Proactive cyber defence

Proactive cyber defense differs from active defence in that it is preemptive (not waiting for an attack to occur). Active cyber defense differs from offensive cyber operations (OCO) in that the latter requires legislative exceptions to undertake. Hence, offensive cyber capabilities may be developed in collaboration with industry and facilitated by the private sector; these operations are often led by nation states.

Methods and aims

Common methods of proactive cyber defense include cyber deception, attribution, threat hunting and adversarial pursuit. The mission of the pre-emptive and proactive operations is to conduct aggressive interception and disruption activities against an adversary using: psychological operations, managed information dissemination, precision targeting, information warfare operations, computer network exploitation, and other active threat reduction measures.

The proactive defense strategy is meant to improve information collection by stimulating reactions of the threat agents and to provide strike options as well as to enhance operational preparation of the real or virtual battlespace. Proactive cyber defence can be a measure for detecting and obtaining information before a cyber attack, or it can also be impending cyber operation and be determining the origin of an operation that involves launching a pre-emptive, preventive, or cyber counter-operation.

The offensive capacity includes the manipulation and/or disruption of networks and systems with the purpose of limiting or eliminating the adversary's operational capability. This capability can be required to guarantee one's freedom of action in the cyber domain. Cyber-attacks can be launched to repel an attack (active defence) or to support the operational action.

5 more chapters are free with a Lably account.

Cyber defense

Strategically, cyber defence refers to operations that are conducted in the cyber domain in support of mission objectives. The main difference between cyber security and cyber defence is that cyber defence requires a shift from network assurance (security) to mission assurance. Cyber defence focuses on sensing, detecting, orienting, and engaging adversaries in order to assure mission success and to outmanoeuver the adversary. This shift from security to defence requires a strong emphasis on intelligence, and reconnaissance, and the integration of staff activities to include intelligence, operations, communications, and planning.

Defensive cyber operations refer to activities on or through the global information infrastructure to help protect an institutions' electronic information and information infrastructures as a matter of mission assurance. Defensive cyber does not normally involve direct engagement with the adversary.

Active cyber operations refers to activities on the global information infrastructure to degrade, disrupt, influence, respond, and interfere with the capabilities, intentions, and activities of a foreign individual, state, organization, and terrorist groups. Active cyber defence decisively engages the adversary and includes adversarial pursuit activities.

In 1982, the United States Department of Defense (DoD) used "proactive" as a contrary concept to "reactive" in assessing risk. In the framework of risk management "proactive" meant taking initiative by acting rather than reacting to threat events. Conversely "reactive" measures respond to a stimulus or past events rather than predicting the event. Military science considers defence as the science-art of thwarting an attack. Furthermore, doctrine poses that if a party attacks an enemy who is about to attack this could be called active-defence. Defence is also a euphemism for war but does not carry the negative connotation of an offensive war. Usage in this way has broadened the concept of proactive defence to include most military issues including offensive, which is implicitly referred to as active-defence. Politically, the concept of national self-defence to counter a war of aggression refers to a defensive war involving pre-emptive offensive strikes and is one possible criterion in the 'Just War Theory'. Proactive defence has moved beyond theory, and it has been put into practice in theatres of operation. In 1989 Stephen Covey's study transformed the meaning of proactive as "to act before a situation becomes a source of confrontation or crisis". Since then, "proactive" has been placed in opposition to the words "reactive" or "passive".

Context

The National Strategy to Secure Cyberspace, a book written by George W. Bush, was published in February 2003 outlining the initial framework for both organizing and prioritizing efforts to secure the cyberspace. It highlighted the necessity for public-private partnerships. In this book, proactive threads include the call to deter malicious activity and prevent cyber attacks against America's critical infrastructures.

As one of the founding members of Canada's interdepartmental committee on Information Warfare, Dr. Robert Garigue and Dave McMahon pointed out that "strategic listening, core intelligence, and proactive defence provide time and precision. Conversely, reacting in surprise is ineffective, costly and leaves few options. Strategic deterrence needs a credible offensive, proactive defence and information peacekeeping capability in which to project power and influence globally through Cyberspace in the defence of the nation. Similarly, deterrence and diplomacy are required in the right dosage to dissuade purposeful interference with the national critical cyber infrastructures in influence in the democratic process by foreign states.

Vulnerabilities equities

Intelligence agencies, such as the National Security Agency, were criticized for buying up and stockpiling zero-day vulnerabilities and keeping them secret and developing mainly offensive capabilities instead of defensive measures and, thereby, helping patch vulnerabilities. This criticism was widely reiterated and recognized after the May 2017 WannaCry ransomware attack.

Proactive pre-emptive operations

The notion of a proactive pre-emptive operations group (P2OG) emerged from a report of the Defense Science Board's (DSB) 2002 briefing. The briefing was reported by Dan Dupont in Inside the Pentagon on September 26, 2002, and was also discussed by William M. Arkin in the Los Angeles Times on October 27, 2002. The Los Angeles Times has subsequently quoted U.S. Secretary of Defense Donald Rumsfeld revealing the creation of the "Proactive, Pre-emptive Operations Group". The mission was to conduct Aggressive, Proactive, Pre-emptive Operations to interdiction and disruption the threat using: psychological operations, managed information dissemination, precision targeting, and information warfare operations. Today, the proactive defence strategy means improving information collection by stimulating reactions of the threat agents, provide strike options to enhance operational preparation of the real as well as virtual battle space. The P2OG has been recommended to be constituted of one hundred highly specialized people with unique technical and intelligence skills. The group would be overseen by the White House's deputy national security adviser and would carry out missions coordinated by the secretary of defence. Proactive measures, according to DoD are those actions taken directly against the preventive stage of an attack by the enemy.

International relations perspectives

The discipline of world politics and the notions of pre-emptive cyber defence topics are the two important concepts that need to be examined because we are living in a dynamic international system in which actors (countries) update their threat perceptions according to the developments in the technological realm. Given this logic employed frequently by the policymakers, countries prefer using pre-emptive measures before being targeted. This topic is extensively studied by the political scientists focusing on the power transition theory (PTT), where Organski and Kugler first discussed that powerful countries start the attack before the balance of power changes in favor of the relatively weaker but the rising state. Although the PTT has relevance to explain the use of pre-emptive cyber defence policies, this theory can still be difficult to apply when it comes to cyber defence entirely because it is not easy to understand the relative power differentials of the international actors in terms of their cyber capabilities. On the other hand, we can still use the PTT to explain the security perceptions of the United States and China, as a rising country, in terms of their use of pre-emptive cyber defence policies. Many scholars have already begun to examine the likelihood of cyber war between these countries and examined the relevance of the PTT and other similar international relations theories.