Proactive cyber defence means acting in anticipation to oppose an attack through cyber and cognitive domains. Proactive cyber defence can be understood as options between offensive and defensive measures. It includes interdicting, disrupting or deterring an attack or a threat's preparation to attack, either pre-emptively or in self-defence. Common methods include cyber deception, attribution, threat hunting and adversarial pursuit. The mission of the pre-emptive and proactive operations is to conduct aggressive interception and disruption activities against an adversary using:
psychological operations
Psychological warfare (PSYWAR), or the basic aspects of modern psychological operations (PsyOp), have been known by many other names or terms, including Military Information Support Operations (MISO), Psy Ops, political warfare, "Hearts and Mi ...
, managed information dissemination, precision targeting, information warfare operations, computer network exploitation, and other active threat reduction measures. The proactive defense strategy is meant to improve information collection by stimulating reactions of the threat agents and to provide strike options as well as to enhance operational preparation of the real or virtual battlespace. Proactive cyber defence can be a measure for detecting and obtaining information before a cyber attack, or it can also be impending cyber operation and be determining the origin of an operation that involves launching a pre-emptive, preventive, or cyber counter-operation.
The offensive capacity includes the manipulation and/or disruption of networks and systems with the purpose of limiting or eliminating the adversary's operational capability. This capability can be required to guarantee one's freedom of action in the cyber domain. Cyber-attacks can be launched to repel an attack (active defence) or to support the operational action. Proactive cyber defence differs from active defence, meaning that it is pre-emptive (not waiting for an attack to occur). The distinction between active cyber defence and offensive cyber operations (OCO) is that the later requires legislative exceptions to undertake. Hence, offensive cyber capabilities may be developed in collaboration with industry and facilitated by private sector. But, these operations are often led by nation-states.
Cyber defense
Strategically, cyber defence refers to operations that are conducted in the cyber domain in support of mission objectives. The main difference between
cyber security
Computer security, cybersecurity (cyber security), or information technology security (IT security) is the protection of computer systems and networks from attack by malicious actors that may result in unauthorized information disclosure, the ...
and cyber defence is that that cyber defence requires a shift from
network assurance (security) to
mission assurance Mission Assurance is a full life-cycle engineering process to identify and mitigate design, production, test, and field support deficiencies threatening mission success.
Aspects of Mission Assurance
Mission Assurance includes the disciplined app ...
. Cyber defence focuses on sensing, detecting, orienting, and engaging adversaries in order to assure mission success and to outmanoeuver the adversary. This shift from security to defence requires a strong emphasis on intelligence, and reconnaissance, and the integration of staff activities to include intelligence, operations, communications, and planning.
Defensive cyber operations refer to activities on or through the global information infrastructure to help protect and institutions' electronic information and information infrastructures as a matter of mission assurance. Defensive cyber does not normally involve direct engagement with the adversary.
Active cyber operations refers to activities on the global information infrastructure to degrade, disrupt, influence, respond, and interfere with the capabilities, intentions, and activities of a foreign individual, state, organization, and terrorist groups. Active cyber defence decisively engages the adversary and includes adversarial pursuit activities.
History of the term proactive
In the fifth century, B.C.,
Sun Tzu
Sun Tzu ( ; zh, t=孫子, s=孙子, first= t, p=Sūnzǐ) was a Chinese military general, strategist, philosopher, and writer who lived during the Eastern Zhou period of 771 to 256 BCE. Sun Tzu is traditionally credited as the author of ''The ...
advocated foreknowledge (predictive analysis) as part of a winning strategy. He warned that planners must have a precise understanding of the active threat and not "remain ignorant of the enemy's condition". The thread of proactive defense is spun throughout his teachings. Psychiatrist
Viktor Frankl
Viktor Emil Frankl (26 March 1905 – 2 September 1997)
was an Austrian psychiatrist who founded logotherapy, a school of psychotherapy that describes a search for a life's meaning as the central human motivational force. Logotherapy is part ...
was likely the first to use of the term proactive in his 1946 book ''
Man's Search for Meaning
''Man's Search for Meaning'' is a 1946 book by Viktor Frankl chronicling his experiences as a prisoner in Nazi concentration camps during World War II, and describing his psychotherapeutic method, which involved identifying a purpose in life to f ...
