Hybrid Warfare & Cyber Defence Maj Gen Thomas FRANZ, DEU AF SHAPE DCOS CIS & CD
Characteristics of Hybrid Warfare Alternate means to achieve goals Lines blurred between: state-onstate wars, counterinsurgency conflicts, terrorism, cyber attacks Hybrid Warfare New and unfamiliar forms of warfare Cyber is a readily available tool for an adversary s tool kit Clausewitz: War is more than a true chameleon that slightly adapts its characteristics to the given cause Source: HYBRID WARFARE ASSESSMENT FOLLOW-ON TASKING FROM THE WALES SUMMIT, 7 Nov 2014 Hybrid Warfare, edited by Williamson Murray and Peter R. Mansoor, Cambridge University Press 2
Cyber Warfare vs. Hybrid Warfare Hybrid Warfare: Attacks on and from a variety of domains Land, Sea, Air, Cyber, InfoOps/StratComm Carried out by regular, irregular and clandestine forces More likely to be state sponsored More likely to be destructive in the physical and cyber realms Cyber Warfare: Attacks purely on and from the cyber domain Carried out by hackers, hactivists Could be state sponsored Could be non-destructive State-sponsored and Industrial-sponsored espionage 3
Russian Model for Cyber Defence Russian model for Cyber Defence differs from our own. Cyberspace as a subset of Information Warfare (IW) Information Troops within the Russian armed forces as Information Assurance and/or CyberOps Investment in Information Warfare troops, which actively participated during the Ukrainian crisis. Firepower of information attacks could be higher than that of conventional weapons Russian Military believe they must be prepared to effectively counter threats in cyberspace and to improve the level of protection of the relevant infrastructure 4
Defence is Always Behind Average Zero Day Exploit time-to-fix: ~230 days Online purchases for capabilities tend to be cheap and readily available Principal actors have significant resources Cyberwar in Ukraine Types of Attacks (Open Source Data) Symantec, 2012, FEYE, 2014, TREND Micro, 2012 5
What makes Cyber Attacks unique? Low cost of entry Difficulty in determining attribution of attack Easily available tools and expertise that can be bought or rented Cyber domain attack is easier than defence Differing national laws make catching and prosecuting cyber attackers very tough 6
Key Players NCIA (Technical Component) North Atlantic Council NATO HQ Committees Execution Decision Governance ACO (Military Component) NCI Agency (NCIRC) Supports prioritizes SHAPE NATO CIS Group Joint Force Command JFC Single Service Command SSC SSC Technical CD Service Provisioning Operational CD Planning 7
NATO Cyber Defence NATO primarily protects NATO s own networks Potential response to attacks in the cyber domain will be decided by NAC ACO response will be based on NAC authorization ACO works closely with NCIA during crises 8
ACO s Role in CD Consider Cyber in Operational Planning Conduct Operations in Cyber contested environments Maintain Cyber situational awareness Provide Cyber consequence management 9
NCI Agency und NCIRC Services NCIA = Technical Service Provider for NATO Cyber Defence - Prevention, Detection, Reaction and Recovery - Rapid Reaction Teams - Centralized Protection for Networks C2 arrangements SACEUR/NCI Agency guarantee effective support to operations Technical Achievements NCIRC FOC important step for NATO Cyber Defence Deployed CIS - Cyber Defence executed by NCISG (regional/ local) 10
Types of Incidents Lost or stolen computer hardware Computer facilitated fraud or hoax or scam Unauthorized access to, or modification of, system or data files Web site defacement Disruption or denial of service through electronic means Interception of electronically transmitted information Virus, worm or trojan infection Malicious probes or scams 11
ACO current work Consequence Management These are based on what-if scenarios How to continue military operations despite degradation in cyber capabilities Priority is to keep operations going, not to restore systems must have manual processes in place 12
ACO current work Situational Awareness over CD NCIRC Sensors Op Requirements/ Priorities Open Source Threat Intel Cyber Cyber SA SA Indications and Warnings IT Infrastructure IT Configuration, Incident and Vulnerability Management Safeguards 13
Summary Hybrid Warfare not new use of Cyber domain is new Cyber will likely play a role in future conflicts Adversaries will use the means (Cyber) where they have parity or an asymmetric advantage Establishing own protective measures is key NATO is actively working on CD integration into Alliance Ops & Missions 14
Questions? 15