ebook img

Proceedings of a Workshop on Deterring Cyberattacks PDF

401 Pages·2010·3.076 MB·English
Save to my drive
Quick download
Download
Most books are stored in the elastic cloud where traffic is expensive. For this reason, we have a limit on daily download.

Preview Proceedings of a Workshop on Deterring Cyberattacks

Proceedings of a Workshop on Deterring CyberAttacks: Informing Strategies and Developing Options for U.S. Policy Proceedings of a WorkshoP on deterring cyberattacks Informing Strategies and Developing Options for U.S. Policy Committee on Deterring Cyberattacks: Informing Strategies and Developing Options for U.S. Policy Computer Science and Telecommunications Board Division on Engineering and Physical Sciences Policy and Global Affairs Division Copyright © National Academy of Sciences. All rights reserved. Proceedings of a Workshop on Deterring CyberAttacks: Informing Strategies and Developing Options for U.S. Policy THE NATIONAL ACADEMIES PRESS 500 Fifth Street, N.W. Washington, DC 20001 NOTICE: The project that is the subject of this report was approved by the Governing Board of the National Research Council, whose members are drawn from the councils of the National Academy of Sciences, the National Academy of Engineering, and the Institute of Medicine. The members of the committee that oversaw this project were chosen for their special competences and with regard for appropriate balance. Support for this project was provided by the Office of the Director of National Intelligence under award number HHM402-05-D0011, DO #12. Any opinions, findings, conclusions, or recommendations expressed in this publica- tion are those of the authors and do not necessarily reflect the views of the organization that provided support for the project. International Standard Book Number-13: 978-0-309-16035-3 International Standard Book Number-10: 0-309-16035-9 Additional copies of this report are available from: The National Academies Press 500 Fifth Street, N.W., Lockbox 285 Washington, DC 20055 (800) 624-6242 (202) 334-3313 (in the Washington metropolitan area) Internet: http://www.nap.edu Copyright 2010 by the National Academy of Sciences. All rights reserved. Printed in the United States of America Copyright © National Academy of Sciences. All rights reserved. Proceedings of a Workshop on Deterring CyberAttacks: Informing Strategies and Developing Options for U.S. Policy The National Academy of Sciences is a private, nonprofit, self-perpetuating society of distinguished scholars engaged in scientific and engineering research, dedicated to the furtherance of science and technology and to their use for the general welfare. Upon the authority of the charter granted to it by the Congress in 1863, the Academy has a mandate that requires it to advise the federal government on scientific and technical matters. Dr. Ralph J. Cicerone is president of the National Academy of Sciences. The National Academy of Engineering was established in 1964, under the charter of the National Academy of Sciences, as a parallel organization of outstanding engineers. It is autonomous in its administration and in the selection of its members, sharing with the National Academy of Sciences the responsibility for advising the federal government. The National Academy of Engineering also sponsors engineering programs aimed at meeting national needs, encourages education and research, and recognizes the superior achievements of engineers. Dr. Charles M. Vest is president of the National Academy of Engineering. The Institute of Medicine was established in 1970 by the National Academy of Sciences to secure the services of eminent members of appropriate professions in the examination of policy matters pertaining to the health of the public. The Institute acts under the responsibility given to the National Academy of Sciences by its congressional charter to be an adviser to the federal government and, upon its own initiative, to identify issues of medical care, research, and education. Dr. Harvey V. Fineberg is president of the Institute of Medicine. The National Research Council was organized by the National Academy of Sciences in 1916 to associate the broad community of science and technology with the Academy’s purposes of furthering knowledge and advising the federal government. Functioning in accordance with general policies determined by the Academy, the Council has become the principal operating agency of both the National Academy of Sciences and the National Academy of Engineering in providing services to the government, the public, and the scientific