{"id":152,"date":"2019-02-15T15:49:23","date_gmt":"2019-02-15T15:49:23","guid":{"rendered":"http:\/\/donavan.sg\/blog\/?p=152"},"modified":"2019-02-15T15:52:52","modified_gmt":"2019-02-15T15:52:52","slug":"digital-defence","status":"publish","type":"post","link":"https:\/\/donavan.sg\/blog\/index.php\/2019\/02\/15\/digital-defence\/","title":{"rendered":"Digital Defence"},"content":{"rendered":"\n<p>It&#8217;s Total Defence Day in Singapore today. And for the first time in thirty-five years, there has been an <a href=\"https:\/\/www.straitstimes.com\/singapore\/digital-defence-to-be-sixth-pillar-of-total-defence\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"update to the framework (opens in a new tab)\">update to the framework<\/a>.<\/p>\n\n\n\n<p>Introduce Digital Defence.<\/p>\n\n\n\n<p>This was probably much called for, considering how the theatre of warfare has transcended physical space into the <a href=\"https:\/\/www.zdnet.com\/article\/cyberwar-a-guide-to-the-frightening-future-of-online-conflict\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"digital space (opens in a new tab)\">digital space<\/a>.<\/p>\n\n\n\n<p>The subject of digital warfare is too complicated to condense into a blog post, and I will not try to bore the reader. I will only glance through simple implications and betray their simplicity; often the simplest-sounding statements are the gravest.<\/p>\n\n\n\n<p><u>Digital Warfare Transcends Geography<\/u><\/p>\n\n\n\n<p>Most militaries in the physical domain arm themselves vis a vis the capabilities of their neighbours. Defence expenditure is dependent on the geopolitical neighbourhood and the existentialism of the threats an entity faces. Hence, a nation will arm itself up to the point of an effective deterrent vis a vis its perceived threats.<\/p>\n\n\n\n<p>But what if we remove geography from the equation?<\/p>\n\n\n\n<p>If we did that, defence expenditure would now become dependent on the global neighbourhood and the existentialism of the threats an entity faces regardless of location. The calculation of perceived threats will have to change. A football analogy suitable in Asia is the skills gap between being champion of the AFC Asian Cup and the World Cup. The playing field is vastly different; the footballing standard required to be AFC Asian Cup Champion is much lower than against the global giants in the World Cup.<\/p>\n\n\n\n<p>Digital warfare is no different, and the implication behind this is that digital warfare is <u>global<\/u>. All nations will eventually need to build globally credible digital defence forces, or risk themselves being repeated victims of cyber attacks. <a rel=\"noreferrer noopener\" aria-label=\"Now, everyone is forced to play in the World Cup, with dire consequences should they not be champion (opens in a new tab)\" href=\"https:\/\/www.straitstimes.com\/singapore\/digital-warfare-the-new-global-arms-race\" target=\"_blank\">Now, everyone is forced to play in the World Cup, with dire consequences should they not be champion<\/a>.<\/p>\n\n\n\n<p><u>Digital Warfare Will Cripple, Not Just Economically<\/u><\/p>\n\n\n\n<p>Digitalisation is irreversible; not many can imagine how much we will regress should we undo all the progresses in technology. In fact, many of us will find such a life unthinkable today. However, digitalisation, done insecurely, will cripple, and in ways beyond simple monetary losses.<\/p>\n\n\n\n<p>There are many attacks that illustrate this point, but nothing quite beats the December 2015 <a rel=\"noreferrer noopener\" aria-label=\"power grid takedown (opens in a new tab)\" href=\"https:\/\/jsis.washington.edu\/news\/cyberattack-critical-infrastructure-russia-ukrainian-power-grid-attacks\/\" target=\"_blank\">power grid takedown<\/a>, because of its implications. As the first successful cyber attack against a power grid, it has gained attention worldwide because it forced governments to start thinking, if they had not already done so, the likelihood and impact of such critical infrastructure being disrupted. Imagine the economic, psychological and financial damage this could entail.<\/p>\n\n\n\n<p>One can now apply the age-old adage in warfare:<br><\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p> &#8220;The supreme art of war is to subdue the enemy without fighting.&#8221; <\/p><cite>Sun Tzu&#8217;s &#8220;Art of War&#8221;<\/cite><\/blockquote>\n\n\n\n<p><br>How do we do so? Let us understand why a digital warfare campaign might be conducted. This can be for a variety of reasons:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>show of force<\/li><li>denial of availability<\/li><li>dampening trust in institutions, government or state<br><\/li><\/ul>\n\n\n\n<p>There will always be successful attacks that will cost. And some of these costs cannot be quantified. How do we assess the damage arising from the <a rel=\"noreferrer noopener\" aria-label=\"loss of trust (opens in a new tab)\" href=\"https:\/\/techbeacon.com\/security\/broken-promises-how-trust-affects-cybersecurity\" target=\"_blank\">loss of trust<\/a> and rebuild trust?<\/p>\n\n\n\n<p><u>Digital Warfare Will Force Us to Be Smarter Technology Users<\/u><\/p>\n\n\n\n<p>The average person exploits the digital world for his or her own benefit. But look beyond attractive user interfaces, and the average person may well be lost in the labyrinth of technology.<\/p>\n\n\n\n<p>Add an evil twist to the mix. Imagine you have a friend, X, who is utterly trusting of her friends because of years of friendship. As a result, they share everything and will trust one another to keep a lookout for them. Part of their digital activity would, of course, be sharing links to promotions, shopping deals and airfare discounts. Who wouldn&#8217;t click on links from their friends, X might think.