defense system. Many computing people initially declined to join the debate
because they believed it was inherently political and they had little to offer. That changed with David Parnas’s
remarkable Communications article,
“Software aspects of strategic defense
systems,” 4 which set out for the first
time the scientific framework of software engineering. Parnas showed that
software engineering at the time was
not capable of producing reliable control systems for missile defense. After
that many computing professionals
joined the debate to add their own experience and expertise with unreliable
large, complex systems.
There are several other examples
where political and legal issues depended on an understanding of the limits of
computing technology, and computing
professionals made important contributions to the debates. These included
the move toward e-voting, cryptography policy, architecting the Internet for
strong authentication, technologies to
improve or impede anonymity, proposals to charge postage on email to stop
spam, and network neutrality.
Cyber attack is on par with the strategic defense issue. The complex and
subtle issues of cyber attack cannot
be adequately resolved unless experts
knowledgeable in the workings and capabilities of information technologies
participate actively in the discussions.
Some of the areas where technical expertise is essential include:
˲ ˲ Advancing the capabilities for rapid attribution—determining who instigated an attack so as to enable a timely
and precise response.
˲ ˲Understanding and measuring
it is not possible to
build strong defenses
without acquiring a
of how attacks work
and how effective
they might be.
both direct and indirect effects of cyber attacks; assessing damages related
to direct and indirect effects of cyber
˲ ˲ Determining whether a cyber operation is an attack or exploitation—or
generally inferring intent.
˲ ˲Trying to understand, through
war game simulations, how social
and technical systems in the Internet
might respond to various attacks and
provocations, how cyber attacks could
escalate out of control, and which
“games of cooperation” might best
˲ ˲Understanding the relationship
between recovery time and value of an
attack—an attacker is less motivated to
take down a network if the victim can
quickly restore it to operation.
˲ ˲ Finding effective means of planting or discovering Trojan horses and
other forms of malware.
˲ ˲ Determining the effects of virtualization in the cloud on the ability to
mount, detect, and thwart attacks.
˲ ˲Understanding and minimizing
risks introduced by development or use
of cyber attack and exploit capabilities.
˲ ˲ Understanding and explaining implications of new technologies—how
they might be attacked or how they
might facilitate an attack or exploit. For
example, technologies for smart grids,
smart cars, wireless home networks, or
social networking systems.
˲ ˲ Determining the requirements for
getting good indications and warnings
of cyber attack—is it necessary to penetrate adversary networks to get this in
a timely enough manner to defend or
Studying these areas contributes to
better defenses. It is not possible to
build strong defenses without acquiring and maintaining a solid understanding of how attacks work and how
effective they might be.
What You Can Do
It is important that computing professionals bring their general knowledge
of computers and networks to the discussions of technical, policy, legal,
and social issues around cyber attack.
There are several ways to do this:
˲ ˲ Engaging in research in the above
areas and publishing results.
˲ ˲ Developing and participating in cy-
ber attack and defense exercises; mak-
ing sure that cyber exercises are true to
technology and its limits.
1. clarke, r., and r. Knake. Cyber War. ecco, 2010.
2. denning, d. e. Information Warfare and Security.
3. national research council. Technology, Policy, Law,
and Ethics Regarding U. S. Acquisition and Use of
Cyberattack Capabilities. w.A. owens, K.w. dam,
and h.S. lin, eds., national Academic press, 2009.
Available from MacArthur foundation, macfound.org,
search for “cyberattack.”
4. parnas, d. Software aspects of strategic defense
systems. Commun. ACM 28, 12 (dec. 1985), 1326–1335.
5. Vijayan, j. over 75,000 systems compromised in
cyberattack. Computer world (feb 18, 2010).
Peter J. Denning ( email@example.com) is distinguished
professor of computer Science and director of the
cebrowski Institute for Innovation and Information
Superiority at the naval postgraduate School in Monterey,
cA and is a past president of AcM.
Dorothy E. Denning ( firstname.lastname@example.org) is distinguished
professor of defense Analysis at the naval postgraduate
School in Monterey, cA, and author of Information
Warfare and Security. 2