These past few months have caused my mind to spin. I saw two job postings looking for cyber threat analysts that came up when I was researching a cyber topic. One position was in the intelligence community and the other was for a major global player within their industry (non-defense). Both descriptions caught my attention. The requirements listed were typical for a cyber threat intelligence analyst – that is, until I got to the last section. In that section, the cyber threat analyst would recommend appropriate responses to the threats they identified.
While that is interesting in and of itself within the intelligence community, it demands much more attention coming out of the private sector.
What would be the analysts' options? What if they recommended a retaliatory cyber strike against a cyber threat they identified and analyzed? Does this indicate the private sector is fed up with being a victim and planning to take action in their own defense? A couple of years ago a cybersecurity services provider called me and asked my advice. They had detected an attack on one of their clients and wanted to launch a retaliatory cyber strike. Of course, I warned that was not a good idea.
One would have to wonder about the implications of such action. Would that open the country from which the retaliatory strike was launched to an attack from the country where the target was located? These are just a few of the questions that came to mind after reading the job descriptions.
This has been a growing issue for a number of years. It appears it may have reached a point where retaliatory strikes are about to become routine. Everyone is frustrated by the increasing number of sophisticated hacking attacks that they experience. In addition, their frustration is increased by the lack of available remedies that are available to them.
One can see how this could easily escalate to the point where U.S. Cyber Command and the military will become involved. This is not where we should be headed. One has to wonder, is there any international case law on this? Any international treaties?
