Monitoring critical infrastructure assets and strategic signaling to deter aggression in cyberspace.

摘要

At 6:00 a.m., just before power consumption reaches its peak, a computer security expert at an electrical power utility receives the text message, "Fireball Express," indicating that a cyber operation is being executed on the utility's assets. The expert is a covert government agent, who is embedded in the power utility to monitor cybersecurity breaches. Only the CEO of the company is aware of her status as a government agent.;Months earlier, the embedded agent created a honeynet at the utility to draw cyber operations conducted by adversaries. The honeynet presents an intruder with a carbon copy of the utility's SCADA systems. Meanwhile, to enhance situational awareness, U.S. intelligence has secretly implanted sensors in core Internet routers across America. The Fireball Express alert was triggered by correlating information gathered from the honeynet and the Internet sensors; the analysis indicates that the operations are being conducted by a nation state adversary.;This dissertation considers three important questions raised by the Fireball Express scenario. Does the government's placement of the honeynet and the embedded agent at the privately-owned utility violate the Constitution? How can the U.S. clearly demonstrate its disapproval of the intrusion at the utility to the nation state adversary? Since a direct confrontation with the adversary could reveal the existence of the honeynet and, possibly, the presence of the embedded agent, how can the U.S. maintain the secrecy of its sensors while responding strongly to the intrusion?;In particular, the dissertation focuses on three components. First, it describes government monitoring scenarios and outlines the constitutional authorities and principal legal issues associated with government monitoring of private critical infrastructure assets. Second, it presents a signaling framework based on adversary-defender interactions that can be used to help deter aggression in cyberspace. Finally, it discusses the application of deception techniques to shield cyberspace sensors. Well-executed and nuanced deception with regard to the deployment and use of sensors can help a defender gain tactical and strategic superiority in cyberspace.