NATO’s central missions of collective defense and cooperative security must be as effective in cyberspace as
they are in the other domains of air, land, sea, and space. The Alliance started this process after suffering its first major cyber attacks in 1999, during Operation Allied Force, but more than a decade later it is still playing catch up. The recent NATO cyber defense policy gives the Alliance a strong boost, giving priority to defense of NATO’s own networks. But now the Alliance should “double down” on a core set of priorities, leveraging the best capabilities, policies, and practices from member nations and industry partners
.... Read full report at
http://www.acus.org/files/publication_pdfs/403/022712_ACUS_NATOSmarter_IBM.pdf
Recommendations:
To develop cyber capabilities, NATO should focus its efforts on the following areas. These first seven recommendations are general and could apply to any military organization facing challenges in cyberspace.
1. Pursue a relevant standard, such as the widely understood ISO/IEC 27001 and 27002 or the newer RMM, which has more focus on performance during crises.
2. Invest resources in the basics. Incident response, information sharing, resilience, properly maintaining
computers to “patch” them from being vulnerable, and generally executing the new strategy.
3. Emphasize agility. It was only fifteen years from the first flight of an airplane to the battle of Saint-Mihiel, the first coordinated air operation, under a single commander and in support of a ground attack. Though we have over twice that many years experience in cyberspace, we do not yet have a similar understanding of what cyber conflict will eventually look like or how national militaries – much less NATO – should organize for it. This means militaries will need to remain agile. Options might include a heavier than normal reliance on capabilities from national members; learning to quickly procure and secure commercial IT systems; pooling and sharing; and collaboration with the private sector (see below).
4. Learn to fight through intrusions. Neither NATO, nor the militaries of its member nations, will be able to
keep adversaries from intruding during a cyber conflict. As stated in the new US Department of Defense cyber strategy: “Operating with a presumption of breach will require DoD to be agile and resilient, focusing its efforts on mission assurance and the preservation of critical operating capability.” In line with the 2009 Strasbourg Summit Declaration, NATO exercises must fully integrate cyber into all its exercises and train to work through disruptions. Just as air forces must fly and fight through hostile jamming, so must militaries also be able to operate when adversaries are inside their perimeter in cyberspace.
5. Develop and research advanced capability to stay ahead of the evolving threats. Investment into research
and the next generation of security intelligence capability is needed but advanced security analytics – coupled with automation – will be required including through the existing Science for Peace and Security Program.
6. Develop an agenda for private sector collaboration, not just for information sharing, but in more substantive
ways as well. Many non-governmental organizations have significant capabilities to fight cyber crime, respond to incidents, and foster cooperation with other nations, making it productive and cost effective for NATO to collaborate. While the current policy says that NATO “will work with partners, international organizations, academia, and the private sector in a way that promotes complementarity and avoids duplication,” this actually requires agility, fresh thinking and, above all, a plan to tie together efforts like the existing Framework for Collaborative Interaction, established by NATO’s Allied Command Transformation.
7. Treat cyber conflict as a national security problem for policymakers, not just a technical issue for computer security professionals. Policy makers must demand options that do not rely on exact attribution, such as ratcheting pressure against national leaders that encourage attacks,
whether or not those attacks can be traced to that nation’s infrastructure. In addition, at the Chicago Summit of 2012, NATO should support important cyber norms, such as that
any alliance cyber operations will conform to the Laws of Armed Conflict and that NATO will not use or encourage third-party, non-state proxies to conduct cyber attacks on
its behalf.
The following ideas are specific to NATO:
8. Explore how a “phased adaptive” approach might apply to cyber defense. Though the parallels to missile
defense are imperfect, NATO should consider structuring their future cyber defense plans into multiple phases
depending on future threats and technologies. Phase 1 might improve NATO’s own defenses, while Phase 2
extends these to national militaries. Later phases could include sharing information with the EU, infrastructure
providers, or erecting a cyber umbrella of warning and defenses.
9. Push multinational sharing of baseline capabilities. NATO may not need a separate IT schoolhouse for
each nation’s military or service or separate national IT procurement programs, as Allies use the same Internet
for similar purposes and purchase generally identical computers and switches. If nations can share aircraft
carriers then there are likely obvious options to share and pool cyber capabilities. NATO must develop a mechanism in the medium term to connect military and civilian ministries.
12. Consider offensive coordination, not capability. When the US military started exploring offensive cyber
capabilities, it began with small, embedded units who knew both traditional and cyber military operations – and had the proper clearances. During future crises NATO might consider creating an ad hoc coordination cell. These officers should apply, but not necessarily share, their knowledge of sensitive capabilities to help communicate the objectives of the Alliance’s operational commanders to
their relevant national cyber units. This coordination group might be similar to the US Air Forces Cyber Operations Liaison Element. In addition, as suggested by the Atlantic Council’s Franklin Miller, NATO should consider creating a group, modeled on NATO’s existing Nuclear Planning Group, to consider offensive cyber policy
Click here to read more ....
Solutions :
www.xcyss.in
