count cyber weapons. A new deterrence doctrine,nobody knows what will happen.
- Enginerrrd 5y ago
  It's not totally unprecedented. It's hard to count HUMINT assets too, and yet it is the subject of negotiations. Biological weapons have been similar and are perhaps most analogous. Though, you can offer tours of your facilities and it's harder to hide large fermenters and the like. But it's much harder to identify offensive weapons research than it is offensive production.
- jason-phillips 5y ago
  > A new deterrence doctrine, nobody knows what will happen. I'm quoting someone else's apropos statement here: "You don't just turn a country's electric grid back on."
- 3pt14159 5y ago
  It has already evolved. I don't want to rehash everything here, but I wrote something that made the rounds at the Munich security conference some years back and the bottom line is deterrence to massive cyberattack is via nuclear weapons. Do you like Moscow? Ok great. Keep the lights on stateside. That's the policy. I know it isn't what HN likes to hear but it's not like it doesn't exist. There is a reason the nuclear football has a switch to disable the internet for at least the USA and probably Canada too because of NORAD, etc. Even Matt Tait (aka, pwnallthethings) has talked about the "strategic threats" from the cyber domain of war at a completely unclassified conference in Miami and he ended the talk with a mushroom cloud up. I believe it was the keynote, but I can't quite remember.
  - jmnicolas 5y ago
    FWIW I tried to visit the website linked in your description but your certificate is invalid since November.
ya_throw 5y ago
>"Ignore the Human Factor at your peril" Indeed. Why bother with weapons (kinetic AND cyber) at all, when the both the spread and the pseudo-anonymous nature of online communication has left the thoughts, desires and opinions of the Western world wide open for study and manipulation. I used to have strong opinions about the necessity for a fully free, open, anonymous, untracked, etc etc, internet. However, from a national security point of view, countries like Russia and China have it right. Why would you allow the above to happen to your citizens?
- juanani 5y ago
- Terry_Roll 5y ago
  > Why would you allow the above to happen to your citizens? In peace time, its logical to continue military developments on individual members of the public. Besides there are more constraints on military activity at times of war, biological & chemical weapons are banned, propaganda or pysops continues to be developed though as its not banned under any international convention. Psyops can both microtarget and blanket cover huge parts of the population. The public make the mistake in trusting those who rule over them.
  - jefurii 5y ago
    > The public make the mistake in trusting those who rule over them. Like we're supposed to trust corporations more? At least the government has some degree of transparency and it's at least theoretically possible to vote people out or make changes.
- champagnois 5y ago
  >>Western world wide open for study and manipulation I have long since held the opinion that blogs and online publishing would yield an avenue for foreign influence and cognitive attacks on our way of life. For what it is worth, I do believe that the government and our intelligence agencies are fundamentally good and are staffed by mostly non-partisan, non-extremist patriots who I have tremendous respect for. We are, presently, a government for the people by the people and of the people. I do, however, fear that our intelligence agencies and politicians exist with a high degree of arrogance derived from a faith in the superiority of our messaging. I share their faith that our way of life and methods of dealing with each other is superior to that of communist or authoritarian societies, but I do not share their same level of arrogance. I am more inclined to think that the internet should be modified so as to ensure that the emergent dialogue, the emergent narrative of history and events, is one that came about naturally from our citizens speaking with one another. For starters, comment sections should be siloed or firewalled nationally. Media entities of significance that wish to portray themselves as reputable news media should be required to have a registration with the government. Their comment sections should be limited to an anonymized walled-garden of citizens of our country only. Removing foreign influence operatives from the comment sections of CNN, WashingtonPost, and Fox News would do a lot to heal the national divide and quell the brewing extremism. I would go much further than that and would do tons of experiments if I was in charge of a department handling such a push at the government level. I think all of these troll attacks on our republic fall under the umbrella term "cognitive attacks" and I think it is time we make an effort to apply network security concepts to our national, internal dialogue.
cdiamand 5y ago
Looks like the USMA has taken defensive action against all the HN visitors pummeling it's website. (pages loading slowly, if at all)
- hereforphone 5y ago
  Yeah I'm sure they're super busy trying to get less people from HN to read their content. Not a hug of death thing at all.
blablabla123 5y ago
It's worrying how IT security is getting militarized because conventional conflicts are getting less (which is a good thing) and thus military staff might be getting bored/lacking opportunities.

