US & China Are Escalating Their Cyber War

defense-large.jpg

Threet & Response: A Snapshoy of the Cyberwar.

"Admiral, is China an adversary?" On July 30, U.S. Republican Senator Tom Cotton asked that question to Adm. John Richardson, who is President Barack Obama's nominee to be the next chief of naval operations. 
Heretofore, the most common answer in official Washington to that question has been to describe China as a competitor, not an adversary. Richardson avoided a straight answer; he said China was "a complex nation," doing some things that possessed an "adversarial nature." But by declining to give the standard response, Richardson may have signaled a transition in official thinking to the view that China is in fact an adversary.
The Obama administration now faces a critical decision on two flashpoints created by Chinese aggression. The first is how the United States government will respond to the cyber intrusion into the Office of Personnel Management (OPM) database, an attack that resulted in the theft of over 20 million government personnel records. The administration has reached a series of conclusions regarding the OPM hack that represents a significant departure from past practices. 
In the wake of the OPM data breach, establishing cyber deterrence with China will require inflicting punishment on their decision-makers in a way that harms their interests (in order to demonstrate that it is possible to do so), and promising more to come if these decision-makers don't change their behavior. And that will likely require much sterner measures than the diplomatic protests and Justice Department indictments that have thus far had no discernible effect. Critics of retaliation will protest that a response will only result in an escalating cyber war between the two countries, with the United States more exposed to the damage that would bring. 
The second flashpoint is of course Chinese activities in the South China Sea. According to a recent article in Politico, a civil-military dispute is now simmering between Navy officers and officials at US Pacific Command (PACOM) and advisers at the White House. Military officials want a clear demonstration of freedom of navigation near China's outposts in the Spratly Island chain but are meeting resistance from White House advisers, who are seemingly reluctant to create a flare-up in the region, especially in advance of Chinese President Xi Jinping's visit to the United States in September.
US officials refuse to say whether US warships or aircraft have sailed or flown within 12 nautical miles of any of the seven Chinese artificial islands in the Spratlys. According to the United Nations Convention on the Law of the Sea (UNCLOS) (which China has ratified and the United States has not), artificial structures built on submerged features, which describes at least six of China's seven outposts, do not possess the 12 nautical mile territorial right. Querulous Navy and PACOM officials are concerned that a failure to defend the law with a visible demonstration will result in the gradual acceptance of China's territorial claims in the sea.
This is not a new issue but recent events have stepped up the urgency of a response. Having largely completed its dredging and land reclamation at its seven sites in the Spratlys, the next phase for China will be further structural improvements such as more offices, barracks, piers, warehouses, aircraft hangers, and military equipment. 
The United States and its partners will undoubtedly have to reckon some day with Chinese missiles in the Spratlys. But establishing the initial legal precedent of freedom of navigation by sailing and flying within 12 nautical miles of China's sand piles will be an easier decision before those missile are installed.
The upcoming summit between Obama and Xi may be the last chance to prevent China's slide from competitor to adversary. That chance is slim. China seems committed to both its cyber espionage program and its territorial expansion in East Asia on its "blue soil." We can now see in retrospect that America's long-standing, bipartisan policy of forbearance toward China has accelerated the slide and therefore should be seen as totally discredited.
Judging by media reporting, the Obama administration seems to have endorsed the principle of deterrence, enforced through punishment, to protect US interests in cyberspace. What remains unknown is how much punishment, and in what forms, the United States will have to deliver in order to establish deterrence. 
Chinese leaders are likely to presume they possess significant comparative advantages in the cyber domain, which means that retaliation and escalating cyber duels are possible. Applying deterrence theory to the cyber domain presents far more questions than answers. This does not mean that deterrence is not the right approach for the US government to take. But once on this course we should expect some surprising departures from past experiences. Finally, we should not be surprised if "cyber non-combatants" suffer some collateral damage once hostile network packets start flying in all directions.
As with the looming cyber war, such a US demonstration in the South China Sea would be merely the next move in an open-ended game. What will follow are deeper examinations about whether the United States and its partners in the region are prepared to compete in the game, and how policymakers and military leaders on all sides expect to either control escalation or attempt to use escalation to their advantage. A question no one will be asking at that point is whether China is an adversary.
Ein News:  http://bit.ly/1hPOcNG

 

« Cognitive Computing: What Can and Can’t Be Done.
Hit List: ISIS 'hacking division' Releases Details of 1,400 Military & Government Personnel. »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Team Cymru Research NFP

Team Cymru Research NFP

Team Cymru Research is a group of technologists passionate about making the Internet more secure and dedicated to that goal.

RiskSense

RiskSense

RiskSense empowers enterprises and governments to reveal cyber risk, quickly orchestrate remediation, and monitor the results.

CERTuy

CERTuy

CERTuy is the national Computer Emergency Response Team for Uruguay.

Pindrop Security

Pindrop Security

Pindrop solutions are leading the way to the future of voice by establishing the standard for security, identity, and trust for every voice interaction.

SIGA

SIGA

SIGA provides cyber security solutions for Industrial Control Systems SCADA systems used in critical infrastructures and industrial processes.

SANS CyberStart

SANS CyberStart

SANS CyberStart is a unique and innovative suite of tools and games designed to introduce children and young adults to the field of cyber security.

Six Degrees

Six Degrees

Six Degrees is a leading secure, integrated cloud services provider. We protect UK organisations and help them thrive in the cloud by giving them secure platforms to innovate and grow.

TechArch

TechArch

TechArch helps customers to optimize their investments in cybersecurity by providing them independent and vendor-neutral consultation and guidance.

IberLayer

IberLayer

IberLayer is the company behind the Email Guardian service, a cloud based Email Total Protection system that filters and blocks email threats.

VaultOne

VaultOne

VaultOne is a next-generation security solution that addresses security issues from different domains (Password Manager, Secure Access, PAM, Identity Management) as a single, integrated solution.

Navaio IT Security

Navaio IT Security

Navaio helps clients with IT Security related challenges with a primary focus on Identity and Access Management, Data Governance, User Awareness and Cyber Resilience Services.

Abion

Abion

At Abion (formerly BRANDIT), we empower your business by providing comprehensive brand protection and web security services.

Com Laude

Com Laude

Com Laude is a domain name management company that provides strategic consulting to help companies strengthen digital brand, safeguard customers & protect brand IP.

Netography

Netography

Netography provides a scalable and reliable platform for detection & remediation of cyber threats found on your network.

US Army Cyber Command (ARCYBER)

US Army Cyber Command (ARCYBER)

US Army’s Cyber Command (ARCYBER) is engaged in the real-world cyberspace fight today, against near-peer adversaries, ISIS, and other global cyber threats.

Nullify

Nullify

Nullify is your automated security sentry that continuously finds and fixes security issues across your codebase.