多学科视角下的战略网络防御：北约高级研究工作坊论文集

需积分: 14 43 浏览量更新于2024-07-19 收藏 4.41MB PDF 举报

"Strategic Cyber Defense : A Multidisciplinary Perspective" 是一本书，汇集了2016年在弗吉尼亚州诺福克举行的北约高级研究工作坊（ARW）"军事网络安全战略框架"的论文。该书关注的是网络安全领域的多学科视角，特别是国家网络安全策略的实施和北约的网络防御政策。本书探讨的关键知识点包括： 1. 网络安全的多维度挑战：随着对数字和互联网技术的依赖增加，网络安全已上升为国家安全问题。然而，各国发布的网络安全策略往往无法全面覆盖国内所有机构的需求。网络安全问题涉及复杂的利益相关者和网络结构，需要跨学科的方法来解决。 2. 北约的网络防御政策：工作坊聚焦北约的网络防御优先事项以及政策实施。这表明北约成员国在网络安全方面进行了合作，以提高防御能力，并共同应对网络威胁。 3. 跨学科研究：参与者不仅考虑了网络安全的技术影响，还讨论了法律、战略、教育和组织层面的问题。这强调了理解网络安全需要从多个角度进行，包括但不限于技术，还包括法律框架、战略规划和组织架构。 4. 教育与组织层面的考虑：网络安全不仅仅是技术问题，还包括教育公众和组织如何识别和防止攻击，以及建立有效的响应机制。 5. 复杂性与挑战：书中反映了网络安全的复杂性，指出它带来的众多挑战，这要求各个领域专家的协作，以制定全面的防御策略。 6. 北约科学和平与安全系列：这本书是北约科学和平与安全系列的一部分，该系列支持在国防反恐、对抗其他安全威胁以及北约、伙伴国和地中海对话国优先事项等关键领域的会议。 7. 会议类型：北约支持的会议通常分为两种类型——高级研究工作坊（ARW）和高级研究学院（ASI）。ARW旨在为高级受众提供最新进展的教程，而ASI则提供高级别教程，传播某一主题的最新发展。 "Strategic Cyber Defense : A Multidisciplinary Perspective" 提供了网络安全的最新方法和多学科见解，对从事网络安全工作的专业人士具有很高的参考价值。它强调了在制定有效防御策略时，必须综合考虑技术、法律、战略、教育和组织等多个因素。

Western countries are more conscious of their vulnerability to retaliation. This might

explain the perceived discrepancy. Authoritarian states have their weakness towards the

power of the Internet to facilitate communication and organization for oppositional

purposes, as well as serving to dispel official propaganda and other factors affecting

general perception. Online loyalties and ideologies are a grave threat to any regime,

especially one whose legitimacy hangs by a thread. With the rise of extremism and

radicalism, they are a threat also for Western nations with unassimilated minorities

which live in parallel societies and maintain their apartness and their ideological purity

through contact with their home region and with like-minded groups. The worldwide

grassroots architecture is not controlled by anyone, and for countries without the

resources and expertise of powerful states, like China, the best defense against the

Internet digging at the foundations of their regime is to limit access to it altogether,

there being countries with fewer Internet connections than Antarctica.

4. Educational Issues

The participants in the ARW discussed with the leadership of Old Dominion University

the critical issue of educating the required cyber security experts. It was noted that

demand outstrips supply and that the requirements go beyond the training of expert

personnel and veer into the mass education of the population in the basics of cyber

security hygiene and the education of political leaders to internalize the consequences

to their country of the rapid development of cyber security concerns. With regard to the

training of experts, a number of models from the United States and Europe were put on

display, underscoring the diversity of approaches and the wealth of development that

the field will permit. Eventually, the success of cyber security efforts will hinge not just

on conferring the adequate levels of authority on expert bodies and groups, but also on

an adequate balance and provisioning of the diverse skill sets that cyber security in

general, and cyber security policy formulation and implementation, in particular, will

require. A few commonalities stand out.