Take a look at the institute's list of fellows - some very interesting people! https://mwi.usma.edu/fellows/max-brooks/ https://mwi.usma.edu/fellows/max-brooks/

alex_anglin 5y ago
Getting off topic here a fair bit, but you may enjoy these conversations with Max Brooks from the Commonwealth Club: -How Star Wars Explains Modern Military Conflict: https://www.commonwealthclub.org/events/archive/podcast/max-brooks-and-ml-cavanaugh-how-star-wars-explains-modern-military-conflict https://www.commonwealthclub.org/events/archive/podcast/max-... -How Game of Thrones Explains Modern Military Conflict: https://mlcavanaugh.com/2019/04/09/how-game-of-thrones-explains-modern-military-conflict-commonwealth-club/ https://mlcavanaugh.com/2019/04/09/how-game-of-thrones-expla...

1cvmask 5y ago

The biggest defense on a societal level is a pervasive use of MFA for all applications, a good patching policy and backups.

jason-phillips 5y ago
Those are good points, but there's quite a bit more to it than that. Off the top off my head, hunting within your network and reducing attackers' dwell time is another strong recommendation. Proxying internal network traffic with SSL-decrypt and rules-based analysis is another. Defining boundaries and firewalling off infrastructure to limit the blast radius is another. Scanning project code, dependencies and containers, and so on. It really requires a holistic approach and commitment. There is no one right answer here but it's something we all need to take seriously, imo. Disclosure: Have worked for several cyber-security startups with former .gov and .mil professionals while assisting many sensitive federal agencies myself.
- AyyWS 5y ago
  Does SSL-Decryptand and rules-based analysis work? These are the times I've interacted with them: 1. Disabling SSL-Decrypt because it blocks HTTPS from PowerShell, bash, git, android studio and other comandline tools where I couldn't figure out how to trust our internal cert. I figured it out for Postman, but mostly I just couldn't figure it out. 2. Disabling or exempting rules that blocked our pharmacy app from going to webpages or perform SQL Queries that included legal drug names that were also illegal drug names. I think it's tough for non-security professionals who feel burdened and never get to see the benefits.
  - jason-phillips 5y ago
    Define "work". It's a layer in your overall plan. You should be able to apply it selectively and tweak as appropriate. If an internal resource is exfiltrating information somehow, the goal is to uncover that activity.
crims0n 5y ago
MFA and patching doesn’t help much when your perimeter gets knocked over by a zero day. There is quite a bit more that goes into security than these surface level recommendations. It’s why cybersecurity is such a hot field right now, with a massive talent shortage.
- jvanderbot 5y ago
  Not disagreeing, but Op's 'biggest' and 'societal' is not necessarily in disagreement with what you said, and leaves lots of room for necessary measures above and beyond.
  - bitexploder 5y ago
    People get compromised with MFA all the time. It’s like 1/10th of a societal level solution. The real biggest part is also the hardest and that is education. Password managers, spotting phishing, spotting scam calls, using MFA, updating your software regularly, patching your ancient home router, etc. It takes a lot and these are all likely vectors you will get popped as a regular user in home equipment. There is no cure all and even as someone with 15 years of experience in the most technical parts of information security I have no simple solutions. Don’t use computers lol.
    - giantg2 5y ago
      Most routers today have automatic patching schedules, so at least that one is getting better.
    - jvanderbot 5y ago
      yes they do get compromised, but that doesn't mean you shouldn't use it. It also doesn't mean that's all you should use. If all of society used 2fa, we'd be much better, which is all OP was saying. Also, 1/10 can still be the biggest factor. but this is getting pedantic
      - bitexploder 5y ago
rocqua 5y ago
I'd expect in case of actual war, prepare for commercial network connectivity to fail. Satellites? Shot down. Fiber? ISP and higher-level routers are owned or simply DDOSed Cellular? what parts of the edge are owned is down, the core networks get targeted heavily. At best this will be spotty. The big internet-interconnects? Targets for cruise missiles and any other viable attacks. BGP? Fully poisoned and needs to be cleaned up before anything works. I'd expect the DoD to have their own networks up that are much more resilient. But our current highly interconnected, triered, and multi-faceted internet is going down the moment war between the great nations breaks out. It is simply too easy, and too valuable for the enemy not to do this.
- KineticLensman 5y ago
  Also cutting underwater cables. In the news in the last few days as a potential act of war [0], and the real-world effects have already been , e.g. [1] [0] https://www.forces.net/news/chief-defence-staff-russia-cutting-underwater-cables-could-be-act-war https://www.forces.net/news/chief-defence-staff-russia-cutti... [1] https://en.wikipedia.org/wiki/2008_submarine_cable_disruption https://en.wikipedia.org/wiki/2008_submarine_cable_disruptio...
- jmnicolas 5y ago
  To your list I would add a nice virus that wipes clean all the hard drives in the commercial clouds. Just that would decimate the West and would need decades to recover from.
- jnurmine 5y ago
  Unless EMPs also wipe out consumer electronics, there will likely be only islands of connectivity. I'm thinking folks with WIFI gadgets and COTS networking gear could very well build local connectivity, but those islands would be unable to talk to each other. The WIFI gadgets would have to mesh up over distances which are likely to exceed their range. Jamming and a generally dirty RF environment is likely in a war of such magnitude, so perhaps distributed laser links would work best, if one could create line of sight between the link nodes.
  - 5y ago

Borrible 5y ago

Just in the unlikely event of disarmament negotiations between cyber super powers in the future. You can count nukes and explosive power, but you can't count cyber weapons. A new deterrence doctrine,nobody knows what will happen.