'' to distinguish the act of taking responsibility for one's own circumstances rather than attributing one's condition to external factors.
Later in 1982, the
United States Department of Defense
The United States Department of Defense (DoD, USDOD or DOD) is an executive branch department of the federal government charged with coordinating and supervising all agencies and functions of the government directly related to national secu ...
(DoD) used "proactive" as a contrary concept to "reactive" in
assessing risk. In the framework of risk management "proactive" meant taking initiative by acting rather than reacting to threat events. Conversely "reactive" measures respond to a stimulus or past events rather than predicting the event.
Military science
Military science is the study of military processes, institutions, and behavior, along with the study of warfare, and the theory and application of organized coercive force. It is mainly focused on theory, method, and practice of producing mil ...
considers defence as the science-art of thwarting an attack. Furthermore, doctrine poses that if a party attacks an enemy who is about to attack this could be called active-defence. Defence is also a
euphemism
A euphemism () is an innocuous word or expression used in place of one that is deemed offensive or suggests something unpleasant. Some euphemisms are intended to amuse, while others use bland, inoffensive terms for concepts that the user wishes ...
for war but does not carry the negative connotation of an offensive war. Usage in this way has broadened the concept of proactive defence to include most military issues including offensive, which is implicitly referred to as active-defence. Politically, the concept of national self-defence to counter a war of aggression refers to a defensive war involving pre-emptive offensive strikes and is one possible criterion in the '
Just War Theory
The just war theory ( la, bellum iustum) is a doctrine, also referred to as a tradition, of military ethics which is studied by military leaders, theologians, ethicists and policy makers. The purpose of the doctrine is to ensure that a war is m ...
'. Proactive defence has moved beyond theory, and it has been put into practice in theatres of operation. In 1989
Stephen Covey's study transformed the meaning of proactive as "to act before a situation becomes a source of confrontation or crisis". Since then, "proactive" has been placed in opposition to the words "reactive" or "passive".
Origins
Cyber is derived from "
cybernetics
Cybernetics is a wide-ranging field concerned with circular causality, such as feedback, in regulatory and purposive systems. Cybernetics is named after an example of circular causal feedback, that of steering a ship, where the helmsperson m ...
", a word originally coined by a group of scientists led by
Norbert Wiener
Norbert Wiener (November 26, 1894 – March 18, 1964) was an American mathematician and philosopher. He was a professor of mathematics at the Massachusetts Institute of Technology (MIT). A child prodigy, Wiener later became an early researcher i ...
and made popular by Wiener's book of 1948, ''Cybernetics or Control and Communication in the Animal and the Machine''. Cyberspace typically refers to the vast and growing logical domain composed of public and private networks; it means independently managed networks linked together the Internet. The definition of Cyberspace has been extended to include all network-space which at some point, through some path, may have eventual access to the public internet. Under this definition, cyberspace becomes virtually every networked device in the world, which is not devoid of a network interface entirely. With the rapid evolution of information warfare operations doctrine in the 1990s, we have begun to see the use of proactive and preemptive cyber defence concepts used by the policymakers and scholars.
Current status
''The National Strategy to Secure Cyberspace,'' a book written by George W. Bush, was published in February 2003 outlining theinitial framework for both organizing and prioritizing efforts to secure the cyberspace. It highlighted the necessity for public-private partnerships. In this book, proactive threads include the call to deter malicious activity and prevent cyber attacks against America's critical infrastructures.
The notion of "proactive defence" has a rich history. The hype of "proactive cyber defence" reached its zenith around 1994, under the auspices of Information Warfare. Much of the current doctrine related to proactive cyber defence was fully developed by 1995. Now most of the discussions around proactive defence in the literature are much less "proactive" than the earlier discussions in 1994. Present-day proactive cyber defence strategy was conceived within the context of the rich discussion that preceded it, existing doctrine and real proactive cyber defence programs that have evolved globally over the past decade.