Decision making in cyber defense, as similar to many other areas, is accomplished

in three levels: tactical, operational and strategic. There exist too many studies and

practical solutions to address tactical and operational side of the issue. Solutions for a

strategic level is a few if any. The main reason behind this situation is considering

cyber in its technical nature. People at the strategic level need to be trained with

concepts, techniques and strategies focused on managing the cyber domain. After

gaining a breadth of cyber domain knowledge, they need a situational awareness

system tailored to satisfy their needs. There needs to develop a training system for

military strategic level decision makers to bring them an understanding of the cyber

environment and its potential impact to military mission and operations. Real-world

cyber security problems have technical, organizational, diplomatic, strategic, economic

aspects. Without taking all these aspects into consideration and harmonizing them in an

efficient manner, failure in problem-solving is inevitable. Therefore, training for the

strategic level should not target only decision-making capabilities of individuals; they

have to improve the collaborative decision-making capabilities of groups in

organizational, national and international contexts.

First to be highlighted was the growing cooperation between the educators and the

end beneficiaries of the trained workforce, exceeding what was previously achieved.

This is going beyond the model of academia cooperating with one particular state

U. Tatar et al. / Strategic Approach to a Fierce Domain 5

agency or private company, to cooperation between more than two entities, such as, in

one example given (that of Syracuse University), the University, a security contractor

and a NATO facility. The rapid development of the field precludes the previous linear

model where the necessities of industry and government trickled down into the

educational curriculum, which would respond to competitive pressures in due course.

Now, the most advanced examples of cyber security education programs march in lock-

step with the end beneficiaries, featuring constant communication and feedback, as

well as an influx of real world scenarios on which students may be trained. The training

of new specialists runs the gamut of academic credentialing, from undergraduate

studies to postgraduate education, but not neglecting continuous education efforts and

industry certification standards as a prerequisite for a performing and responsive

educational system. New courses are introduced, but there is also a concept of adding a

security flavor to almost all courses where this would be applicable. Ultimately, these

developments are required by the evolving challenges of cyber security efforts, but also

by the increasingly difficult task of filling available positions. Specialist labor must be

provided at a certain cost and quality in sufficient quantities and in an adequate

timeframe. Current programs are over-extended and the "naturally" arising resource for

cyber security excellence is being exhausted - individuals from other programs who

enter this field, as well as the self-educated prodigies that often drift into hacker culture

and are eventually recruited by government agencies or by private entities.

Participants argued that educational efforts need to mold professionals capable of

assuring the security of critical systems and providing mathematically rigorous

analyses of system dependability for procurement efforts, as well as other services,

possibly overlooked. In the same fashion that US engineers and scientists promoted

space security as vital to US security interests and, increasingly, NATO interests, so

too must cyber security be promoted.

A paradigm shift must also be promoted, from cyber security research undertaken

at the component level, catering to the commercial demand that also filters into

government demand, to cyber security research at the mission and system levels

especially for militaries but also for civilian beneficiaries.

Recruitment and retention served as important focal points for the discussion.

Identifying and nurturing talent is an arduous process, especially in countries where

there is not yet an adequate pipeline of computer science and engineering oriented

programs to enable pre-selection. Finding ways to cut back on costs and the time

required for appropriate training should also be a concern since the hacker phenomenon

proves that relative youth is not a barrier for cyber expertise. Retention is a problem

many industries face and is vital for the long-term viability of cyber security structures,

especially with the increasing specialization that the field will require. Participants

noted that strategies might be borrowed from other fields which deal with retention

issues, such as the US Army and other stressful and demanding sectors of employment.

Retention factors such as financial rewards, social status and prestige, conditioning the

belief in a higher calling or mission and attributing meaningfulness to the activity that

overrides the pressures are all means of doing so. At the same time, cyber security

efforts must take into account key issues regarding human resources that might not

have been an issue during prior security build-ups. For the United States, but somewhat

applicable to other countries, there is a generational divide that must be bridged with

regards to attitudes towards work, country, ideology, and aspirations. While not

explicitly analyzed as such, the cases of Edward Snowden and Bradley Manning

informed the attitudes of the participants. Cited were the rise to prominence and

U. Tatar et al. / Strategic Approach to a Fierce Domain6

authority of individuals from the "millennial" generation or the increasing reliance in

the military and intelligence communities on civilian contractors lacking both the pre-

selection and acculturation that individuals within military structures receive. The

resulting issues of weak loyalties, dissent expressed in an underhanded and harmful

manner, corruptibility and ideologies at odds with the goals of the legitimate political

authorities and of the policies of the beneficiaries of the individual's work must be

taken into account. This is especially true in an increasingly international milieu, where

individuals come from many different countries, cultures and regimes. Of interest to

some of the participants was the US experience with ROTC (Reserve Officer Training

Corps) programs, which may combine technical training (for students in those

particular fields) with parallel military training that reduces some of the disadvantages

associated with over reliance on civilian capabilities in an expressly military (or

traditional intelligence agency) environment. With the gearing up in several Eastern

European nations of “National Guard” type organizations for reservists and volunteers,

the ROTC model may become an attractive way to not only ensure leadership, but also

to provide a useful anchor point for involving such organization in cyber security

efforts in a manner less conducive to failures in leadership, security culture and so on.

