There have been discussions of treaties banning "cyberwar" already. It seems counterproductive. I assume it would be preferable to someone in Seoul that they we

There have been discussions of treaties banning "cyberwar" already. It seems counterproductive. I assume it would be preferable to someone in Seoul that they were attacked through digital means than with conventional weapons. They might lose access to their bank accounts for a while, but they won't have their homes destroyed or family killed. Asymmetric warfare of all kinds has two sides to it, it's part of the definition of asymmetric. The low capability party has to attack asymmetrically, but the high capability party can respond with much greater and effective force. In most cases, we are the high capability party. This "new" concept of cyber-warfare is really a way of saying conflict through the use of digital networks, but in a way that is distinguishable from network-centric or electronic warfare which are two different things. It is also asymmetric in the sense that it enables a low capability party to attack a high capability party with a much small investment than a strategic attack through other means would require. (Leaving out "terrorist-style" attacks using small arms or devices for the moment, which are not usually strategic.) It also means that a high capability party may not have an adequate defense against this type of attack, no matter how much they might invest in passive/defensive security. One weakness in enough systems is enough to massively increase the effectiveness of the overall attack. To respond to your second point, the overuse of "cyber-" is nauseating, and I personally restrict it to the use I mentioned earlier which is a means of differentiating it with network-centric or electronic warfare. A financial institution issuing press releases talking up their "cyber-security" means as little their marketing copy mentioning their use of "industry-grade SSL encryption." A proper disclosure would get into password policies for internal systems as well as customer accounts, what hashing algorithm they use to protect customer account passwords in their system, and other details that would give testimony to their capabilities in securing their own systems. This is somewhere where Google and Chrome can do a lot of good, giving us more than EV certificates and use of higher bit and stronger hash algorithms on CA certs as feedback in the browser. The next step could be a (cryptographically) signed affidavit of the internal security measures in place, which could be scored and used as a part of the determination of what feedback to show in the browser UI. It might also make sense for Chrome to conduct a rudimentary scan of the home router for these kind of obvious issues, or maybe for Google or someone else to offer an inexpensive secure router, though too many of these are provided by the ISPs now. Anyway, I'll leave it the cyberexperts to share their cyberknowledge about cyberwarfare and cybersecurity about how to prevent cyberviruses and other malware to those of us who are less cybersavvy, or, in the words of more than one newscaster, barely know how to turn on their computer.