US Cyber Command Is A Tool Of Foreign Policy

The US National Security Strategy announced by President Trump at the end of 2017 was aimed at “redefining its cyber security mission” and stemming the tide of nation-state attacks on the US. This  has include the open use of cyber weapons to influence,deter and punish other nation states.

Much of the information we have about recent US cyber activities has come from unnamed, but most likely authorised, government sources which have been used as a foreign policy too to signal to adversaries that certain actions are infringing upon US national interests. 

By 2013 US domestic networks were overwhelmed by  constant attack from sophisticated nation-state actors. Hackers stole millions of sensitive records from the Office of Personnel Management, gained access to White House networks and destroyed dozens of computers at Sony Pictures from thousands of miles away. At that time the US Department of Defense’s own cyber teams couldn’t hit back or work on enemy networks abroad because the rules for such operations were incredibly stringent. In fact, one US senator said DoD didn’t conduct an offensive operation for five years. 

That’s not to say the United States sat idly by in cyberspace, experts pointed to covert strikes and intrusions, but it does mean the Pentagon rarely or never used cyber operations as an overt response or to flex its power.

The way Cyber Command meets those goals is through persistent engagement, which means challenging adversary activities wherever they operate, however, cyber tools and networks are a limited commodity; publicising them makes them harder to use a second time. The hope is that using this scarce commodity effectively will persuade potential challengers of American resolve.  

This represents a shift from the Obama administration, which was far more reticent to combine covert cyber activities with more overt signaling. Surely, the United States undertook secret operations to degrade, disrupt, destroy, manipulate, operations in cyberspace. The most famous Obama-era cyber operation was Stuxnet, a worm that caused Iranian nuclear centrifuges to tear themselves apart.  Obama Administration officials engaged only reluctantly in overt signaling. They officially denied involvement, only talking with select reporters on deep background and after the operation was being discussed in the media.

In comparison, the Trump administration is  more openly using cyberspace activities to signal to adversaries that when certain lines are crossed it will result in consequences. 

Examples include operations against Iran after the Saudi oil attack in August 2019 and after the drone downing in September; and operations against Russia after the 2018 midterm elections.

The administration is clearly signaling to Russa in its efforts to deter Moscow’s meddling in the 2020 elections. Officials have told media outlets of efforts to develop information warfare tactics that target Russia’s senior leaders and elites. Such open declarations represent even larger costs because they cannot be easily backed away from. If it works and the threat proves credible enough to deter Russian meddling in the upcoming elections, the US will likely continue with this type signaling

The new philosophy has engendered praise, criticism and confusion among experts. One lawmaker said the White House is stonewalling oversight of the new operations. Academics have questioned whether the strategy will indeed slow hacking from the United States’ enemies. 

Because of the sensitivity of operational details, the Pentagon rarely discusses how the new strategies have worked. But based on interviews with military officials and several cyber experts this is the story of how, in two years, a new strategy is forcing the national security community to rethink cyber operations and the strategy’s long-term effects.

Ultimately, cyber is one tool in the US arsenal and experts have cautioned that it will be hard to point directly to a more assertive cyber posture as the one thing that changes the calculus of adversaries.

New Statesman:       Fifth Domain:            Defense One:

You Might Also Read:

Shockwave - A Global Transformation In Warfare:

 

« Electric Grids Targeted For Cyber Attacks
Cyber Stocks Soaring From Conflict With Iran »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Acuity Risk Management

Acuity Risk Management

Acuity Risk Management helps businesses worldwide effectively manage, prioritize and report on their risks to inform strategic and tactical decision-making and build long-term resilience.

Kaseya

Kaseya

Kaseya is a premier provider of unified IT management and security software for managed service providers (MSPs) and small to medium-sized businesses (SMBS).

LogonBox Software

LogonBox Software

LogonBox Software specialises in producing a cost-effective range of Network Security and Identity Management software solutions for all sizes of Enterprise.

mnemonic

mnemonic

mnemonic helps businesses manage their security risks, protect their data and defend against cyber threats.

Elastic

Elastic

Elastic is the world's leading software provider for making structured and unstructured data usable in real time for search, logging, security, and analytics use cases.

Altaro Software

Altaro Software

Altaro provide backup solutions that are intuitive, easy to use, well-priced and backed by outstanding 24/7 support as part of the package.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Madrona Venture Group

Madrona Venture Group

Madrona Venture Group invests in seed and early-stage technology companies in areas including cybersecurity.

Maritime Cyber Threats Research Group - University of Plymouth

Maritime Cyber Threats Research Group - University of Plymouth

The Maritime Cyber Threats research group of the University of Plymouth is focused on investigating marine cyber threats and researching solutions.

National Cybersecurity Consortium (NCC) - Canada

National Cybersecurity Consortium (NCC) - Canada

The NCC’s mandate is to keep Canada’s cyber and critical infrastructures and citizens safe while ensuring Canada’s global competitiveness and leadership in cybersecurity.

Pillar Technology Partners

Pillar Technology Partners

Pillar Technology Partners is an Information Security Company with a focus on improving Cyber Risk and optimizing the processes and technology that underpin the security of your information assets.

Cyberani Solutions

Cyberani Solutions

Cyberani Solutions was created to fulfill the cybersecurity needs of industry and government in Saudi Arabia, and across the Middle East and North Africa regions.

PatchAdvisor

PatchAdvisor

PatchAdvisor core services include Vulnerability Assessments/Penetration Testing, Application Vulnerability Assessments, and Incident Response.

Archer Technologies

Archer Technologies

Archer helps organizations manage risk in the digital era—uniting stakeholders, integrating technologies and transforming risk into reward.

Abissi

Abissi

Abissi offer cyber intelligence, IoT security, automotive security, red teaming, application security and artificial intelligence security services, with a focus on security by design.

JustunSecure

JustunSecure

JustunSecure is dedicated to promoting information technology and cybersecurity in Africa.