and engineering communities. The Council is administered jointly by both Academies and the Institute of Medicine. Dr. Ralph J. Cicerone and Dr. Charles M. Vest are chair and vice chair, respectively, of the National Research Council. www.national-academies.org Copyright © National Academy of Sciences. All rights reserved. Proceedings of a Workshop on Deterring CyberAttacks: Informing Strategies and Developing Options for U.S. Policy Copyright © National Academy of Sciences. All rights reserved. Proceedings of a Workshop on Deterring CyberAttacks: Informing Strategies and Developing Options for U.S. Policy COMMITTEE ON DETERRINg CybERATTACkS: INFORMINg STRATEgIES AND DEvELOPINg OPTIONS FOR u.S. POLICy JOHN D. STEINBRUNER, University of Maryland, Chair STEVEN M. BELLOVIN, Columbia University STEPHEN DYCUS, Vermont Law School SUE ECKERT, Brown University JACK L. GOLDSMITH III, Harvard Law School ROBERT JERVIS, Columbia University JAN M. LODAL, Lodal and Company PHILIP VENABLES, Goldman Sachs Staff HERBERT S. LIN, Study Director and Chief Scientist, Computer Science and Telecommunications Board TOM ARRISON, Senior Program Officer, Policy and Global Affairs Division VIRGINIA BACON TALATI, Associate Program Officer  Copyright © National Academy of Sciences. All rights reserved. Proceedings of a Workshop on Deterring CyberAttacks: Informing Strategies and Developing Options for U.S. Policy COMPuTER SCIENCE AND TELECOMMuNICATIONS bOARD ROBERT F. SPROULL, Oracle, Chair PRITHVIRAJ BANERJEE, Hewlett Packard Company STEVEN M. BELLOVIN, Columbia University WILLIAM J. DALLY, NVIDIA Corporation and Stanford University SEYMOUR E. GOODMAN, Georgia Institute of Technology JOHN E. KELLY III, IBM JON M. KLEINBERG, Cornell University ROBERT E. KRAUT, Carnegie Mellon University SUSAN LANDAU, privacyink.org DAVID E. LIDDLE, U.S. Venture Partners WILLIAM H. PRESS, University of Texas PRABHAKAR RAGHAVAN, Yahoo! Research DAVID E. SHAW, Columbia University ALFRED Z. SPECTOR, Google, Inc. JOHN A. SWAINSON, Swainson Analysis Services, Inc. PETER SZOLOVITS, Massachusetts Institute of Technology PETER J. WEINBERGER, Google, Inc. ERNEST J. WILSON III, UUnniivveerrssiittyy ooff SSoouutthheerrnn CCaalliiffoorrnniiaa Staff JON EISENBERG, Director RENEE HAWKINS, Financial and Administrative Manager HERBERT S. LIN, Chief Scientist, CSTB LYNETTE I. MILLETT, Senior Program Officer EMILY ANN MEYER, Program Officer ENITA A. WILLIAMS, Associate Program Officer VIRGINIA BACON TALATI, Program Associate SHENAE BRADLEY, Senior Program Assistant ERIC WHITAKER, Senior Program Assistant For more information on CSTB, see its Web site at http://www.cstb.org, write to CSTB, National Research Council, 500 Fifth Street, N.W., Washington, DC 20001, call (202) 334-2605, or e-mail the CSTB at [email protected]. i Copyright © National Academy of Sciences. All rights reserved. Proceedings of a Workshop on Deterring CyberAttacks: Informing Strategies and Developing Options for U.S. Policy Preface In a world of increasing dependence on information technology, the prevention of cyberattacks on a nation’s important computer and communications systems and networks is a problem that looms large. Given the demonstrated limitations of passive cybersecurity defense measures (that is, measures taken unilaterally by an organization to increase the resistance of an information technology system or network to attack), it is natural to consider the possibility that deterrence might play a useful role in preventing cyberattacks against the United States and its vital interests. At the request of the Office of the Director of National Intelligence, the National Research Council (NRC) undertook a project entitled “Deterring Cyberattacks: Informing Strategies and Developing Options for U.S. Policy.” The two-phase project aimed to foster a broad, multidisciplinary examination of strategies for deterring cyberattacks on the United States and of the possible utility of these strategies for the U.S. government (see Box P.1 for the statement of task). In the first phase, the Committee on Deterring Cyberattacks: Informing Strategies and Developing Options for U.S. policy produced a letter report, released in March 2010 and reprinted in Appendix A of this volume, that provided basic information needed to understand the nature of the problem and to articulate important questions that can drive research regarding ways of more effectively preventing, discouraging, and inhibiting hostile activity against important U.S. information systems and networks. The second phase of this project entailed selecting appropriate