Comparing Cyber Weapons to Traditional Weapons Through the Lens of Business Strategy Frameworks by Nicola Bates Supervisor: Professor Konstantinos Markantonakis Information Security Group Royal Holloway, University of London 1 Acknowledgements My thanks go to Professor Konstantinos Markantonakis for supervision on this project. Also to Dr Raja Naeem Akram for advice on where to focus analysis, Dr Michelle Bentley for discussion on weapon categorisation, Dr Nicholas Griffin for casting an eye over strategy framework use within this context, Dr Robert Bates for help on strategic framework analysis and Neil Ashdown for proof reading and feedback. 2 Table of Contents Page Acknowledgements…………………..……………………….…………………………….2 List of figures and tables…………………..………………………………………………..6 Executive summary…………….……………………………………………………………8 1. Introduction and background…………………………………………………………..10 1.1 Introduction……………………………………………………………………………..10 1.2 What is a cyber weapon?…………………………………………………………..11 1.3 Cyber weapons considered for analysis……………………………………….…13 1.4 Actors in cyberspace………………………….…………………………………….14 1.5 Overview of strategic frameworks.…….…………………………………………...16 1.5.1 PESTLE………………..………….…………….……………………………….16 1.5.2 Porter’s Five Forces………………………….…………………………………18 1.5.3 SWOT……………………………….……….…………………………………..19 1.6 Summary and methodology………….……….……………………………………20 2. Comparisons of cyber and conventional weapons….….…….……………………..21 2.1 Introduction….……….………………………….…………….……………………..21 2.2 The fifth domain of warfare………………………….…………….……………….21 2.3 The battlefield………….……………………………….……………………………22 2.3.1 Reach………….……………………………….………………………………...23 2.3.2 Speed………….……………………………….………………………………...23 2.3.3 Volatility………….……………………………….………………………………23 2.3.4 Target dependence………….………………………….………………………24 2.3.5 Offence dominance………….……………………………….…………………24 2.4 Under theorisation.….…………….……….………………………………………..25 2.5 Threat assessment.…………….…………………….……….…………………….25 2.6 Attribution…….…………….…………………….…………….…………………….26 2.7 Proliferation.……….…………………….…………….…………………………….27 2.8 Legal aspects….……………………………….……………………………………28 3 2.9 Cost………….…………………………….….……………………………………..29 2.10 Diversity of actors………….……………………………….……………………..31 2.11 Life expectancy of weapons…………………………….………………………..32 2.12 Intrusion and attack may look the same in cyber……….………….….……….32 2.13 Improved defences counter attacks globally………….………………………..33 2.14 Conclusion………….……………………………….……………………………..34 3. PESTLE analysis of cyber and conventional weapons…..…………………………35 3.1 Introduction to attacks….………………………………….………………………..35 3.2 Estonia – April 2007….………………………………….………………………….36 3.3 Invasion of Georgia – August 2008….…………………………………………….38 3.4 Stuxnet – June 2010….……...………………………….………………………….40 3.5 Saudi Aramco – August 2012….………………………………….……………….42 3.6 F-35 IP theft – 2013 ….………………………………….…………………….……44 3.7 Sony Pictures – November 2014….……………………………………………….46 3.8 Financial transactions, SWIFT – 2014-2015….………………………………….48 3.9 Ukraine power grids – December 2015….………………………………………..50 3.10 US election interference – November 2016….………………………...….……52 3.11 WannaCry – May 2017…………..…………………….………………………….54 3.12 Conclusion………………………………………………………………………….55 4. Porter’s Five Forces analysis…………………………………………………...……..57 4.1 Introduction……………………………………………………………………….….57 4.2 Threat of substitute products……………………………………………………….57 4.3 Threat of protection versus attack…………………………………………………58 4.4 The power of buyers and the power of suppliers………………………………...59 4.5 Rationality of the market……………………………………………………….…...61 4.6 Conclusion……………………………………………………………………………62 5. Conclusions……………………………………………………………………………...64 5.1 Conclusion……………………………………………………………………………64 5.1.1 Cyber changes the battlefield………………………………………………….64 5.1.2 Areas where cyber is beneficial……………………………………………….65 4 5.1.3 Challenges of deploying cyberattacks ……………………………………….66 5.1.4 Cyber weapons are here to stay………………………………………………68 5.2 Further work………………………………………………………………………….69 5.3 Closing thoughts…………………………………………………………………….72 Appendices………………………………………………………………………………....73 Appendix 1: PESTLE results for Estonia………………………………………….…..73 Appendix 2: PESTLE results for Georgia……………………………………………..75 Appendix 3: PESTLE results for Stuxnet……………………………………………...77 Appendix 4: PESTLE results for Saudi Aramco.……………………………………..79 Appendix 5: PESTLE results for F-35 IP theft………………………………………..82 Appendix 6: PESTLE results for Sony Pictures………………………………………83 Appendix 7: PESTLE results for SWIFT………………………………………………85 Appendix 8: PESTLE results for Ukraine power……………………………………...87 Appendix 9: PESTLE results for US election………………………..………………..89 Appendix 10: PESTLE results for WannaCry………………………………………...91 List of definitions and acronyms…………………………………………………………..94 References………………………………………………………………………………….95 5 List of tables and figures Page Table 1: Relationship between state and non-state actors in cyberattack…………..14 Table 2: Types of threat actors in the cyber domain ………………..