Cyber Project

"While cyber and nuclear technologies are vastly different, the process by which society learns to cope with a highly disruptive technology shows instructive similarities. It took states about two decades to reach the first cooperative agreements in the nuclear era. If one dates the cyber-security problem not from the beginning of the Internet in the 1970s, but from the late 1990s, when burgeoning participation made the Internet the substrate for economic and military interdependence (and thus increased our vulnerability), cooperation is now at about the two-decade mark."

Where does malicious software - the code designed to exploit the vulnerabilities of computers and computer systems - come from?

As President Trump increasingly boxes in Tehran, U.S. allies should be worried about the potential for a devastating cyberattack from the Islamic Republic.

In theory, there is no reason why the principles of deterrence should not apply to cyberspace. However, there are number of reasons why it does not work in practice.

The Cipher Brief's Levi Maxey spoke with Michael Sulmeyer about what a deterrence strategy would look like, and what it could and could not do to prevent malicious cyber activity from targeting U.S. institutions.

What is the likelihood that multiple parties will independently discover the same software vulnerability? Herr and Schneier discuss their recent paper "Taking Stock: Estimating Vulnerability Rediscovery." 

Michael Sulmeyer unpacks the possible NSA/CyberCom split and what it would mean to elevate U.S. Cyber Command to the status of a unified command.

This paper presents a new dataset of more than 4,300 vulnerabilities, and estimates vulnerability rediscovery across different vendors and software types. It concludes that rediscovery happens more than twice as often as the 1-9% range previously reported.

Understanding the levels of conflict - strategy, operations, and tactics - can help policymakers mitigate the effectiveness of a disinformation campaign. Russia's operation against the 2016 U.S. election is case in point.

This article compares state activities to control the international spread of malware with efforts to counter the proliferation of weapons of mass destruction (WMD).