As being one of the founding members of the Canada's interdepartmental committee on Information Warfare, Dr. Robert Garigue and Dave McMahon pointed out that "strategic listening, core intelligence, and proactive defence provide time and precision. Conversely, reacting in surprise is ineffective, costly and leaves few options. Strategic deterrence needs a credible offensive, proactive defence and information peacekeeping capability in which to project power and influence globally through Cyberspace in the defence of the nation. Similarly, deterrence and diplomacy are required in the right dosage to dissuade purposeful interference with the national critical cyber infrastructures in influence in the democratic process by foreign states.
Vulnerabilities equities
Intelligence agencies, such as the National Security Agency, were criticized for buying up and stockpiling
zero-day vulnerabilities and keeping them secret and developing mainly
offensive capabilities instead of defensive measures and, thereby, helping patch vulnerabilities. This criticism was widely reiterated and recognized after the May 2017
WannaCry ransomware attack
The WannaCry ransomware attack was a worldwide cyberattack in May 2017 by the WannaCry ransomware cryptoworm, which targeted computers running the Microsoft Windows operating system by encrypting data and demanding ransom payments in the Bitco ...
.
Proactive pre-emptive operations
The notion of a proactive pre-emptive operations group (P2OG) emerged from a report of the
Defense Science Board's (DSB) 2002 briefing. The briefing was reported by Dan Dupont in ''Inside the Pentagon'' on September 26, 2002, and was also discussed by William M. Arkin in the ''
Los Angeles Times
The ''Los Angeles Times'' (abbreviated as ''LA Times'') is a daily newspaper that started publishing in Los Angeles in 1881. Based in the LA-adjacent suburb of El Segundo since 2018, it is the sixth-largest newspaper by circulation in the Un ...
'' on October 27, 2002.
The ''Los Angeles Times'' has subsequently quoted
U.S. Secretary of Defense
The United States secretary of defense (SecDef) is the head of the United States Department of Defense, the executive department of the U.S. Armed Forces, and is a high ranking member of the federal cabinet. DoDD 5100.1: Enclosure 2: a The se ...
Donald Rumsfeld
Donald Henry Rumsfeld (July 9, 1932 – June 29, 2021) was an American politician, government official and businessman who served as Secretary of Defense from 1975 to 1977 under president Gerald Ford, and again from 2001 to 2006 under Presi ...
revealing the creation of the "Proactive, Pre-emptive Operations Group". The mission was to conduct Aggressive, Proactive, Pre-emptive Operations to interdiction and disruption the threat using: psychological operations, managed information dissemination, precision targeting, and information warfare operations. Today, the proactive defence strategy means improving information collection by stimulating reactions of the threat agents, provide strike options to enhance operational preparation of the real as well as virtual battle space. The P2OG has been recommended to be constituted of one hundred highly specialized people with unique technical and intelligence skills. The group would be overseen by the White House's deputy national security adviser and would carry out missions coordinated by the secretary of defence. Proactive measures, according to DoD are those actions taken directly against the preventive stage of an attack by the enemy.
Other topics (relevance to international relations R
The discipline of world politics and the notions of pre-emptive cyber defence topics are the two important concepts that need to be examined because we are living in a dynamic international system in which actors (countries) update their threat perceptions according to the developments in the technological realm. Given this logic employed frequently by the policymakers, countries prefer using pre-emptive measures before being targeted. This topic is extensively studied by the political scientists focusing on the power transition theory (PTT), where Organski and Kugler first discussed that powerful countries start the attack before the balance of power changes in favor of the relatively weaker but the rising state.
Although the PTT has relevance to explain the use of pre-emptive cyber defence policies, this theory can still be difficult to apply when it comes to cyber defence entirely because it is not easy to understand the relative power differentials of the international actors in terms of their cyber capabilities. On the other hand, we can still use the PTT to explain the security perceptions of the United States and China, as a rising country, in terms of their use of pre-emptive cyber defence policies. Many scholars have already begun to examine the likelihood of cyber war between these countries and examined the relevance of the PTT and other similar international relations theories.
See also
References
Sources
* , Bradley J. Wood, O. Sami Saydjari, Victoria Stavridou PhD., SRI International
*
*
*
*
*
*
*
*
*
*
*
* by Tyson Macaulay (Author) BN-13: 978-1420068351
* 4 sections and Appendices.
