Pdf lachow anu

© 2017 The MITRE Corporation. All rights reserved.
| 1 |
Approved for Public Release; Distribution Unlimited. Case Number 17-2636
Dr. Irv Lachow
Portfolio Manager, International Cybersecurity, MITRE
Visiting Fellow, The Hoover Institution, Stanford University
July 13, 2017
The Promise and Peril of
Active Cyber Defense

| 2 |
© 2017 The MITRE Corporation. All rights reserved. For Internal MITRE Use.
Disclaimer
▪ The author's affiliation with The MITRE Corporation is
provided for identification purposes only, and is
not intended to convey or imply MITRE's concurrence
with, or support for, the positions, opinions, or
viewpoints expressed by the author.

| 3 |
Agenda
▪ Active Cyber Defense Primer
▪ Policy Issues
▪ References
▪ Discussion

| 4 |
Why Is Active Cyber Defense Important?
▪ Governments alone cannot protect the private sector
▪ Companies are increasingly capable of taking active
steps to defend themselves—and are doing so
▪ Current legal and policy guidance is "absent, vague
or difficult to operationalize."
– Governments are effectively blocking companies from taking action
▪ Two most likely outcomes are undesirable:
– Companies do nothing
– Wild West

| 5 |
What Does “Active Cyber Defense” Mean?
▪ Center for Cyber and Homeland Security
– Active defense is a term that captures a spectrum of proactive
cybersecurity measures that fall between traditional passive defense
and offensive….the term is NOT synonymous with “hacking back.”
(Emphasis added.)
▪ Hoffman and Levite (from Robert Dewar)
– An approach to achieving cybersecurity predicated upon the
deployment of measures to detect, analyze, identify and mitigate
threats…combined with the capability and resources to take proactive
or offensive action against threats…
▪ DARPA
– DARPA’s Active Cyber Defense (ACD) program is designed
to…[provide] cyber defenders a “home field” advantage: the ability to
perform defensive operations that involve direct engagement with
sophisticated adversaries in DoD-controlled cyberspace.

| 6 |
Examples of ACD Actions
Source: CCHS

| 7 |
Benefits and Risks of ACD Actions
Source: Hoffman and Levite

| 8 |
ACD Activities Involve Risk Tradeoffs

| 9 |
In Theory ACD Risks Can be Quantified

| 10 |
Agenda
▪ Policy Issues
▪ References
▪ Discussion

| 11 |
Key Policy and Legal Questions
▪ Who can do ACD?
▪ What can they do?
▪ When can they do ACD?
▪ Who is help responsible when…?
▪ How address int’l aspects?
▪ How address technical developments?

| 12 |
Legal Frameworks: Not Much Help
▪ National Laws vary considerably but most prevent
the bulk of ACD activities
– Example: United States' Computer Fraud and Abuse Act
▪ International Laws
– "Formal international treaties have no apparent direct application
to the [ACD] questions being considered."
▪ Which legal models are most applicable?
▪ This lack of guidance needs to be addressed…
Source: Lachow, CCHS, Rosenzweig

| 13 |
Principles-Based Approach (Market Driven)
▪ The Concept
– Create normative principles
for ACD behaviors
▪ Risk-based
▪ Formalized via industry-driven
code of conduct
– Use market-based
mechanisms to enforce
desired behaviors
▪ Insurance industry
▪ Civil torts
▪ Advantages
– Relies on incentives to drive
behavior
– Balances risks
– Adaptable to dynamic
environment
▪ Challenges
– Legal authority is still needed
– Actions can have global
consequences
– Markets sometimes fail

| 14 |
Government-Licensed Private Security
▪ The Concept:
– Only authorized firms are
allowed to conduct ACD
– Licensing requirements set
by each country
– Allowed actions would fall
short of most aggressive
ACD techniques
– Close cooperation with gov’t
authorities
▪ Advantages
– Clear limits about allowable
actions
– Lower risk of collateral
damage and escalation
– Improved public-private
cooperation
▪ Challenges
– Licensing process
– Oversight process
– Coordination across nations
– State-sanctioned activity
Source: Rosenzeig

| 15 |
“ACD Policy Framework”
▪ Fifteen recommended steps for U.S. industry,
Executive Branch, and Congress
▪ Key themes
– Define range of acceptable actions that balance efficacy and risk
– Update legal instruments to reflect balanced approach
– Work towards global standards across nations
– Strengthen public-private cooperation
– Create set of best practices that are promulgated across industry
Source: CCHS

| 16 |
Consensus Findings
▪ Private sector needs to be given more authority to act
▪ ACD actions need to balance benefits and risks
▪ Legal clarity is necessary if not sufficient
▪ International aspects may be most challenging
▪ Government and industry cooperation is essential

| 17 |
Agenda
▪ Policy Issues
▪ References
▪ Discussion

| 18 |
Key References
▪ Center for Cyber & Homeland Security (CCHS). Into the Grey Zone: The
Private Sector and Active Defense Against Cyber Threats: Washington,
DC, The George Washington University, 2016.
▪ Croom, Charles, “The Cyber Kill Chain: A Foundation for a New Cyber
Security Strategy,” High Frontier 6, No. 4 (2010): 52-56.
▪ Hoffman, Wyatt and Ariel E. Levite. Private Sector Cyber Defense: Can
Active Measures Help Stablize Cyberspace: Washington, DC, Carnegie
Endowment for International Peace, 2017.
▪ Lachow, Irving. Active Cyber Defense: A Framework for Policymakers:
Washington, DC, Center for a New American Security, 2013.
▪ Rosenzweig, Paul, Steven P. Bucci and David Inserra. Next Steps for
U.S. Cybersecurity in the Trump Administration: Active Cyber Defense,
Backgrounder, No 3188: Washington, DC, The Heritage Foundation,
2017.

| 19 |
Agenda
▪ Policy Issues
▪ References
▪ Discussion

| 20 |
Questions?
Comments?
Ideas?

| 21 |
UK’s Government ACD Program
▪ Goal: “tackle, in [an] automated way, a significant
proportion of the cyber attacks that hit the UK.”
▪ Led by National Cyber Security Centre
▪ Program elements
– Strengthen infrastructure protocols
– Secure email
– Take down criminal websites
– Filter DNS
– Strengthen identity authentication
Source: National Cyber Security Centre

| 22 |
ACD Techniques Most Useful Against
Advanced Adversaries
▪ Cyber “hygiene” can thwart most criminal activity
▪ ACD requires time and effort and carries risks
Source: Lachow and Croom

Pdf lachow anu

More Related Content

Similar to Pdf lachow anu (20)

Recently uploaded (20)

Pdf lachow anu