This post first appeared on Federal News Network. Read the original article.
Consider losing power, water, communications, transportation and sewage services — both for yourself and your supply chain — for weeks or even months. China seeks, and is well on its way, to achieve the commanding ability to wreak such havoc upon us. Only in the shadows of cyberspace could this malicious penetration not be considered the act of war that it is.
Without a call to arms, our nation is dangerously vulnerable today, and still more tomorrow, to increasingly sophisticated and brazen cyberattacks. Within competing priorities and limited budget, cybersecurity must be a priority for any administration. Drones are relatively easy to observe so spur alarm. Unseen Chinese state-sponsored hackers have broadly compromised our nation’s critical infrastructure and networks with profound consequences for our way of life and ability to defend it.
Just two Chinese cyberattack teams, Volt and Salt Typhoon, illustrate the collapse of our cyber deterrence with potentially devastating consequences. Without restraint, Volt Typhoon broadly infested our internet-connected industries and infrastructure. Salt Typhoon hackers achieved much the same in their compromise of network routers and devices to steal network traffic.
Alarmingly, although these attacks were acknowledged this year, they may have secretively begun more than three years ago. Caught in public, China boldly and unabashedly continues the attack to achieve nothing less than the destruction of the American people’s will with a homeland attack whenever they choose. Given China’s continued employment of these open, advanced, persistent hackers, how many are yet to be discovered? Deterrence has failed.
Risk is intolerably out of balance to our strategic disadvantage. The vulnerability of our water, transport, medical, energy and military transport sectors is high. The consequences of an attack could be devastating to our society and military. The threat is increasing as China, Russia and others double down on cyber as an asymmetrical strategic weapon. The collaboration of ransomware criminals and sophisticated state capability creates a hybrid enterprise difficult to defeat or even identify.
Restoring cyber deterrence through resiliency will be an administration-critical action in coordination with private industry. The Nuclear Regulatory Commission is an example of what can be done.
Essential to deterrence is a hardening that reduces vulnerability and so denies benefit to our attackers beyond current practice. The government will have to take the lead, as they have successfully set standards for nuclear power. Market forces have proved ineffective. Without enforcement, the incentives are weak for any company to take on the cost. Government and industry must invest, or attacks will continue undiminished with severe consequences ― the least of which is the Damocles Sword of demonstrated vulnerability that undermines our policies for great power competition.
We know how to fix this. Since 9/11, the Nuclear Regulatory Commission has been the model for keeping pace with the threat through improving processes, expertise and technology, all enforced by regulation. Saudi Aramco is an object lesson. After the devastating 2012 cyberattack, Saudi Arabia invested in leading-edge cyber defenses to stave off an aggressive Iranian cyberattack.
No other great power relies on digital technology for so much that is so vital as the United States. The digital industrial revolution spurred enormous advances, largely without thought to defense. Every sector of our critical infrastructure is vulnerable and many such as water are virtually undefended. Space and the cloud are new challenges. Resiliency initiatives must restore deterrence. Within this, we require a broad transfer of technology developed to protect nuclear power and our nation’s most vital networks. These National Security Agency-certified defenses for the most advanced threats are more accessible to others as size, weight, power and cost have been reduced.
Integrated planning and action across, commercial, public, federal, state and military entities are critical. Despite best efforts, we must assume surprise. China demonstrates the capability and will to avoid, and risk, detection. The 9/11 urgency for coordinated response is orders of magnitude less than required for a sustained, wide-ranging attack on our networks and infrastructure.
Both planning and response require a revised security communications architecture that incorporates classified, commercial and public data exchange and real-time collaboration. Siloed information, collaboration and response will cripple us: Think the Secret Service communication challenges for just one site on a national, multi-sector scale.
The Federal Emergency Management Agency, beyond natural disaster, must serve as a command-and-control hub, as effectively practiced as our military’s Northern Command. The final exam is to coordinate an effective response in the face of an ingeniously orchestrated, willful cyberattack, the workings of which are already placed in our homeland by our fiercest competitor.
Dan O’Donohue is senior vice president for strategic programs at Owl Cyber Defense.
The post A cyber call to arms first appeared on Federal News Network.