Cyber war needs ‘rules of engagement’

Cyber war needs “rules of engagement” to help prevent any cyber disasters from happening, a US think tank said.

The EastWest Institute drew up a proposal to present to the Munich Annual Security Conference, the BBC said.

Delegates to hear the plan included British PM David Cameron, US Secretary of SHillary Clinton, German Chancellor Angela Merkel and Russian Foreign Minister Sergei Lavrov.

It is the first time cyber security has been on the event’s agenda and the EastWest proposal talked of "rendering the Geneva and Hague conventions in cyber space."

The think tank’s draft document of the proposal spoke of defining the territories and players in the cyber world and said concepts of peace and war may be too simple when discussing internet-based conflict.

Businesses should also be included in the debate over cyber warfare, according to EastWest.

"Cyber weapons can deliver, in the blink of an eye, wild viral behaviours that are easily reproduced and transferred, while lacking target discrimination," the document read.

Furthermore, separating civilian and military targets is not so easy, the think tank’s draft said.

Would rules of engagement work?

Frank Coggrave, general manager in Europe, the Middle East and Africa (EMEA) for Guidance Software, had his qualms over whether rules of engagement could actually work in cyber warfare.

“One of the challenges for this is, how do you know if an attack is state sponsored?” Coggrave said.

“It’s very difficult to attribute it.”

But if “kinetic warfare” – covering physical acts of war – and cyber attacks happen in conjunction, then it may be possible to introduce rules of engagement, he said.

Governments “should be paranoid” about the cyber threat, Coggrave said.

“The amount of damage cyber events can do to a country is quite significant,” he said. “If someone wanted to take down the UK’s water infrastructure, they could do it.”

Most businesses have protections to secure against attacks using technologies such as antivirus but many were vulnerable targeted attacks, he said.

“What we are seeing is organisations saying 'we have to prepare for a specific attack,'” he said.

“Anti-virus would never have protected against Stuxnet.”

This article originally appeared at itpro.co.uk