Offensive Cyber Capability: Can it Reduce Cyberterrorism
Stephen M. Marshall · 2010
The subject of cyberterrorism has become a topic of increasing importance to both the U.S. government and military. Offensive cyber capabilities provide a means to mitigate risk to U.S. systems that depend on the Internet to conduct business. In combination with passive security measures, offensive cybercapabilities seem to add to the level of Internet security thereby securing cyberspace for all Americans. The intent of this monograph is to identify the strengths and weaknesses of an offensive cyber capability in order to visualize the various options and tradeoffs necessary to achieve an acceptable level of security. The idea of convergence continues to bring together separate technologies using the Internet in order to interact and become more efficient. The effect of this phenomenon has increased the speed with which information is shared, helped business become more competitive and provided different means to distribute information. This same convergence has made the Internet a prime target as it has the potential to affect the economy, critical infrastructure and limit the freedoms of others in the cyberspace arena. Due to the increasing complexity of technology, vulnerabilities will continue to surface that can be taken advantage of. Technology is also becoming cheaper and easier to operate granting any motivated individual with access to the Internet the ability identify network vulnerabilities and exploit them. These themes are important as they identify that the U.S. is highly dependent on the Internet making it imperative that feasible security options must be identified in order to secure cyberspace. A cyberterrorist act has not occurred therefore there is no empirical evidence to develop case studies upon and generate learning. An agent based model using basic parameters learned from the literature review and logical deductions reveals key several key relationships. First, there is a balance between an offensive cyber capability and passive defensive measures that must be achieved in order to attain an acceptable level of network security. Increased passive defensive measures can reduce vulnerabilities, thereby mitigating the threat of cyberterrorist attack. However, public and industrial interests will continue to challenge the strength of the passive defensive measures, creating network vulnerabilities that can be taken advantage of. Second, an offensive cyber capability can reduce the threat of cyberterrorism. It is clear from the agent based model that the addition of this resource with passive defensive measures can lead to higher cyberterrorist kills and fewer nodal compromises. It grants the state the ability to take direct action against a perceived threat however the risk is high for attacking an innocent bystander. However, for the U.S. to achieve an acceptable level of security, it cannot be too reliant on offensive cyber capabilities.