TaoSecurity Blog

Yesterday I posted Latest PhD Thesis Title and Abstract . One of my colleagues Ben Buchanan subsequently contacted me via Twitter and we exchanged a few messages. He prompted me to think about the title. Later I ruminated on the title of a recent book by my advisor, Dr. Thomas Rid. He wrote Cyber War Will Not Take Place . One of the best parts of the book is the title. In six words you get his argument as succinctly as possible. (It could be five words if you pushed "cyber" and "war" together, but the thought alone makes me cringe, in the age of cyber-everything.) I wondered if I could transform my latest attempt at a thesis title into something that captured my argument in a succinct form. I thought about the obsession of the majority of the information security community on the tool and tactics level of war. Too many technicians think about security as a single-exchange contest between an attacker and a defender, like a duel. That reminded me of a proble

In January I posted Why a War Studies PhD ? I recently decided to revise my title and abstract to include attention to both offensive and defensive aspects of intrusion campaigns. I thought some readers might be interested in reading about my current plans for the thesis, which I plan to finish and defend in early 2018. The following offers the title and abstract for the thesis. Network Intrusion Campaigns: Operational Art in Cyberspace   Campaigns, Not Duels: The Operational Art of Cyber Intrusions* Intruders appear to have the upper hand in cyberspace, eroding users' trust in networked organizations and the data that is their lifeblood. Three assumptions prevail in the literature and mainstream discussion of digital intrusions. Distilled, these assumptions are that attacks occur at blinding speed with immediate consequences, that victims are essentially negligent, and that offensive initiative dominates defensive reaction.  This thesis examines these assumptions t