Table of Contents
Preface iii
Figures ix
Tables xi
Summary xiii
Acknowledgements xxi
Abbreviations xxiii
Chapter 1 Introduction 1
Purpose 5
Basic Concepts and Monograph Organization 6
Chapter 2 A Conceptual Framework 11
The Mechanisms of Cyberspace 12
External Threats 13
Internal Threats 20
Insiders 20
Supply Chain 21
In Sum 22
Defining Cyberattack 23
Defining Cyberdeterrence 27
Chapter 3 Why Cyberdeterrence Is Different 39
Do We Know Who Did It? 41
Can We Hold Their Assets at Risk? 52
Can We Do So Repeatedly? 56
If Retaliation Does Not Deter, Can It at Least Disarm? 59
Will Third Parties Join the Fight? 62
Does Retaliation Send the Right Message to Our Own Side? 64
Do We Have a Threshold for Response? 65
Can We Avoid Escalation? 69
What If the Attacker Has Little Worth Hitting? 70
Yet the Will to Retaliate Is More Credible for Cyberspace 71
A Good Defense Adds Further Credibility 73
Chapter 4 Why the Purpose of the Original Cyberattack Matters 75
Error 76
Oops 76
No, You Started It 77
Rogue Operators 78
The Command-and-Control Problem 78
Coercion 79
Force 82
Other 86
Implications 90
Chapter 5 A Strategy of Response 91
Should the Target Reveal the Cyberattack? 92
When Should Attribution Be Announced? 93
Should Cyberretaliation Be Obvious? 94
Is Retaliation Better Late Than Never? 96
Retaliating Against State-Tolerated Freelance Hackers 98
What About Retaliating Against CNE? 102
Should Deterrence Be Extended to Friends? 104
Should a Deterrence Policy Be Explicit? 106
Can Insouciance Defeat the Attackers Strategy? 108
Confrontation Without Retaliation 109
The Attackers Perspective 112
Signaling to a Close114
Chapter 6 Strategic Cyberwar 117
The Purpose of Cyberwar 118
The Plausibility of Cyberwar 121
The Limits of Cyberwar 122
The Conduct of Cyberwar 125
Cyberwar as a Warning Against Cyberwar 126
Preserving a Second-Strike Capability 127
Sub-Rosa Cyberwar? 128
A Government Role in Defending Against Cyberwar 129
Managing the Effects of Cyberwar 131
Terminating Cyberwar 135
Conclusions 137
Chapter 7 Operational Cyberwar 139
Cyberwar as a Bolt from the Blue 143
Dampening the Ardor for Network-Centric Operations 149
Attacks on Civilian Targets 153
Organizing for Operational Cyberwar 154
Conclusions 158
Chapter 8 Cyberdefense 159
The Goal of Cyberdefense 160
Architecture 165
Policy 167
Strategy 169
Operations 170
Hardware 171
Deception 171
Red Teaming 173
Conclusions 173
Chapter 9 Tricky Terrain 175
Appendixes 179
A What Constitutes an Act of War in Cyberspace? 179
B The Calculus of Explicit Versus Implicit Deterrence 183
C The Dim Prospects for Cyber Arms Control 199
References 203
