Search

Begin New Search Topic Security Political Geography Global Focus Content Type Working Paper Publishing Institution Carnegie Endowment for International Peace Publication Year within 5 Years

1. Phase-based Tactical Analysis of Online Operations

Author:
Ben Nimmo and Eric Hutchins
Publication Date:
03-2023
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
The online threatscape in 2023 is characterized by an unprecedented variety of actors, types of operation, and threat response teams. Threat actors range from intelligence agencies and troll farms to child-abuse networks. Abuses range from hacking to scams, election interference to harassment. Responders include platform trust-and-safety teams, government agencies, open-source researchers, and others. As yet, these responding entities lack a shared model to analyze, describe, compare, and disrupt the tactics of malicious online operations. Yet the nature of online activity—assuming the targets are human—is such that there are significant commonalities between these abuse types: widely different actors may follow the same chain of steps. By conducting a phase-based analysis of different violations, it is possible to isolate the links in the chain within a unified model, where breaking any single link can disrupt at least part of the operation, and breaking many links—“completing the kill chain”—can disrupt it comprehensively. Using this model will allow investigators to analyze individual operations and identify the earliest moments at which they can be detected and disrupted. It will also enable them to compare multiple operations across a far wider range of threats than has been possible so far, to identify common patterns and weaknesses in the operation. Finally, it will allow different investigative teams across industry, civil society, and government to share and compare their insights into operations and threat actors according to a common taxonomy, giving each a better understanding of each threat and a better chance of detecting and disrupting it.
Topic:
Security, Internet, and Non-Traditional Threats
Political Geography:
Global Focus

2. Financial Markets and Social Media: Lessons From Information Security

Author:
Claudia Biancotti and Paolo Ciocca
Publication Date:
11-2021
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
On January 28, 2021, stocks in U.S.-based video game retailer GameStop Corp. reached an all-time high of $483. Two weeks earlier, they had been trading at $20. Two weeks later, they were down again, and a congressional hearing on the matter was underway in Washington. Wild swings are hardly uncommon in financial markets. This episode, however, had novel characteristics. In a recent report, the U. S. Securities and Exchange Commission states that “GameStop Corp and multiple other stocks experienced a dramatic increase in their share price in January 2021 as bullish sentiments of individual investors filled social media.” 1 Retail traders congregating on the Reddit platform were key in both price formation and the emergence of a “Main Street versus Wall Street” narrative around the stock.2 The influence of social media on financial markets is here to stay, as younger generations start saving and investing. This carries both opportunities and risks. Information sharing and discussion on internet platforms can improve market transparency and efficiency. On the other hand, social media platforms are known vehicles of disinformation and manipulation of human behavior. They could be weaponized by malicious actors, ranging from state-sponsored groups to crime syndicates, looking to compromise market integrity and financial stability. For liberal democracies with independent financial watchdogs, a complex policy challenge follows. In order to fight information operations, financial authorities will need to cooperate with intelligence communities and other relevant parts of executive branches. This requires rules that clearly define each party’s role and encourage reciprocal trust. In many jurisdictions, cybersecurity statutes provide a starting point. They are, however, limited in scope, only covering cooperation vis-& agrave;-vis traditional cyber attacks. In this paper, we argue that the model must evolve to help prevent or defend against malicious information operations.3 We highlight, as a first step, the importance of organizational modules that allow entities with different levels of access to classified information to work together to assess and inform responses to hostile operations.
Topic:
Security, Markets, Finance, and Social Media
Political Geography:
Global Focus and United States of America

3. Cyberspace and Geopolitics: Assessing Global Cybersecurity Norm Processes at a Crossroads

Author:
Christian Ruhl, Duncan Hollis, Wyatt Hoffman, and Tim Maurer
Publication Date:
02-2020
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
As cyber insecurity has become a growing problem worldwide, states and other stakeholders have sought to increase stability for cyberspace. As a result, a new ecosystem of “cyber norm” processes has emerged in diverse fora and formats. Today, United Nations (UN) groups (for example, the Group of Governmental Experts [GGE] and the Open-Ended Working Group [OEWG]), expert commissions (for example, the Global Commission on the Stability of Cyberspace), industry coalitions (for example, the Tech Accord, the Charter of Trust), and multistakeholder collectives (for example, the Paris Call for Trust and Security in Cyberspace) all purport to identify or operationalize various normative standards of behavior for states and/or other stakeholders in cyberspace. As some of these processes wind down (for example, the Global Commission) and others wind up (for example, the OEWG), cyber norms are at a crossroads where each process’s potential (and problems) looms large.
Topic:
Security, Science and Technology, Cybersecurity, Geopolitics, and Norms
Political Geography:
Global Focus

