6th European Conference - Academic Conferences

Merritt Baer
Effective cyberintrusion defenses analog the epidemiological model for responding to an invader.
Some have warned of a “cyber pearl harbor”; this seems too kinetic-world to form an accurate
description of the threat. As Giesler asserts, we ought to be talking about cyber-destruction like a
cancer—“you already have it, it‟s hard to detect, it may be fatal but it‟s also treatable.” It may be that
the best responses to cyberwar are not found by studying war—at least not the ones in our history
books involving cannons or tanks.
Similarly, rather than a process of continual growth, cyber evolution, like biological evolution, seems
more aptly characterized as punctuated equilibrium—fairly long periods of relative stasis followed by
quick, drastic periods of breakthrough. (An example of a breakthrough in the cyber context could be
the advent of cloud computing.) Correspondingly, one of the reasons why reaching Nash equilibrium
is unlikely in the cyberwar context is that it under unstable conditions, evolutionarily stable strategies
don‟t run a typical course. As evolutionary biologist Klaus Rohde (2005: Appendix 3) writes, “frequent
and drastic abiotic and biotic changes in the environment which affect the fitness (reproductive
success) of potential contestants in evolutionary „games,‟ will make it more difficult to establish
evolutionary stable strategies, because the establishment of an ESS cannot keep up with the
changes.” Because cyber evolution is not linear but organic, it forces us to treat it according to the
economics of biology. The DNI‟s “Vision 2015” report addresses the deliverables aspect of this: “We
cannot evolve into the next technology „S curve‟ incrementally; we need a revolutionary approach.
Breakthrough innovation, disruptive technologies, and rapid transition to end-users will be required…”
Applying game theory to cyberwarfare strategy allows us to make predictions that transcend lockstep
models, that change based on resources, and that take into account other players‟ strategies and
environmental conditions. Thus, while there is no solution nor even an accurate map of potential
moves in game theory, it seems yet to be our best tool for transcending the perpetual reactiveness
that has characterized cyber- information security efforts.
5. Uses of game theory
5.1 Layered defense
While cyberwar strategy is a game of imperfect information, there are always choices available, and
the vulnerabilities associated with each choice are not random but are often knowable or predictable,
at least to some extent. We know that the risks of using open-source materials are in its lack of
restriction; we know that the weakness that comes from use of highly classified, air-gapped (or in
Zittrain-speak, “tethered”), networks come from a loss of functionality and “generativity.” Diversity and
interoperability are tradeoffs, as are embrittlement and toughening. These are zero-sum games; but
the overall strategy is not. While one can not create a network that is maximally resistant to random
faults and maximally resistant to targeted faults, one can take into account the particular weaknesses
and likelihoods of attack so that the weaknesses overlap in resistant ways-- ways that correspond to
risk preferences and security priorities. As the banking and credit card systems have worked to create
overall robustness through non-overlapping weaknesses, other providers (including infrastructural)
should be able to create calculated layers of defense if there were coordination and appropriate
budgeting.
5.2 Identifying nodes robustly
In game theory, the identification of possible choices is termed alpha-beta pruning—there is not an
unlimited number of desirable outcomes therefore there is not an unlimited number of choices. One
can prune down the number of nodes evaluated in the search tree. Alpha-beta pruning represents the
fact that as soon as one move can be proven less desirable than another, it need not be further
evaluated. One‟s search can then steer toward the more promising subtree(s), creating an optimal
search path.
To do this effectively first requires diversity and creativity—that is, the ability to identify many possible
nodes. Defense Secretary Robert Gates stated that the Pentagon is “desperately short of people who
have capabilities (defensive and offensive cybersecurity war skills) in all the services and we have to
address it.” (Booz Allen 2009: 1). The key human-side aspect of cyberwar strategy is to effectively
uncover all possible decision paths, which requires foundationally that the Department of Defense do
a more effective job of recruiting and retaining diverse talent.
27