IMPACTS OF MALICIOUS CYBER ACTIVITIES
Embargo until
Date
2015-08-20
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
Johns Hopkins University
Abstract
In past decades security dilemmas focused on state on state activities where the tools of power were only obtainable with the resources a state can bring to bear. In moving into a new era where the cyber domain offers state and non-state actors the ability to wield low-cost capabilities for high-effect actions, understanding the implications of these threats to national security is paramount.
This thesis ponders if proposed cyber governance models are effective in assessing risk, preventing, and responding to malicious cyber activities. Current governance processes for preventing and responding to malicious cyber activities are immature and inadequate to manage the requirements of an ever-expanding cyber domain. This thesis explores why current approaches to implementing security through policy and standards of practice have been unsuccessful and concludes that evidence found though analyzing multiple case studies shows a lack of coherent risk assessment, inadequate prevention and inconsistent responses to malicious cyber activities.
The first chapter explores whether governance approaches designed to prevent and deter malicious cyber activities are effective, hypothesizing that current governance processes cannot deter or prevent malicious cyber activities. Through the analysis of the 2013 Target and the 2014 USIS computer network exploitation in relation to three governance approaches explored in the literature review, analysis revealed none provided adequate cyber incident prevention.
The second chapter explores governance approaches to respond to malicious cyber activities are effective, hypothesizing that current response options are not effective. Through the analysis of the 2014 Sony and 2014 JP Morgan Chase malicious cyber incidents, response approaches reviewed were inadequate in part because of legal authority but poor risk assessment also emerged as a driving factor.
The final chapter explores whether a state actor, in this case China is a risk to critical infrastructure. The chapter theorizes that state actors such as China possess the capability to conduct crippling cyberattacks in U.S. critical infrastructure. Using the 2003 northeast blackout as an analog the chapter concludes that though cyberattacks on U.S. critical infrastructure are possible, wide scale full spectrum cyber warfare is unlikely; however the threat that state actors pose to the U.S. infrastructure is real, and requires further attention.
Description
Keywords
cyber policy, cyber attack, cyber defense