Schneier on Security

Skeptical • February 26, 2016 5:41 PM

I wonder though whether this reasoning neglects an assessment of the sensitivity of a tactical or strategic advantage to:

1 – the particular rate at which both knowledge of a vulnerability and the comprehensive capability (technological and institutional) to exploit that vulnerability spreads;

2 – the time differences between each actor’s acquisition of that knowledge (whether by original research or by the work of others);

3 – most importantly, the overall context (the particular technological, political, social, economic, configurations of each actor and of the overall system they together compose).

Obviously, NOBUS isn’t a static state; it’s a temporary state. And this is the case with nearly all advantages.

But – and this is somewhat oblique to the point I think that the post is driving at – perhaps NOBUS should not be understood to refer narrowly to knowledge of a particular vulnerability or an associated exploit, but rather to refer to the capability to exploit that vulnerability in a particular context such as to produce an unmatched tactical or strategic gain from it – regardless of whether other actors are aware of the vulnerability, or even also possess the capability to exploit it.

Let me lay out a quick, highly abstract scenario to illustrate.

Suppose actors Blue, Red, and Orange all discover vulnerability V_0 at time t_0. No actor is aware that any other actor has made this discovery.

Actor Blue has the assets (broadly encompassing everything from organizational expertise and processes to relevant deployed equipment to relationships with entities useful to the exploitation of V_0) to most rapidly exploit V_0 and to do so in manner that furthers its strategy in domains other than cyber to a greater extent than does Red or Orange.

Actors Red and Orange will both be able to exploit V_0 at a certain point, but the extent and effect of the exploitation may be more limited due to other factors. Nonetheless, viewed in an isolated perspective from Red’s or Orange’s position, exploitation of V_0 appears to produce gains for them.

Now, disclosure also does more than tell others about the vulnerability; it tells others that the disclosing party knows, and knew, about the vulnerability.

Even if Blue knows that Red and Orange are likely aware of V_0, Blue may wish to conceal its own knowledge of V_0 with the goal of encouraging Red and Orange to avoid taking steps that would advertise their respective awarenesses of V_0 – thereby, perhaps, leaving Red and Orange susceptible in a way that preserves a net advantage for Blue.

Moreover – because of the different capabilities of Blue, Red, and Orange, in some cases Blue may have capabilities that render Red’s or Orange’s exploitation of V_0 into a source of opportunity for Blue, whether in the cyber or in other domains.

To put this somewhat scattered musing more succinctly, NOBUS may not refer to merely knowledge of a particular vulnerability or to possession of a particular exploit, but may actually refer to an entire framework in which V_0 as undisclosed confers appreciably greater advantage to Blue.

Vulnerabilities also might be exploitable in an indirect manner that, in a sense, could qualify for NOBUS status. Let me give one extraordinarily speculative example for illustration. Let’s say V_0 could be exploited to grant access to a particular class of systems ranging from certain critical infrastructure to particular segmented government/contractor defense projects networks.

Let’s say the line of attack to these systems runs by necessity across your sensors. Perhaps you choose to allow V_0 to remain in place for a limited time. The cost will be compromise of certain bona fide defenes projects and plans, and the ability of a highly sophisticated actor to mount, temporarily, CNA operations against certain dams and power plants.

However, you include among those defense projects a program developing a vital piece of software that enables a 5th generation fighter aircraft to fly predictably and for its systems to interact in a predictable, safe, and effective manner. Another party has already stolen some of the hardware plans, and has clearly undertaken a major effort to copy the weapons platform entirely.

And this vital piece of software is both magnificently complex and yet marvelously susceptible to an abstracted understanding. Once one grasps the abstractions, which are clearly documented and referenced frequently, one acquires the sense that one understands the software. Sure, one may not have gone line by line through the code, looked at the runtime in granular detail, etc., but one loads it into the hardware and it works; one runs the tests already documented in the program, which seem very comprehensive, and they pass. One puts it into a prototype – and with a bit of learning, it works under all testable conditions at your disposal.

Should the other party steal it, this vital software would form the keystone in an enormously expensive military platform to which he has invested very substantial resources and on which certain key elements of his strategy for certain scenarios will rely.

However, under conditions that would only arise in case of conflict, or in any case at the initiative of yourself, that system will depart from expected operations with perhaps noticeably catastrophic effects, or perhaps more subtle (but quite unwanted from the perspective of the adversary) effects.

And this is because, being genuinely several steps ahead in this field, and having observed the theft of hardware associated with the project, and knowing the resources that the other party is pouring into its development efforts, you fully anticipate a large magnitude of resources to be aimed at obtaining other critical, but highly complex, components to the platform. And you realize that there is an opportunity here to waste vast amounts of the other party’s resources while compromising one of his key projects – and so you develop parallel critical components that are well-guarded, but are intended to be stolen.

And so – you stay quiet about V_0 – the other party scrambles to exploit it, knowing what it might be able to access using it. And the other party is intelligent about its use of V_0 – it does not chance discovery of its knowledge by utilizing it for lower value operations. Finally, the flag goes up: V_0 has been exploited. You lose some unaltered projects; you temporarily exposed some critical infrastructure to attack, but your deterrent to such attacks is credible and effective; and you’ve inserted weaknesses into a key foreign military program that will likely remain in place for some time. When discovered, that program will not only need to undertake years of auditing and additional research, but the integrity of other programs that incorporate stolen elements will be called into doubt as well. This weakens the other party’s strategies, and sets back their development years. The advantage may be temporary – but that is always the case.

This type of effort is – in the same sense which one might exploit an opponent’s vector of force in judo – an exploitation of V_0. And because it reuslts from a likely unique set of factors in a given time-frame, the exploitation here is of a NOBUS variety.

In any event, it’s just an example, but one would imagine that in considering the value of NOT disclosing a vulnerability, there would sometimes be advantages unique to the US (or to any party) due to the larger context in which the vulnerabilities are discovered and the way in which those vulnerabilities, undisclosed, can raise the probability of the creation of further advantages or opportunities.

Obviously, this is all entirely speculative. However, viewed from my very limited perspective, the general considerations above, and the general form of net assessments incorporating those considerations, along with the means by which potential adversaries might be led astray down expensive pathways that terminate upon unfavorable ground, seem at least within the realm of reasonable possibility.

Skeptical • February 27, 2016 7:28 PM

@name.withheld: You lost me at eigen I’m afraid, but I very dimly sense that Were my intention to have described formally a complete set of strategies for well defined game, at least some of those points could be important.

But my intention was much more limited: to simply suggest that the point of NOBUS may lie in the connection between a capability and the full strategic context (military, economic, social, political, etc). Apologies if some of the language I used suggested anything beyond that.

As to the hypothetical I provided, the point was simply that not all means of exploiting a vulnerability need be direct – and that therefore the importance of not disclosing one’s knowledge of a vulnerability can be difficult to assess unless one is acquainted with the full set of relevant facts.