…………………15 Table 3: PESTLE analysis descriptions for cyber weapons comparison…..………..17 Table 4: Porter’s Five Forces descriptions for competitive market analysis…………19 Table 5: Comparison of the five domains of warfare.………………………………….22 Table 6: Summary PESTLE analysis for Estonia..….……………..…………………...38 Table 7: Summary PESTLE analysis for Georgia...………………..…………………..39 Table 8: Summary PESTLE analysis for Stuxnet………………..………..…………...42 Table 9: Summary PESTLE analysis for Saudi Aramco………………..……………..44 Table 10: Summary PESTLE analysis for F-35 IP theft...………………..……………45 Table 11: Summary PESTLE analysis for Sony Pictures..………………..…………..48 Table 12: Summary PESTLE analysis for SWIFT.………………..…………………...50 Table 13: Summary PESTLE analysis for Ukraine power………………..………..….52 Table 14: Summary PESTLE analysis for US election..………………..……………..54 Table 15: Summary PESTLE analysis for WannaCry..………………..………………55 Table 16: Combined PESTLE analysis………………………………..………………...56 Table 17: Summary of Porter’s Five Forces analysis………………………….....……63 Table 18: PESTLE analysis for Estonia...………………..……………………………...75 Table 19: PESTLE analysis for Georgia...………………..……………………………..77 Table 20: PESTLE analysis for Stuxnet..………………..……………………………...79 Table 21: PESTLE analysis for Saudi Aramco..………………..………………………81 Table 22: PESTLE analysis for F-35 IP theft...………………..………………………..83 Table 23: PESTLE analysis for Sony Pictures...………………..………………………85 Table 24: PESTLE analysis for SWIFT...………………..………………………………87 Table 25: PESTLE analysis for Ukraine power………………..………..……………...89 Table 26: PESTLE analysis for election interference..………………..……………….91 Table 27: PESTLE analysis for WannaCry..………………..………………….……….27 6 List of tables and figures (continued) Page Figure 1: Types of cyberattack………………….……………….…………………….…12 Figure 2: Cyberattacks considered in this report.……….……………………………..14 Figure 3: ZERODIM payouts for mobile phones………………………………………..30 Figure 4: Cyberattacks considered mapped to section numbers………………...…..35 7 Executive Summary Advances in technology have changed the way nation states conduct offensive operations, with cyber capabilities increasingly being used. With such rapid change it has been noted that more research is now needed into how the cyber domain fits into general strategic theory [1]. Traditionally this would be performed from a military perspective by looking at the direct comparison to kinetic means in terms of physical impact. With cyber weapons possessing a different set of characteristics, deployment and impact mechanisms, this report will propose, and demonstrate, that the application of business strategy methodologies to provide a suitable and insightful framework in which to consider the differences between cyber and kinetic attacks. Such frameworks can be used to explain the power dynamics between different actors within the cyber domain. The data from this work can then be used to analyse trends within operations using cyber weapons and conventional weapons in order to support decision making. Within the current body of work the use of business strategy frameworks specifically for cyber weapons have only been found in consultancy companies, such as Inkwood Research [2], rather than in research papers or governments. Consultancy sources require payment to access and so have not been viewed. Comparing results to my research were therefore not possible. This project aims to: • increase knowledge of the cyber domain required for strategic decisions making; • compare cyber and kinetic attacks which would achieve the same effect or objective; • determine what the strategic benefits of cyber weapons are compared to traditional attacks, as well as the limitations and challenges of cyber weapons. Historical examples of cyber weapons will be analysed using business strategy frameworks. These examples will be compared with alternative ways of achieving the same effect or objective using ‘traditional’ kinetic means and operations. A market overview of the cyber weapons field will also be completed ranging from low end, downloadable tools, up to very sophisticated, targeted capabilities. This will provide a clearer understanding of how the cyber weapons market operates. Key findings from analysis have been that cyber weapons: • can combine action at a distance, with close quarters accuracy and efficiency, permitting a new class of attacks which are de-risked versus conventional means; • offer the ability to strike rapidly, without warning across an entire network, propagating faster than investigators can react; • In the main have reversible effects and are limited in