<\/p>\n\n\n\n<p>One day, one of X&#8217;s friends receives a weaponised page that scaremongers X&#8217;s friend into clicking a PDF file, with a title that looks like clickbait (e.g. <strong>WHILE STOCKS LAST! FREE COURSE FOR FINANCIAL FREEDOM! ONLY FREE FOR SEVEN DAYS!<\/strong>). For instance, it could be a link with a tabloid-like headline that leads an unsuspecting victim to download a malicious PDF file, masqueraded as a premium review article available for free for only 7 days. Such time urgency is built to lure the user into clicking on the malicious file. This is one method of a <a rel=\"noreferrer noopener\" aria-label=\"client-side attack (opens in a new tab)\" href=\"https:\/\/www.offensive-security.com\/metasploit-unleashed\/client-side-exploits\/\" target=\"_blank\">client-side attack<\/a>. X&#8217;s friend clicks it, triggers a payload that hijacks his Facebook account, mass-propagates this exploit to all his friends, including X. This is behaviour characteristic of a <em>worm<\/em>. X, thinking that this is from her friend, trusts this as &#8220;good advice&#8221;, and clicks on the link, furthering the worm&#8217;s propagation. X notices a slowdown of her machine&#8217;s performance, and only realises she had become the victim of a worm when another friend raises some suspicion and questions why she would send a free course on financial freedom.<\/p>\n\n\n\n<p>Besides the obvious lessons to check before clicking, and to constantly update one&#8217;s protective software such as anti-virus, and enable 2FA on accounts, one subtle point is that many attacks exploit human weaknesses. These include unsuspecting victims who would scramble for any freebie he or she sees.<\/p>\n\n\n\n<p>Because many attacks mass-proliferate, and are engineered to exploit human weaknesses, we have to become smarter when using our technology. We should not just blindly click on every single URL-shortened link, for instance (<a rel=\"noreferrer noopener\" aria-label=\"what's really behind the bit.ly link? (opens in a new tab)\" href=\"https:\/\/support.bitly.com\/hc\/en-us\/articles\/230650447-Can-I-preview-a-bitlink-before-clicking-on-it-\" target=\"_blank\">what&#8217;s really behind the bit.ly link?<\/a>). <a rel=\"noreferrer noopener\" aria-label=\"Neither should we trust every single application on the App Store (opens in a new tab)\" href=\"https:\/\/appleinsider.com\/articles\/18\/09\/07\/more-malicious-apps-found-in-mac-app-store-that-are-stealing-user-data\" target=\"_blank\">Neither should we trust every single application on the App Store<\/a> just because it looks <em>kind&nbsp;of&nbsp;useful<\/em>. Oh, and we must expect, from time to time, that some of our favourite and\/or sensitive applications might become victims of data breaches. For example, a <a rel=\"noreferrer noopener\" aria-label=\"very unfortunate data breach happened to an online dating platform on... Valentine's Day (opens in a new tab)\" href=\"https:\/\/www.theverge.com\/2019\/2\/14\/18224702\/coffee-meets-bagel-data-breach-valentines-day\" target=\"_blank\">very unfortunate data breach happened to an online dating platform on&#8230; Valentine&#8217;s Day<\/a>. How heartbreaking.<\/p>\n\n\n\n<p>We must learn to be smarter, more discerning, and be accepting that things in digital space <em>can&nbsp;go&nbsp;wrong<\/em>. <\/p>\n\n\n\n<p>That&#8217;s all, folks, for a sombre Friday reading over the weekend. Have a happy weekend. (And an additional reading which may be of interest: how might the digital landscape change &#8212; according to <a rel=\"noreferrer noopener\" aria-label=\"Quora (opens in a new tab)\" href=\"https:\/\/www.quora.com\/What-can-we-expect-future-cyber-attacks-will-look-like\" target=\"_blank\">Quora<\/a>. This one may give sleepless nights.)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>It&#8217;s Total Defence Day in Singapore today. And for the first time in thirty-five years, there has been an update to the framework. Introduce Digital Defence. This was probably much called for, considering how the theatre of warfare has transcended physical space into the digital space. The subject of digital warfare is too complicated to&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[8,5,21],"tags":[],"class_list":["post-152","post","type-post","status-publish","format-standard","hentry","category-cybersecurity","category-digital-world","category-thoughts"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/donavan.sg\/blog\/index.php\/wp-json\/wp\/v2\/posts\/152","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/donavan.sg\/blog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/donavan.sg\/blog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/donavan.sg\/blog\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/donavan.sg\/blog\/index.php\/wp-json\/wp\/v2\/comments?post=152"}],"version-history":[{"count":3,"href":"https:\/\/donavan.sg\/blog\/index.php\/wp-json\/wp\/v2\/posts\/152\/revisions"}],"predecessor-version":[{"id":155,"href":"https:\/\/donavan.sg\/blog\/index.php\/wp-json\/wp\/v2\/posts\/152\/revisions\/155"}],"wp:attachment":[{"href":"https:\/\/donavan.sg\/blog\/index.php\/wp-json\/wp\/v2\/media?parent=152"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/donavan.sg\/blog\/index.php\/wp-json\/wp\/v2\/categories?post=152"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/donavan.sg\/blog\/index.php\/wp-json\/wp\/v2\/tags?post=152"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}