5. Institutional Issues

A significant challenge to collective cyber defense comes from the mixing of missions,

legal regimes, and institutions that accompanies a multi-stakeholder model for security

governance. This model, however, can only be improved, not avoided, because of the

previously stated penury of resources, expertise and knowledge gathering capacities of

individual actors, no matter how well positioned in the abstract. Institutions, functions

and capacities are increasingly being formed or self-forming into clusters, to cement

lines of communication, achieve operational efficiencies and economies of scale. This

model, as opposed to the separate institutional approach, is a natural reaction to the

interconnected world that must be defended, which demands a multidisciplinary

approach, diverse skillsets, even ranging beyond the computer engineering areas into

history, politics, and economics, and the mapping of expertise rather than a

burdensome duplication of effort to create every required expert knowledge in-house.

For instance, SCADA systems vary widely between sectors of activity, so the expertise

required to understand the functioning of the systems in each individual case is very

specific. Since we cannot expect institutions with cyber defense roles to have sanitation

management experts on staff for the eventuality of an attack on a water purification or

waste disposal facility, which would be very damaging, then disparate institutions are

"condemned to cooperate." This is an especially important issue since civilian

infrastructures are legitimate targets in case of an armed conflict and will most likely be

included within the scope of retaliation for a lawful and orderly confrontation.

Militaries are expected to be defenders of last resort for these infrastructures but do not

have the capacity to be familiar, let alone proficient, in the functioning of civilian

networks.

Ultimately, roles and responsibilities have to be defined nationwide before efforts

at Alliance level can truly be effective, with procedures, legal frameworks, and

practices suited to the new security needs. There is a subsidiarity involved in this kind

of thinking, reflecting not just the need to access specialized knowledge (sectorial, local,

etc.), but to marshal all of the resources than can be put to use in making security gains.

U. Tatar et al. / Strategic Approach to a Fierce Domain 7

By working in existing military, civilian, police, central, regional, local and other kinds

of structures, an ever-looming "brick wall" of entanglement, obstinacy, and

ineffectuality can be avoided. This is achieved, partially, by clarifying the impact of

cyber security and ensuring clarity among the active parties on framework questions –

authority, cooperation, information sharing, timeframes and resources. The urgency of

crisis management processes makes answering these issues all the more important.

Different models can be detected at the level of the countries within the Alliance.

In the Netherlands, there is a Dutch Association of Consumers and Regulators which

brings together private companies, universities, regulators and other entities, with cyber

security as one of their purposes. In quite a number of countries (Spain, Italy, Romania),

there are civil society associations of critical infrastructure experts as well as

companies which can become models or actual partners in a deepening cyber security

partnership between competent stakeholders.

The role of the intelligence community is also an important factor for national

cyber security governance. There are several models and applications. For instance,

when embedding Computer Emergency Response Teams (CERT) or CSIRT (as part of

a cyber-security center), there is a binary choice: inside the intelligence community or

outside. This institutional arrangement subsequently determines to a large extent the

information sharing relations that the center can build and maintain. If part of the

intelligence community, the CERT – i.e. in Denmark's case – can share and receive

malware signatures and threat indicators from international partners that are either

intelligence services or linked to them. Much cybersecurity information in the

government sector is (unfortunately) over-classified, and these reports can only be

shared easily with partner intelligence services. If the CERT is outside, such as the

Dutch DefCERT and National Cyber Security Centrum (NCSC), then cooperation will

be easiest with other centers that are equally situated outside the intelligence

community. In general, for both sharing communities, the larger the group, the less

information that is shared.

Another important point is the concerns on the choice between clustering cyber

capacity, or differentiating by the mission. In the Netherlands, offense, defense and

intelligence are all separate, and each has its own legal regime. In Denmark, they are all

clustered into one unit, and the legal mandate depends on the activities executed. From

a legal, accountability and ethical perspective, differentiating by mission is the

principled choice and prevents boundaries between sectors and legal regimes blurring.