4. Enduring Cyber Threats and Emerging Challenges to the Financial Sector

Author:
Adrian Nish, Saher Naumaan, and James Muir
Publication Date:
11-2020
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
Cybersecurity is a unique challenge for the financial sector. To prevent massive financial losses, banks and other financial institutions should understand how cyber threat groups could launch complex new cyber attacks. At the time of writing, several financial services firms are working to restore their networks following disruptive cyber attacks. Banks in Chile and Seychelles, as well as financial technology companies like Silverlake Axis, a supplier of core banking systems throughout the Asia-Pacific, are all reportedly victims of separate ransom and extortion attempts. Elsewhere, the threat from cyber criminals triggered a suspension of automatic teller machine (ATM) transactions overnight, and hackers recently knocked websites associated with a stock exchange offline using distributed denial-of-service (DDoS) attacks. Such disruptions not only impact customers of these services, but also undermine the confidence of peers in the financial services community. Regulators have been taking increasing notice of these cyber threats, and operational resilience has shot to the top of agendas around the world. A few years ago, targeted attacks on financial services sector firms were still relatively rare. However, cases have increased in recent years as capabilities and specialisms such as network intrusion have advanced. BAE Systems in partnership with the Carnegie Endowment for International Peace has documented public examples via the Timeline of Cyber Incidents Involving Financial Institutions. This timeline serves as a useful resource in tracking trends, even though public cases are just the tip of the iceberg and the true volume of incidents and near misses is much greater.
Topic:
Security, Finance, Non-Traditional Threats, and Cyberspace
Political Geography:
Global Focus

5. Deepfakes and Synthetic Media in the Financial System: Assessing Threat Scenarios

Author:
Jon Bateman
Publication Date:
07-2020
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
Bad actors could use deepfakes—synthetic video or audio—to commit a range of financial crimes. Here are ten feasible scenarios and what the financial sector should do to protect itself. Rapid advances in artificial intelligence (AI) are enabling novel forms of deception. AI algorithms can produce realistic “deepfake” videos, as well as authentic-looking fake photos and writing. Collectively called synthetic media, these tools have triggered widespread concern about their potential in spreading political disinformation. Yet the same technology can also facilitate financial harm. Recent months have seen the first publicly documented cases of deepfakes used for fraud and extortion. Today the financial threat from synthetic media is low, so the key policy question is how much this threat will grow over time. Leading industry experts diverge widely in their assessments. Some believe firms and regulators should act now to head off serious risks. Others believe the threat will likely remain minor and the financial system should focus on more pressing technology challenges. A lack of data has stymied the discussion.
Topic:
Security, Cybersecurity, Artificial Intelligence, and Non-Traditional Threats
Political Geography:
Global Focus

6. Moving the Encryption Policy Conversation Forward

Author:
Encryption Working Group
Publication Date:
09-2019
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
Strong data encryption thwarts criminals and preserves privacy. At the same time, it complicates law enforcement investigations. A Carnegie working group looks to move the debate forward.
Topic:
Security, Science and Technology, Law Enforcement, and Privacy
Political Geography:
Global Focus and United States of America

7. ICT Supply Chain Integrity: Principles for Governmental and Corporate Policies

Author:
Ariel Levite
Publication Date:
10-2019
Content Type:
Working Paper
Institution:
Carnegie Endowment for International Peace
Abstract:
In an increasingly digitized world, information and communication technologies (ICTs), and especially operational technologies (OTs), have assumed critical importance for governments, industry, and the general public worldwide. Yet trust in the integrity of these products and services is declining because of mounting concerns over inadvertent vulnerabilities in the supply chain and intentional backdoor interventions by state and corporate actors. Compounding the problem, these legitimate security concerns are sometimes exaggerated for political and commercial reasons—a counterproductive dynamic that fuels rivalries, fragments the marketplace, increases anxiety, stifles innovation, and drives up costs. Inarguably, some governments have been intervening in the ICT/OT supply chain or at least laying the groundwork for such interventions. They believe the pursuit to be justifiable and legal, citing objectives related to intelligence, law enforcement, and military operations. Whether valid or not, the concern is that certain corporations are actively or passively weakening the security of the supply chain and final products either at the behest of governments or for questionable purposes. Another concern is that both state and corporate interventions could leverage or mask what are purely lax security standards or flaws in products and services. And this further reduces trust in ICT/OT.
Topic:
Security, Government, Science and Technology, and Private Sector
Political Geography:
Global Focus