Jacob G. Oakley

Waging Cyber War

Technical Challenges and Operational Constraints

Jacob G. Oakley
Owens Cross Roads, AL, USA
ISBN 978-1-4842-4949-9e-ISBN 978-1-4842-4950-5
https://doi.org/10.1007/978-1-4842-4950-5
© Jacob G. Oakley 2019
This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed.
Trademarked names, logos, and images may appear in this book. Rather than use a trademark symbol with every occurrence of a trademarked name, logo, or image we use the names, logos, and images only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. The use in this publication of trade names, trademarks, service marks, and similar terms, even if they are not identified as such, is not to be taken as an expression of opinion as to whether or not they are subject to proprietary rights.
While the advice and information in this book are believed to be true and accurate at the date of publication, neither the authors nor the editors nor the publisher can accept any legal responsibility for any errors or omissions that may be made. The publisher makes no warranty, express or implied, with respect to the material contained herein.
Distributed to the book trade worldwide by Springer Science+Business Media New York, 233 Spring Street, 6th Floor, New York, NY 10013. Phone 1-800-SPRINGER, fax (201) 348-4505, e-mail [email protected], or visit www.springeronline.com. Apress Media, LLC is a California LLC and the sole member (owner) is Springer Science + Business Media Finance Inc (SSBM Finance Inc). SSBM Finance Inc is a Delaware corporation.

To my children, you’ll move mountains.

Introduction

This book was written to inform the reader on the increasingly intertwined concepts of war and cyber. It is meant to dispel the misconceptions and mythos surrounding cyber warfare. Reading this book will provide insight into the technical obstacles within the cyber domain which hinder effective warfighting operations. You will also come to understand how legal and oversight authorities, as well as international convention, further constrain what technical capabilities do exist. Cyber warfare has crept into facets of everyday life. Each individual citizen and their personal devices, from cell phone to smart fridge, represent an extension of a nation’s attack surface. Whether you are a policy maker, commander, warfighter, technical or non-technical citizen, or employed in the cyber security industry, understanding the facts of cyber warfare is necessary to combat its increasing pervasiveness.

Acknowledgments

I thank my beautiful wife and family for sacrificing their nights and weekends to let me write this book and for loving and supporting me through this and other nerdy endeavors.

I thank my father for exemplifying hard work and for all he did to give me the best chance to succeed in life.

I would like to thank Wayne York for being the technical reviewer for this book and being a true leader of Marines, specifically this Marine.

To all you keyboard-wielding cyber warriors out there protecting freedom, I salute you.

Table of Contents

Chapter 1:​ Cyber and Warfare 1
Definition 1
Declaration 2
Just War Theory 4
Jus ad Bellum 4
Jus in Bello 5
International Agreements 7
Expectation of Protection 10
Summary 12
Chapter 2:​ Legal Authority 13
Title 50—Intelligence Community 13
Title 10—Department of Defense 15
Maintaining Military Operations 15
Covert Action 17
Bringing It Together 18
Known US Responses 19
Espionage 22
Defining Espionage 23
Title 18 23
Cyber and Espionage 24
Summary 24
Chapter 3:​ Cyber Exploitation 25
Refined Definition 26
Exploitation 28
Types of Exploitation 28
Title Implications 39
Summary 39
Chapter 4:​ Cyber-Attack 41
Attack Types 45
Denying the Enemy 46
Manipulating the Enemy 49
Espionage 54
Summary 55
Chapter 5:​ Cyber Collection 57
Cyber Intelligence Gathering 59
Cyber Domain Collection Examples 62
Open Source Collection 63
Human Source Collection 64
Direct Collection 66
Indirect Collection 68
Understanding the Trade-Off 69
Summary 70
Chapter 6:​ Enemy Attribution 71
Logical Process of Attribution 72
Discovery 72
Association 73
Identification 73
Motivation 74
Post-attribution Process 74
Is Active Response Itself Appropriate?​ 75
Active Responses 75
Attributes 77
Technical Attributes 77
Tactical Attributes 81
Forget Everything You Thought You Knew 83
Unsteady Foundation 85
Summary 86
Chapter 7:​ Targeting 87
Tactical vs.​ Strategic Response 88
Target Selection 91
Appropriate Targets 92
BDA 94
Target Fidelity 95
Rules of Engagement 98
Method 98
Success 98
Abort 99
Failure 100
Summary 100
Chapter 8:​ Access 101
Access Tools 102
Levels of Access 102
Types of Access 104
Access and Target Relationship 105
Attack Surface 111
Scoping Access Operations 112
ROE for Access Operations 113
Summary 114
Chapter 9:​ Self-Attribution 115
Unintentional Self-Attribution 116
Examples of Self-Attribution 116
Actor Association 121
Actor Identification 124
Intended Self-Attribution 127
Projecting Force 127
Summary 129
Chapter 10:​ Association 131
Types of Association 134
Incidental 134
Purposeful 136
Summary 142
Chapter 11:​ Resource Resilience 143
Operational Resources 143
Exploits 144
Access Tools 145
Attack Tools 147
Support Resources 148
Obfuscation 148
Frontend Infrastructure 150
Backend Infrastructure 151
Personnel-Based Resources 152
Skill 152
Tradecraft 153
People 154
Summary 155
Chapter 12:​ Control and Ownership 157
Resource Control 157
Resource Ownership 159
Resource Examples 160
Exploits 160
Access Tools 162
Attack Effects 163
Obfuscation Infrastructure 164
Frontend and Backend Infrastructure 165
Tactics, Techniques, and Procedures 166
People 167
Summary 168
Chapter 13:​ Challenges 169
Major Misconceptions 170
Exploitation Is Warfare 171
Ease of Attribution 171
Return Fire 172
Target Dictation 173
Resource Availability 173
Shelf Life 174
Static Targets 175
Next Hacker Up 176
Open Conflict 176
Summary 179
Chapter 14:​ Contemplation 181
Biological Warfare 181
Communicability 182
Effectiveness 182
Targetability 182
No Battle Damage Assessment 183
Control 183
Ownership 183
Bringing It Together 184
Summary 185
Index 187

About the Author and About the Technical Reviewer

About the Author

Jacob G. Oakley
../images/477915_1_En_BookFrontmatter_Figb_HTML.jpg

spent over 7 years in the US Marines and was one of the founding members of the operational arm of Marine Corps Forces Cyberspace Command, leaving that unit as the senior Marine Corps operator and a technical lead. After his enlistment, he wrote and taught an advanced computer operations course, eventually returning back to mission support. He later left government contracting to do threat emulation and red teaming at a private company for commercial clients, serving as principal penetration tester and director of penetration testing and cyber operations. He is working as a cyber SME for a government customer. He completed his doctorate in IT at Towson University researching and developing offensive cyber security methods. He is the author of the book Professional Red Teaming (Apress, 2019) and the technical reviewer of the book Cyber Operations, Second Edition (Apress, 2019), by Mike O’Leary.

 

About the Technical Reviewer

Wayne York

is a retired Marine with over 20 years of service and experience ranging from systems administration, digital network analysis, signals intelligence, and cyber operations. He was involved in the stand-up of the Marine Corps Forces Cyberspace Command with nearly a decade spent between the headquarters and operational components. His time in the Marines as a warfighter and cyber operations subject matter expert provides insight into the complexities of the cyberspace domain.

He is now a senior penetration tester with a professional services company and works both commercial and government contracts helping ensure customers secure their networks and applications from adversarial cyber threats. He holds a Bachelor of Science in Computer Networks and Cybersecurity from the University of Maryland University College, as well as Security and Certified Ethical Hacker (CEH) certifications.

 
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.217.84.171