Experts Debate Cyberwar Defense

Marcus Ranum and James Lewis wrote competing op-eds on cyberwar last week, but I think they agree on more than they let on.

Ranum, an expert on security system design and chief security officer for Tenable Network Security, is deeply cynical about using warfare rhetoric for cyber threats. If my interpretation of his argument is correct, Ranum believes only those with something to grain preach the danger of cyberwar. Additionally, countries with the resources to crash U.S. systems (China and Russia) would have to be stupid to do so because it would only make their own economies and systems vulnerable. He has a point, and to this end, Lewis seems to agree.

Lewis, a senior fellow and program director at the Center for Strategic and International Studies, takes a little drama out of the debate when he puts cyberwar into perspective: "Cyberwar is the use of attacks in cyberspace to erode an opponent's will and capabilities to resist."

The definition is important because it makes the distinction Ranum was after; cyberwar is not a means to an end, it's a way to put an end to the end. In other words, countries use cyberspace to steal not to attack, and only a ground war is likely to change that. But just because cyberattacks don't necessarily add up to cyberwar doesn't mean Ranum and Lewis agree on the best way to protect U.S. systems. Ranum states the only defense is a good defense. Lewis sticks with the old saying the best defense is a strong offense. I think they're both right.

Cyber espionage, the main issue at hand, could benefit from a good defense, but it would be naive to think the United States couldn't benefit from a good offense as well. The logic actually follows a similar line of reasoning for why cyberwar will likely never come to fruition; If competing countries know all they need to know about each others systems, there's no advantage to having the information. The threats cancel themselves out.

Therefore the best defense is a good offense. Conversely, if a country can keep its classified data safer than another, an advantage is achieved. Therefore the best defense is the best defense. Both arguments work for me, but do they work for you? Discuss in the comments field.

You can reach Adam Ross at aross@nextgov.com.