COMMENTARY:
Many cybersecurity professionals and military strategists have anxiously awaited the public version of the Department of Defense’s Cyber Operations Strategy and on July 14 the wait ended when DoD released the 13 page document.
The document follows much of what has been talked about or insinuated in discussions that have taken place in the not so distant past. It breaks down the strategy into five distinct stratagems and initiatives that frame DoD’s operational intent.
Over the past year advances on each of these five stratagems have been made. This is an accomplishment that Deputy Secretary of Defense William Lynn was quick to acknowledge in remarks yesterday at National Defense University.
The document has drawn some sharp criticism, however.
One criticism is that DoD is trying to weaponize or militarize cyberspace. This has already taken place and it was not DoD who did it.
Others claim the document is at such a high level it offers little value for those who seek to critique DoD’s cyber strategy.
Perhaps the sharpest criticism came from the Vice Chairman of the Joint Chiefs, Gen. James Cartwright.
“Right now, we are on a path that is too predictable,” he said noting there is “no penalty for an attack now,” according to a report in Breaking Defense. He is also quoted as saying “This strategy talks more about how we are going to defend the networks. The next iteration will have to start to talk about here’s a strategy that says to the attacker if you do this, the price to you is going to go up.”
I would have to interpret these comments as a signal that we need to continue our current defensive posture with a new aggressive offensive stance added. Our passive approach where we sit there and allow recon of our systems and allow millions of hacking attempts a day has proven not to slow acts of cyber aggression.
The time has come to try something different and making our adversaries pay a price for attacking our critical systems is an excellent start.
This weekly blog will focus on cyber intelligence as it relates to the growing threat posed by acts of cyber aggression.
Kevin G. Coleman is a long-time security technology executive and former Chief Strategist at Netscape. He is Senior Fellow with the Technolytics Institute, where he provides consulting services on strategic technology and security issues.