However, from a practical perspective, combining cyber offense and cyber defense is a

force multiplier, as the two approaches use similar techniques and software, operating

most effectively when in close contact with each other. In the US, but also in the UK,

information assurance and offensive cyber-operations are housed under the same roof

for these reasons.

Considering the availability of cyber knowledge and capacity within Ministries of

Defense, there is continued debate on their eventual role as a last resort in cyber crises.

Even if no military role is foreseen in protecting civilian critical infrastructure, Defense

could still be perceived as – and therefore in the time of crisis designated as – the last

resort security provider. NATO and the US Cyber Command, for instance, have

developed the concept of (rapid reaction) cyber teams that can be deployed to assist

(civilian) organizations that have suffered a cyber-attack. Considering that there are

many versions of SCADA-software, and that they can be extremely complex, each

specific to a sector or industry, it is not an efficient use of resources to recreate this

expertise in Defense cyber teams. It would be more effective to organize an inventory

U. Tatar et al. / Strategic Approach to a Fierce Domain8

of the specific IT-experts per critical infrastructure sector, and in a time of crisis use all

resources to facilitate getting the specific expert to the facilities that have been struck

by a cyber-attack. This could entail a role for Defense, such as using a military

helicopter to transport the IT-expert to where he is needed, but not as a ‘digital fire

service’ as is often alluded to in popular media.

Another example given was of a Civilian Cyber Corps formed in the US State of

Michigan by the Fire Department and the Michigan National Guard. One European

participant spoke of the potential for Gendarmerie institutions to assume such a role,

since they are already organized under military lines, but are also in quotidian contact

with the public and benefit from generally high levels of trust. The Gendarmerie, in

places like Romania, is already responsible, in the case of conflict, for securing critical

infrastructures and key points, as well as tracking infiltrators, to free up the military for

frontline combat. It would not be too much of a stretch to include it in activities related

to coordinating cyber security activities, building up capacity and acting as a useful

link between the fully military sphere and the civilian sphere.

Some participants stressed the value of new models that eschew formal institutions

and formalized cooperation in favor of informal and collaborative approaches. This

view is also set against the addition of new laws and institutional constructivism as

means of tackling new challenges. Rather, the informal approach is better suited to the

categories of challenges that are appearing now, of hybrid infrastructures whose

important human and organizational element represents a social aspect with which

regulators are ill-equipped to handle. Under this vision, a cyber-defense strategy would

first explore the limits of formal institutions and methods and use actor modeling to

construct collaborative structures and incentive structures.

The participants also highlighted the threat posed by the fragmentation of policy

initiatives – on part of the government may be pursuing policies actively being

undermined by another. For instance, the development of encryption technologies for

secure communications by activists, journalists and dissidents through the intercession

of one government entity is opposed by a security structure trying to prevent the cyber

arms race, especially with regards to countering surveillance. Other developments do

not fit into a good-bad dichotomy, where the means that the “bad guys” employ can be

distinguished from those of legitimate security structures. Many defensive and

legitimate developments become problematic depending on who is using them and for

what purpose, including offensively.

The importance of building ontologies to foster collaboration and information

sharing was emphasized by some of the participants. In order to more effectively

support collaborations between nations in the field of cybersecurity, there is a

significant need of a common language for facilitating communication and information

sharing between entities from different domains and from different nations. Ontologies

would be a promising solution. “An ontology is a formal, explicit specification of a

shared conceptualization”. The concepts, principles, methodologies, languages, and

tools of ontologies have been developed for knowledge sharing, information retrieval,

metadata annotation, and machine processing in AI, information science, and Semantic

Web communities. From informal (for human users) to formal (for machine users),

ontologies can offer shared vocabulary, concept taxonomy, information retrieval,

information classification, machine reasoning. Ontologies can be an effective and

efficient mean to facilitate collaborations and cross-domain information sharing among

Members and partners of NATO.

U. Tatar et al. / Strategic Approach to a Fierce Domain 9

剩余204页未读，继续阅读

啊哈_天问

粉丝: 7
资源: 55

多学科视角下的战略网络防御：北约高级研究工作坊论文集

Enterprise.Cybersecurity.1430260823

Strategic Database Marketing

集成电路的价值地位参考文献

html网页设计作品文字,40个以大文字排版的网页设计作品

关于用户的品牌态度的核心文献

Write a 1,000-word article with "cohesion to create a strategic fulcrum of a new development pattern"

三大渗透框架控制软件

List and explain the methods for selecting projects.

cobalt strike 4

最新资源