What is the difference between a hacking attack and a cyberwar attack? What do current militaries consider an attack vs. exploitation or just «normal operations»? Kevin will present an overview on the cyber warfare topic and the current understanding of Advanced Persistent Threats in the context of cyber defense. Referent: Kevin Kirst

1. Cyber Security Services
www.pwc.com
Cyber Warfare Realities
Kevin Kirst
PwC Switzerland

2. Agenda
• Background
• Cyber Warfare
• National Cyber Investments
• The Components
PwC
• Recent Activity
• Why hasn’t it happened yet?
2
One Security

3. My Background
US Military Officer (Pacific Area of Operations)
• Comms & IT Infrastructure
• Military Satellites
• Cyber Operations
PwC
KPMG
• DoD Consulting
Booz Allen Hamilton
• DoD Cyber Threat Intelligence & Operations
PwC Switzerland
• OneSecurity – Cyber Security
One Security
3
Oktober 2012

4. Background
“The use of electronic means makes it possible to steal large quantities
of data at once or within a short time. Such cases of sophisticated
electronic espionage are regularly recorded.”
-Federal Intelligence Services Switzerland 2013
PwC
“The FIS has clear indications that the authorities of various countries
have been directly or indirectly involved in cyber attacks.”
-Federal Intelligence Services Switzerland 2013
One Security
4

5. Federal Intelligence Services 2013
PwC
One Security
5
Cyber Threats

6. What is cyber warfare?
PwC
One Security
6
Oktober 2012

7. Who is investing in Cyber?
PwC
One Security
7

8. China
PwC
One Security
8

9. APT1: Unit 61398 (2013)
PwC
One Security
9

10. Cyber Warfare components
Computer Network Operations (CNO)
• Computer Network Exploitation (CNE)
• Computer Network Defense (CND)
• Computer Network Attack (CNA)
PwC
One Security
10
Exploit to Attack?
“Any cyber operation that results in death or significant damage to
property qualifies as an armed attack.” –Talinn Manual

11. The Tallinn Manual
• States may not knowingly allow cyber infrastructure located in
their territory to be used for acts that adversely affect other States.
• States may be responsible for cyber operations directed against other
States, even though those operations were not conducted by the
security agencies. (i.e. hacktivist)
PwC
• The International Group of Experts agreed that cyber operations that
merely cause inconvenience or irritation do not qualify as uses
of force.
• States may respond to unlawful cyber operations that do not rise to
the level of a use of force with countermeasures.
• A State that is the victim of a cyber “armed attack” may respond by
using force. The force may be either cyber or kinetic.
One Security
11
Oktober 2012

12. Activity Quick Look
Recent Activity:
PwC
One Security
12

13. Why hasn’t it happened yet?
PwC
One Security
13
Oktober 2012
Obfuscation
Definitions
Attribution
Confidence

14. These are easier to respond too….and to use
PwC
One Security
14
Oktober 2012
Obfuscation Definitions
Attribution Confidence

15. Conclusion
“....the risk of misattribution and escalation is real, and we always have
to consider the broad foreign policy implications of our actions.”
- Michael Daniel, White House Cybersecurity Coordinator
PwC
One Security
15

16. Questions?
PwC
One Security
16

17. PwC’s Cyber Security Services
Current Service Offerings:
• Cyber Threat Assessment
• Cyber Intelligence Assessment
PwC
• Cyber Stress Tests
17

18. Antoine Berthaut
Avenue Giuseppe-Motta 50
1211 Genève
Direct: +41 58 792 9233
antoine.berthaut@ch.pwc.com
Contact us
Robert Metcalf
Avenue Giuseppe-Motta 50
1211 Genève
Direct: +41 58 792 9242
robert.metcalf@ch.pwc.com
PwC
Thomas Koch
Birchstrasse 160
Postfach, 8050 Zürich
Direct: +41 58 792 2954
thomas.koch@ch.pwc.com
Holger Greif
Birchstrasse 160
Postfach, 8050 Zürich
Direct: +41 58 792 1386
holger.greif@ch.pwc.com
18Gianfranco Mautone
Birchstrasse 160
Postfach, 8050 Zürich
Direct: +41 58 792 1760
gianfranco.mautone@ch.pwc.com
Juergen Mueller
Avenue avenue C.-F. -Ramuz 45
Case postale, 1001 Lausanne
Direct: +41 58 792 8141
juergen.t.mueller@ch.pwc.com