During the Cold War, the U.S. and the former Soviet Union pursued a policy of mutually assured destruction (MAD). I am wondering if it is safe to assume that organizations such as the National Security Administration and its counterparts in Russia are now pursuing a similar strategy vis-a-vis cyber warfare. I read in the newspapers about the vulnerability of the electrical grid and the banking system. Could it already be true that both the Russian and the U.S. governments have the capability of taking down each others' electrical grids and banking systems?
closed as primarily opinion-based by ThoriumBR, Steffen Ullrich, kasperd, S.L. Barth, Matthew Jan 3 '17 at 10:08
Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.
While, as others have said, Mutually Assured Destruction is not something that could apply to Cyber Security, it is certainly true that tit-for-tat cyber aggression has been going on for quite a while and has been pretty nasty over the last few years between the main government supported hacking groups.
Indeed, I believe that the USA did a deal with a large competitive country around 18m or maybe a bit less ago to get them to calm things down.
One of the issues with cyber warfare of course is that it is very difficult to attribute so those of us not involved with cyber military/intelligence can never be sure who is doing what.
The bottom line, though, is that security is certainly not "good enough", not in any industry sector - even a few days ago, one of the US electricity companies found some malware on an offline computer though thankfully not one (at least that they admit to) that was controlling the grid.
Anyone following the cyber security news will painfully be aware of the vulnerabilities in many industries including critical ones such as government, health, city control ("smart" cities), power, ...
However, I do not believe that the capability exists currently for one attacker to take down an entire power grid in any of the major, large, countries. In general, they are too fragmented to be brought down in a single attack.
Similarly, banking is very tightly controlled and banks are very cautious about their systems and how they are interacted with. They have numerous interlocking safety mechanisms to prevent mass fraud or other manipulations. Indeed, the biggest worry with banking is attacks undermining public confidence rather than actual failure of the systems.
UPDATE: MAD does not exist in the cyber realm because of the vast complexity involved and because the physical world is relatively unimpacted (compared to nuclear holocaust).
You can take down a network maybe, a website for a while, you can steal lots of data. But most systems have backups and are quickly restored with new patches and security added.
The worst cyber attacks so far have taken down an organisation for a few days. Sony Pictures may have been the worst admitted too, they were off for a couple of weeks I think but they had appalling security!
One of the biggest current fears in cyber security is un-noticed changes to data rather than mass encryption or theft. We've yet to see a big example of that but I know that there are lots of experts who are worried about that. But even that doesn't amount to world destruction, the worst that is likely to happen is that a government would fail - maybe some lives lost (if certain industries were impacted, like health). Understand that I'm not dismissing such impacts, they are certainly severe, but they don't rank amongst impacts like MAD.
In regard to your comment about banking. Whilst nobody in their right mind would consider banks as entirely "good" actors after the litany of bad things that have happened over the last decade. Most countries have remarkably tight rules regarding banking for this very reason. In any case, most banks carry their own liabilities - even though they may be bailed out by governments, it comes at a terrific price to the people in charge. They are so carefully inspected in the majority of countries that wrong-doings inevitably are found out in the end. There are also too many people involved inside the banks for such things to be well hidden - the well-known banking issues were mainly caused in areas where a relatively few people control everything.
I would argue that the poster stating that MAD does not apply in cyberwarfare is inaccurate, in that systems are not nearly isolated enough from one another to prevent countries from attacking and destroying a significant portion of internet and other infrastructure. One of my best examples would be to point you to the massive cyberattack in 2007 on the Estonian internet infrastructure.
If the Russians can take down a small country's infrastructure for whom they do not spend significant amounts of time devising an attack strategy, just wonder what the US and Russia could do to each other with the thirty odd years they have been preparing for war with one another.
Even more interesting is the case of military cyberattack preparation of the Chinese during Operation Titan Rain. They, I would assume, have as much capability as the Russians to create widespread disruption/destruction.
I can safely say that cyberwarfare becomes an ever more dangerous way for nation-states to attack one another, even if it does not yet reach the level of MAD.