"Cyber war is coming," announced a land-mark RAND report in 1993. In 2005, the U.S. Air Force boasted it would now fly, fight, and win in cyberspace, the "fifth domain" of warfare. This book takes stock, twenty years on: is cyber war really coming? Has war indeed entered the fifth domain? Cyber War Will Not Take Place cuts through the hype and takes a fresh look at cyber security. Thomas Rid argues that the focus on war and winning distracts from the real challenge of cyberspace: non-violent confrontation that may rival or even replace violence in surprising ways. The threat consists of three different vectors: espionage, sabotage, and subversion. The author traces the most significant hacks and attacks, exploring the full spectrum of case studies from the shadowy world of computer espionage and weaponised code. With a mix of technical detail and rigorous political analysis, the book explores some key questions: What are cyber weapons? How have they changed the meaning of violence? How likely and how dangerous is crowd-sourced subversive activity? Why has there never been a lethal cyber attack against a country's critical infrastructure? How serious is the threat of "pure" cyber espionage, of exfiltrating data without infiltrating humans first? And who is most vulnerable: which countries, industries, individuals?

/pdf/cyber-war-will-not-take-place-53xtj6is5g.pdf

Cyber War Will Not Take Place

For almost two decades, experts and defense establishments the world over have been predicting that cyber war is coming. But is it? This article argues in three steps that cyber war has never happened in the past, that cyber war does not take place in the present, and that it is unlikely that cyber war will occur in the future. It first outlines what would constitute cyber war: a potentially lethal, instrumental, and political act of force conducted through malicious code. The second part shows what cyber war is not, case-by-case. Not one single cyber offense on record constitutes an act of war on its own. The final part offers a more nuanced terminology to come to terms with cyber attacks. All politically motivated cyber attacks are merely sophisticated versions of three activities that are as old as warfare itself: sabotage, espionage, and subversion.

Cyber war will not take place

https://oem.bmj.com/content/oemed/9/3/232.2.full.pdf

The Human Use of Human Beings

Piaget’s Theory of Cognitive Development

Group -learning is one of the teaching styles in distance education of TV university. It serves for the teaching with other styles such as self-learning, invidual assistant, face-to-face classes and classes on net. In this paper, the author analyzes the characters and the roles. From this aspect the writer also give out other related opinions on teaching methods,the orqnization and guiding of group-learning.

On Group- learning

At the time of the state-wide cyber attacks in 2007, Estonia was one of the most developed nations in Europe regarding the ubiquitous use of information and communication technology (ICT) in all aspects of the society. Relaying on the Internet for conducting a wide range of business transactions was and still is common practice. Some of the relevant indicators include: 99% of all banking done via electronic means, over a hundred public eservices available and the first online parliamentary elections in the world. But naturally, the more a society depends on ICT, the more it becomes vulnerable to cyber attacks. Unlike other research on the Estonian incident, this case study shall not focus on the analysis of the events themselves. Instead it looks at Estonia's cyber security policy and subsequent changes made in response to the cyber attacks hitting Estonia in 2007. As such, the paper provides a comprehensive overview of the strategic, legal and organisational changes based on lessons learned by Estonia after the 2007 cyber attacks. The analysis provided herein is based on a review of national security governing strategies, changes in the Estonia’s legal framework and organisations with direct impact on cyber security. The paper discusses six important lessons learned and manifested in actual changes: each followed by a set of cyber security policy recommendations appealing to national security analysts as well as nation states developing their own cyber security strategy.