experts to write papers on questions raised in the letter report. A number of experts, identified by the committee, were commissioned to write these papers under contract with the National Academy of Sciences. Commissioned papers were discussed at a public workshop held June 10-11, 2010, in Washington, D.C., and authors revised their papers after the workshop. In addition to commissioning papers, the NRC sponsored a prize competition for papers that addressed one or more of the questions raised in the letter report. Two of these papers were singled out for recognition as noted on p. xii in the Contents and have been included in Group 7 of this volume. Although the authors were selected and the papers reviewed and discussed by the committee, the individually authored papers do not reflect consensus views of the committee. Under NRC guidelines for conducting workshops, workshop activities do not seek consensus, and proceedings (such as the present volume) cannot be said to represent an NRC view on the subject at hand. Furthermore, indi- vidual members of the committee may agree or disagree with the findings, conclusions, or analysis of ii Copyright © National Academy of Sciences. All rights reserved. Proceedings of a Workshop on Deterring CyberAttacks: Informing Strategies and Developing Options for U.S. Policy iii PREFACE Box P.1 Statement of Task An ad hoc committee will oversee a two-phase activity to foster a broad, multidisciplinary exami- nation of deterrence strategies and their possible utility to the U.S. government in its policies toward preventing cyberattacks. In the first phase, the committee will prepare a letter report identifying the key issues and questions that merit examination. In the second phase, the committee will engage experts to prepare papers that address key issues and questions, including those posed in the letter report. The papers will be compiled in a National Research Council publication and/or published by appropriate journals. This phase will include a committee meeting and a public workshop to discuss draft papers, with authors finalizing the papers following the workshop. any given paper in this volume, and the reader should view these papers as offering points of departure that can stimulate further work on the topics discussed. The papers presented in this volume are published essentially as received from the authors, with some proofreading corrections made as limited time allowed. The meeting agenda and biosketches of the speakers are provided in Appendixes B and C, respec- tively. Appendix D provides biosketches of the committee and staff. Copyright © National Academy of Sciences. All rights reserved. Proceedings of a Workshop on Deterring CyberAttacks: Informing Strategies and Developing Options for U.S. Policy Acknowledgment of Reviewers This report has been reviewed in draft form by individuals chosen for their diverse perspectives and technical expertise, in accordance with procedures approved by the National Research Council’s Report Review Committee. The purpose of this independent review is to provide candid and critical comments that will assist the institution in making its published report as sound as possible and to ensure that the report meets institutional standards for objectivity, evidence, and responsiveness to the study charge. The review comments and draft manuscript remain confidential to protect the integrity of the deliberative process. We wish to thank the following individuals for their review of the papers contained in this volume: Amitai Aviram, University of Illinois Robert Axelrod, University of Michigan William Banks, Syracuse University David Elliott, Stanford University Anita Jones, University of Virginia Cheryl Koopman, Stanford University Ronald Lee, Arnold & Porter, LLP Joseph Nye, Harvard University Francesco Parisi, University of Minnesota Joel Reidenberg, Fordham University Jerome Saltzer, Massachusetts Institute of Technology John Savage, Brown University Dan Schutzer, Financial Services Technology Consortium Walter Slocombe, Caplin & Drysdale Jack Snyder, Columbia University Joel Trachtman, Tufts University Jenell Trigg, Lerman Senter, PLLC Although the reviewers listed above have provided many constructive comments and sug- gestions, they were not asked to endorse the views presented in any of these commissioned and ix Copyright © National Academy of Sciences. All rights reserved.

See more

The list of books you might like

Most books are stored in the elastic cloud where traffic is expensive. For this reason, we have a limit on daily download.