* Directorate of Army Doctrine Update: Information Operations Doctrine Review, Sep 2005
* Future Security Environment 2025 (FSE) Supreme Allied Commander Transformation Branch Head Strategic Analysis / Intelligence Sub-Division
*
*
*
*
*
*
*
* Government Accounting Office. Technology Assessment: Cyber security for Critical Infrastructure Protection. May 2004 (http://www.gao.gov/new.items/d04321.pdf)
*
* Macaulay, Tyson— Critical Infrastructure: Understanding its Component Parts, Interdependencies, Vulnerabilities and Operating risks, 700 pages Auherbach publishing, June 2008
* Macaulay, Tyson— Security Converged IP Networks: New requirements for information and Communications Technology Security and Assurance, 300 pages, Auherbach publishing, June 2006
* McMahon, Dave, Rohozinski, Rafal - Combating Robot Networks and their Controllers, Bell Canada and the Secdev Group, 750 pages, August 2004
* McMahon, Dave, Rohozinski, Rafal - Dark Space Report, Bell Canada and the Secdev Group 600 pages, December 2012
* McMahon, Dave, - A Canadian National Proactive Defense Strategy, Bell Canada, 800 pages, August 2004
*
* McMahon, David, Cyber Threat: Internet Security for Home and Business, Hardcover – Oct 1 2000
* National Infrastructure Security Coordination Center NISCC Briefing 08/2005 Issued 16 June 2005, Targeted Trojan Email Attacks, Titan Rain
* NATO Cooperative Cyber Defence Centre of Excellence
* NATO Cooperative Cyber Defence Centre of Excellence, Tallinn Manual on the International Law Applicable to Cyber Warfare 2013
*
* Network Centric Warfare: Developing and Leveraging Information Superiority, David S. Alberts, John J. Garstka, Frederick P. Stein, DoD C4ISR Cooperative Research Program, February 2000
* Networks and Netwars: The Future of Terror, Crime, and Militancy, Edited by: John Arquilla, David Ronfeldt, RAND Corporation, 1999
* Omand, Sir David, Jamie Bartlett & Carl Miller, “Introducing Social Media Intelligence (SOCMINT)” published: 28 Sep 2012.
* Proactive Cyber Defense and the Perfect Storm. www.cyberthreat.ca David McMahon 19 April 2008
*
* Secdev, “Shadows in the Cloud”. A complex ecosystem of cyber espionage that systematically targeted and compromised computer systems in India, the Offices of the Dalai Lama, the United Nations, and several other countries. http://www.nartv.org/mirror/shadows-in-the-cloud.pdf
* https://ccdcoe.org/cyber-definitions.html
Office of Homeland SecurityThe National Strategy to Secure Cyberspace, February 2003* Office of Information Assurance and Critical Infrastructure Protection Federal Technology Service General Services Administration Before the Subcommittee On Terrorism Technology And Government Information Committee On Judiciary And The United States Senate July 25, 2001
* Schwartau, Winn. "Information Warfare — Chaos on the electronic superhighway "Thunder's Mouth Press, New York, 1994
* Science Application International Corporation (SAIC), "Planning Considerations for Defensive Information Warfare — Information Assurance -", 16 December 1993, 61 pages.
* {{cite journal , title=Seeking Symmetry In Fourth Generation Warfare: Information Operations In The War Of Ideas , last=Taipale , first=K.A. Executive Director, Center For Advanced Studies NYLS, Bantle , journal=INSCT Symposium , date=March 29–30, 2006
* Subcommittee on Emerging Threats and Capabilities, Committee on Armed Services United States Senate Hearing on Cyber Security and Critical Infrastructure Protection, Martin C. Faga, Executive Vice President, The
MITRE Corporation, March 1, 2000
* Toffler, Alvin, and Heidi Toffler. War and Anti-War. New York: Warner Books, 1995. 370pp. (U102 .T641 1995)
* What Works in Implementing the U.S. National Strategy to Secure Cyberspace Case Studies of Success in the War on Cyber crime and Cyber Espionage, A SANS Consensus, Document Version 1.0 December 10, 2007
Counterterrorism
Security engineering
National security
International security
United States Department of Homeland Security
Cyberwarfare
Defense
Prevention