Estonia after the 2007 Cyber Attacks: Legal, Strategic and Organisational Changes in Cyber Security

The Republic of Estonia leads Europe in the provision of public digital services. The national communications and transactions platform allows for twenty-first century governance by allowing for transparency, e-safety (inter alia privacy), e-security, entrepreneurship and, among other things, rising levels of prosperity, and well-being for all its Citizens. However, a series of Information Infrastructure attacks against the Estonian e-society infrastructure in 2007 became one of best known incidents and experiences that fundamentally changed both Estonian and international discussions about Cyber Security and Privacy. Estonian experience shows that an open and transparent attitude provides a good foundation for trust between the Citizen and the State, and gives more control to the real owner of the data - the Citizen. Another important lesson is that the Citizen needs to be confident in the government’s ability to keep their data safe -- in terms of confidentiality, integrity and availability - establishing a strong link between privacy and information security. This paper discusses certain critical choices, context, and events connected to the birth and growth of the Estonian e-society in terms of Privacy.

/pdf/personal-control-of-privacy-and-data-estonian-experience-58oiady6k2.pdf

Personal control of privacy and data: Estonian experience

Cyber security exercises are believed to be the most effective training for the training audiences from top professional teams to individual students. However, evidence of learning outcomes is often anecdotal and not validated. This paper focuses on measuring learning outcomes of technical cyber defense exercises (CDXs) with Red and Blue teaming elements. We studied learning at Locked Shields, which is the largest unclassified defensive live-fire CDX in the world. This paper proposes a novel and simple methodology, called the “5-timestamp methodology”, aiming at accommodating both effective feedback (including benchmarking) and learning measurement. The methodology focuses on collection of timestamps at specific points during a cyber incident and time interval analysis to assess team performance, and argues that changes in performance over time can be used to evidence learning. The timestamps can either be collected non-intrusively from raw network traces (such as pcaps, logs) or using traditional methods, such as interviews, observations and surveys. Our experience showed that traditional methods, such as self-reporting, fail at high-speed and complex exercises. The suggested method enhances feedback loop, allows identifying learning design flaws, and provides evidence of learning value for CDXs.

Improving and Measuring Learning Effectiveness at Cyber Defense Exercises

The capability and mandate for organized violence in the interna‑ tional setting has normally been the domain of nation‑states. Cyberspace however provides an international arena where almost anyone has the power to attack any target at will. While most of these attacks have little eﬀect there is often little disincentive to using them as attribution of cyber attacks and eﬀective punishment of attackers is still the exception instead of the norm. Thus 21st century farmers with pitchforks or cyber militia become more than a local force and if organized well enough can mount an oﬀensive cyber cam‑ paign that aﬀects a nation‑state on the other side of the planet. In order to test this claim I will consider the potential threat from the Internet users who are untrained in hacking techniques and who have very limited resources. In general there are two types of activities that are open to such persons: supporting the cyber campaign by providing resources cover and training (among other things and launching cyber attacks as part of the cy‑ ber campaign. It is important to note that an untrained individual is probably more useful when providing support to skilled attackers instead of actually participating in the cyber attacks. Based on the overview of the simple options that are available for a novice cyber attacker I will draw some conclusions on the actual threat posed by a (ad‑hoc cyber militia of amateurs.

From pitchforks to laptops: volunteers in cyber conflicts

Abstract It is often difficult to meaningfully convey concepts like security incident management cycle, information sharing, cooperation, as well as the roles of people, processes and technology in cybersecurity courses. Serious gaming can help solve this problem, since it can provide a more immersive and interactive learning experience than traditional methods. This paper presents a light weight tabletop exercise format that has been successfully used in cybersecurity education to demonstrate these and many other concepts to Master level students in two European universities over the past 5 years. The term light weight is chosen to indicate the low work load and resource requirements for the instructor. The paper provides practical guidance on how to develop and execute such exercises. In addition, it lists observations of concepts and recommended discussion points that have been successfully demonstrated in class using this exercise format.

Rain Ottis

Papers

Estonia after the 2007 Cyber Attacks: Legal, Strategic and Organisational Changes in Cyber Security

Personal control of privacy and data: Estonian experience

Improving and Measuring Learning Effectiveness at Cyber Defense Exercises

From pitchforks to laptops: volunteers in cyber conflicts

Light Weight Tabletop Exercise for Cybersecurity Education