Enginerrrd 5y ago
It's not totally unprecedented. It's hard to count HUMINT assets too, and yet it is the subject of negotiations. Biological weapons have been similar and are perhaps most analogous. Though, you can offer tours of your facilities and it's harder to hide large fermenters and the like. But it's much harder to identify offensive weapons research than it is offensive production.
jason-phillips 5y ago
> A new deterrence doctrine, nobody knows what will happen. I'm quoting someone else's apropos statement here: "You don't just turn a country's electric grid back on."
3pt14159 5y ago
It has already evolved. I don't want to rehash everything here, but I wrote something that made the rounds at the Munich security conference some years back and the bottom line is deterrence to massive cyberattack is via nuclear weapons. Do you like Moscow? Ok great. Keep the lights on stateside. That's the policy. I know it isn't what HN likes to hear but it's not like it doesn't exist. There is a reason the nuclear football has a switch to disable the internet for at least the USA and probably Canada too because of NORAD, etc. Even Matt Tait (aka, pwnallthethings) has talked about the "strategic threats" from the cyber domain of war at a completely unclassified conference in Miami and he ended the talk with a mushroom cloud up. I believe it was the keynote, but I can't quite remember.
- jmnicolas 5y ago
  FWIW I tried to visit the website linked in your description but your certificate is invalid since November.

ya_throw 5y ago

>"Ignore the Human Factor at your peril" Indeed. Why bother with weapons (kinetic AND cyber) at all, when the both the spread and the pseudo-anonymous nature of online communication has left the thoughts, desires and opinions of the Western world wide open for study and manipulation. I used to have strong opinions about the necessity for a fully free, open, anonymous, untracked, etc etc, internet. However, from a national security point of view, countries like Russia and China have it right. Why would you allow the above to happen to your citizens?

juanani 5y ago
Terry_Roll 5y ago
> Why would you allow the above to happen to your citizens? In peace time, its logical to continue military developments on individual members of the public. Besides there are more constraints on military activity at times of war, biological & chemical weapons are banned, propaganda or pysops continues to be developed though as its not banned under any international convention. Psyops can both microtarget and blanket cover huge parts of the population. The public make the mistake in trusting those who rule over them.
- jefurii 5y ago
  > The public make the mistake in trusting those who rule over them. Like we're supposed to trust corporations more? At least the government has some degree of transparency and it's at least theoretically possible to vote people out or make changes.
champagnois 5y ago
>>Western world wide open for study and manipulation I have long since held the opinion that blogs and online publishing would yield an avenue for foreign influence and cognitive attacks on our way of life. For what it is worth, I do believe that the government and our intelligence agencies are fundamentally good and are staffed by mostly non-partisan, non-extremist patriots who I have tremendous respect for. We are, presently, a government for the people by the people and of the people. I do, however, fear that our intelligence agencies and politicians exist with a high degree of arrogance derived from a faith in the superiority of our messaging. I share their faith that our way of life and methods of dealing with each other is superior to that of communist or authoritarian societies, but I do not share their same level of arrogance. I am more inclined to think that the internet should be modified so as to ensure that the emergent dialogue, the emergent narrative of history and events, is one that came about naturally from our citizens speaking with one another. For starters, comment sections should be siloed or firewalled nationally. Media entities of significance that wish to portray themselves as reputable news media should be required to have a registration with the government. Their comment sections should be limited to an anonymized walled-garden of citizens of our country only. Removing foreign influence operatives from the comment sections of CNN, WashingtonPost, and Fox News would do a lot to heal the national divide and quell the brewing extremism. I would go much further than that and would do tons of experiments if I was in charge of a department handling such a push at the government level. I think all of these troll attacks on our republic fall under the umbrella term "cognitive attacks" and I think it is time we make an effort to apply network security concepts to our national, internal dialogue.

cdiamand 5y ago

Looks like the USMA has taken defensive action against all the HN visitors pummeling it's website. (pages loading slowly, if at all)

hereforphone 5y ago
Yeah I'm sure they're super busy trying to get less people from HN to read their content. Not a hug of death thing at all.

blablabla123 5y ago

It's worrying how IT security is getting militarized because conventional conflicts are getting less (which is a good thing) and thus military staff might be getting bored/lacking opportunities.