Experts Respond to Defense Department Cyber Strategy

The U.S. Department of Defense recently unveiled declassified portions of its long-awaited strategy for handling cyberattacks, declaring publicly for the first time that it would treat cyberspace -- just as land, sea, and air -- as an "operational domain."

While the department's five-pronged approach to combating cyber threats signaled an important first step in the development of a national cyberwarfare strategy, it also raised many unanswered questions, including policy issues such as how the U.S. could use the Internet to respond to a cyber threat.

Three experts from the Indiana University Center for Applied Cybersecurity Research (CACR) offered brief insight into the plan. Each is available for further comment.

FRED H. CATE, CACR director and Distinguished Professor, IU Maurer School of Law: This is an important first step; it is the first time this has ever been done by the Department of Defense. But it's still a very traditional and not particularly innovative approach. There are critical legal questions that aren't asked or answered. For example: When does a cyber attack constitute an act of war and when is a kinetic response justified? What are the limits of DoD involvement in the proposed partnerships with industry and civilian government agencies? How are civil liberties to be protected? We should care, and the Defense Department should care, about the answers, but at least in the unclassified section of the report, it doesn't ask the questions, most likely because it doesn't want the department's hands tied.

DAVID P. FIDLER, CACR Fellow, James P. Calamaras Professor of Law: The five pillars of the new DoD strategy consolidate existing thinking and practice rather than break new policy ground. The central tension in this strategy is the contrast between the announced scaling up of U.S. military activities in cyberspace with repeated reassurances that these increased and intensified activities do not portend the militarization of cyberspace. The openness and interconnectedness of the Internet suggest that containing rapidly expanding military interest, initiatives, and influence in cyberspace will be a very difficult policy challenge -- especially if cybersecurity failures continue in civilian contexts. Stronger moves by the U.S. military in cyberspace will prompt similar moves by other countries, producing a collective militarization creep in cyberspace that might threaten, ultimately, the Internet freedom agenda the Obama administration is championing.

SCOTT SHACKELFORD, CACR Fellow, professor of business law and ethics, IU Kelley School of Business: The strategy states that sophisticated cyber capabilities reside with nations, allowing the U.S. to respond with military force if threatened. But it fails to note how the U.S. will be able to attribute attacks quickly and accurately, or how the U.S. will respond to state-sponsored cyberattacks launched by non-state actors. What will the burden of proof be? The strategy is interesting, but did little to change the overall dynamic or address fundamental legal and technical questions of securing cyberspace.

The Center for Applied Cybersecurity Research has been designated a National Center of Academic Excellence in both Information Assurance Education and Research. CACR is part of the Pervasive Technology Institute at Indiana University.

Featured

  • Maximizing Your Security Budget This Year

    The Importance of Proactive Security Measures: 4 Stories of Regret

    We all want to believe that crime won’t happen to us. So, some business owners hope for the best and put proactive security measures on the back burner, because other things like growth, attracting new customers, and meeting deadlines all seem more pressing. Read Now

  • 91 Percent of Security Leaders Believe AI Set to Outpace Security Teams

    Bugcrowd recently released its “Inside the Mind of a CISO” report, which surveyed hundreds of security leaders around the globe to uncover their perception on AI threats, their top priorities and evolving roles, and common myths directed towards the CISO. Among the findings, 1 in 3 respondents (33%) believed that at least half of companies are willing to sacrifice their customers’ long-term privacy or security to save money. Read Now

  • Milestone Announces Merger With Arcules

    Global video technology company Milestone Systems is pleased to announce that effective July 1, 2024, it will merge with the cloud-based video surveillance solutions provider, Arcules. Read Now

  • Organizations Struggle with Outdated Security Approaches, While Online Threats Increase

    Cloudflare Inc, recently published its State of Application Security 2024 Report. Findings from this year's report reveal that security teams are struggling to keep pace with the risks posed by organizations’ dependency on modern applications—the technology that underpins all of today’s most used sites. The report underscores that the volume of threats stemming from issues in the software supply chain, increasing number of distributed denial of service (DDoS) attacks and malicious bots, often exceed the resources of dedicated application security teams. Read Now

Featured Cybersecurity

Webinars

New Products

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction. 3