raceBannon - Slashdot User

Comment Re:It's not Cyber "Warfare" ..it's Cyber-Espionnag (Score 1) 24

by raceBannon on Thursday July 21, 2011 @01:21PM (#36836224) Attached to: Book Review: Cyber Warfare

No - there is a difference between Cyber Espionage and Cyber Warfare. This book is about Cyber Warfare and the policies surrounding that activity. No nation has declared cyber war on another but, you can bet that many nations are experimenting with how to use cyberspace to conduct warfare operations. The Stuxnet story demonstrates that it is possible to use a cyber vector alone to destroy critical infrastructure. You can bet that many nations have noted that and are figuring out how to leverage that information.

Comment Re:Any successes? (Score 1) 24

by raceBannon on Thursday July 21, 2011 @01:06PM (#36836078) Attached to: Book Review: Cyber Warfare

Well- this book is not a case study book. it is more about policy. I am not aware of any book that outlines Cyber Warfare case studies. I think most of that would be classified. The Giant Bureaucracy you are talking about is the new Cyber Command.

Submission + - Cyber Warfare

Submitted by raceBannon on Friday July 08, 2011 @07:30AM

raceBannon writes: The authors, Steve Winterfield and Jason Andress, cover everything you will want to consider when thinking about how to use cyberspace to conduct warfare operations. The primary concepts have been bouncing around US military circles for over a decade but they have never been collected into one tome before. Clarke and Knake’s book, “Cyber War: The Next Threat to National Security and What to Do about It,” discusses how weak the US network defenses are and offers suggestions about how to improve. Carr’s book, “Inside CyberWarfare: Maping the Cyber Underworld,” presents threat examples and nation state capabilities. Libicki’s book, “Cyberdeterrence and Cybrewar,” attacks cyberwar from a policy viewpoint and does not really address operational considerations. Stiennon’s book, “Surviving Cyberwar,” is a good place to start if you are new to the subject and is almost a prerequisite for this book.

Full Disclosure: One of the authors, Steve Winterfield, used to work for me when he and I were both in the US Army wrestling with all of these ideas right after 9/11. I ran the Army Computer Emergency Response Team (ACERT) and Steve ran the Army’s Southern Regional CERT (RCERT South). He and I have been friends ever since and he even quoted me in one of the back chapters.

Although the content has been around for a while, it is striking how little the main concepts have changed. In a world where new innovations completely alter the popular culture every eighteen months, the idea that Cyber Warfare’s operational principals remain static year after year is counter-intuitive. After reading through the various issues within though, you begin to understand the glacial pace. These difficult concepts spawn intractable problems and the authors do a good job of explaining them.

I do have a slight issue withthe subtitle though: “Techniques, Tactics and Tools for the Security Practitioners.” The way I read this book, the general purpose (GP) Security Practitioner will not find this book very useful except as backgroundinformation. Aside from the chapters on Logical Weapons, Social Networking and Computer Network Defense, most of the material has to do with how a nation state, mostly the US, prepares to fight in cyber space. There is overlap for the GP security practitioner, but this material is covered in more detail in other books.

The book is illustrated. Some of the graphics are right out of military manuals and have that PowerPoint Ranger look about them. Some are screenshots of the various tools presented. Others are pictures of different equipment. One graphic stood out for me in the Cyberspace Challenges chapter (14). The graphic in question is a neat Venn Diagram that encapsulates all of the Cyber Warfare issues mentioned in the book, categorizes the complexity of each issue and shows where they overlap in terms of Policy, Processes, Organization, Tech, People and Skills. My only ding on the diagram is that in the same chapter, the authors discuss how much each issue might cost to overcome. It would have been very easy to represent that information on the Venn diagram and make it more complete.

One last observation about the graphics that I really liked is the author’s use of “Tip” and “Note” boxes throughout the book. Scattered throughout the chapters are grayed-out text boxes that talk about some technology or procedure that is related to the chapter information but not directly. For example, in the Social Engineering chapter (7), the authors placed a “Note” describing the various Phishing forms. You do not need the information to understand the chapter but having it nearby provides the reader with a nice example to solidify the main arguments. The book is full of these examples.

The first three chapters are my favorites. Winterfield and Andress do agood job of wrapping their heads around such entangled concepts as the definition of cyber warfare, the look of a cyber battle space and an inernational view of current doctrine It is fascinating.

In the middle of the book, the authors take on the task of describing the Computer Network Operations (CNO) Spectrum; a spectrum that ranges from the very passive form of Computer Network Defense (CND) through the more active forms of Computer Network Exploitation (CNE) and Computer Network Attack (CNA). It is indeed a spectrum too because the delineation between where CND, CNE and CNA start and stop is not always clean and precise. There is overlap. And somewhere along that same spectrum is where law enforcement organizations and counter-intelligence groups operate. You can get lost fairly quickly without a guide and the authors provide that function admirably. The only thing missing from these chapters is a nice diagram that encapsulates theconcept.

Along the way the reader gets a nice primer on the legal issues surrounding Cyber Warfare, the ethics that apply, what it takes to be a cyber warrior and a small glimpse over the horizon about what the future of Cyber Warfare might bring. In the end, Winterfield and Andress get high marksfor encapsulating this complex material into an easy-to-understand manual; a foundational document that most military cyber warriors should have at their fingertips and a book that should reside on the shelf of anybody interested in the topic.

Submission + - Chicago Merc. Exchange Secrets Leaked to China (threatpost.com)

Submitted by chicksdaddy on Thursday July 07, 2011 @12:12PM

chicksdaddy writes: A 10 year employee of CME Group in Chicago is alleged to have stolen trade secrets and proprietary source code used to run trading systems for the Chicago Mercantile Exchange and passed them to officials in China, where he hoped to set up a software firm to help create electronic exchanges, according to a criminal complaint filed in U.S. District Court in Illinois. Chunlai Yang, 49, is alleged to have downloaded "thousands of files" containing "source code and proprietary algorithms" used by CME to run its trading systems. The files were downloaded from a company-owned source code repository maintained by CME to Yang's work computer, then copied them to removable "thumb" drives. The complaint also cites personal e-mail correspondence between Yang and an official in China that contained proprietary CME information.

Slashdot Top Deals