Cyber deterrence with imperfect attribution and unverifiable signaling

Cybersecurity and Supply Chain Risk Management Are Not Simply Additive: Implications for Directions in Risk Assessment, Risk Mitigation, and Research to Secure the Supply of Defense Industrial Products

“…31 Efforts to share information among defenders may lead to gains in efficiency and efficacy, both defensive and productive, but may also present cyber-specific downside risk, and hence trade-offs, depending on the form of the sharing. 32 Within the context of the cybersecurity of industrial supply chains, information-sharing could mean sharing cyber threat intelligence between defenders in the forms of vulnerability information or threat information, sharing or signaling defensive posture and offensive capability between attackers and defenders (see Welburn, Grana, and Schwindt, 2023, and the extended discussion in Appendix B), and sharing intellectual property (e.g., designs or specifications) between firms. Of particular concern are the possibilities of revealing information that an adversary can exploit to its advantage or of expanding the attacker's attack surface by conveying additional points of entry that increase the probability of successful attacks.…”

“…34 However, even when detection and retaliation are possible, the literature suggests that deterrence strategies that either publicly name and shame or retaliate in kind may be effective, but only some of the time against some adversaries. For more on retaliation with imperfect detection and attribution, see, e.g., Edwards et al (2017) and Welburn, Grana, and Schwindt (2023). LaTourrette, 2015, andHaphuriwat, Bier, andWillis, 2011, respectively).…”

“…This research suggests that weak attribution can promote aggression, insomuch as attackers will tend to ratchet up their aggression to nearly match that of the most aggressive attacker. Welburn, Grana, and Schwindt (2023) defines a basic attribution game between an attacker and a defender, similar to that in Edwards et al (2017), in which attackers and defenders choose whether to attack or retaliate, respectively, but defenders must choose without knowing whether they have been attacked. Welburn, Grana, and Schwindt built on the game by adding signaling.…”

The Purpose of Cybersecurity Governance in the Digital Transformation of Public Services and Protecting the Digital Environment

“…Information and data are among the most significant things that a hacker seeks to access in order to control the system and exploit customers. The cyber security system consists of three essential elements: Cyber force [6], cyber defence [7], and cyber deterrence [8]. The primary position of cybersecurity is to put in place mechanisms to defend the computer network, protect the electronic environment, and ensure the safe transfer of information between government institutions and agencies without the presence of unauthorized persons or malware software aimed at controlling and manipulating the system [9][10][11].…”