What Is the Cyber Offense-Defense Balance? Conceptions, Causes, and Assessment

Abstract

Most scholars and policymakers claim that cyberspace favors the offense; a minority of scholars disagree. Sweeping claims about the offense-defense balance in cyberspace are misguided because the balance can be assessed only with respect to specific organizational skills and technologies. The balance is defined in dyadic terms, that is, the value less the costs of offensive operations and the value less the costs of defensive operations. The costs of cyber operations are shaped primarily by the organizational skills needed to create and manage complex information technology efficiently. The current success of offense results primarily from poor defensive management and the relatively simpler goals of offense; it can be very costly to exert precise physical effects using cyberweapons. An empirical analysis shows that the Stuxnet cyberattacks on Iran's nuclear facilities very likely cost the offense much more than the defense. The perceived benefits of both the Stuxnet offense and defense, moreover, were likely two orders of magnitude greater than the perceived costs, making it unlikely that decisionmakers focused on costs.

Governing Uncertainty or Uncertain Governance? Information Security and the Challenge of Cutting Ties

“…Security controls for these vulnerabilities, such as scanning systems for known software problems and fixing them, are also well-known. The larger problem is implementing those controls in extremely complex and highly interconnected systems (Slayton 2017).…”

A tale of two cybers - how threat reporting by cybersecurity firms systematically underrepresents threats to civil society

“…involves the use of the internet for espionage" (Gartzke, 2013, p. 70). The limited effectiveness of cyber operations as means of warfare, coercion and destruction has since been emphasized by an increasing number of scholars (Borghard & Lonergan, 2017;Slayton, 2017;Smeets, 2018). In short, acts of violence or physical destruction involve non-trivial operational challenges that only powerful actors are both likely to overcome and unlikely to have interests in, given other more reliable ways of generating coercive harm.…”

Prospects and Challenges to Arms Control in South Asia

“…Moreover, difficulty in recognizing offensive and defensive nature of cyber capabilities also exaggerate the security dilemma. Despite the fact that states are guided by primarily defensive interests, however, increase in such capabilities enhanced other's threat perceptions (Slayton, 2016/17).…”