How an alliance evolves in cyberspace: a perspective from NATO.
Ambassador Sorin Ducaru shares his NATO experience. Nathan Mitchell Photography, courtesy of Billington CyberSecurity
By The CyberWire Staff
Mar 23, 2018

How an alliance evolves in cyberspace: a perspective from NATO.

NATO has developed an approach to cyberspace that takes it seriously as an operational domain.

Ambassador Sorin Ducaru, Senior Fellow, Hudson Institute, former Assistant Secretary General for Emerging Security Challenges, NATO, delivering the summit's final keynote.

NATO's experience with cyberattacks began in the late 1990s when its networks came under attack during the Atlantic Alliance's intervention in Kosovo. "Back then, cyber was regarded as a purely technical issue," Ducaru said.

This began to change in 2008, when NATO responded to Russia's 2007 cyberattacks ("Web War One") against Estonia. The Alliance established a NATO division of cyber responsibilities, a management structure, and mandatory defensive benchmarks. 2008 also saw the launch of NATO's Cyber Defense Center of Excellence, appropriately in Tallinn, Estonia. And 2010 saw implementation of further policy to address fast-developing 21st century security challenges.

"NATO now recognizes cyber as an operational domain as important as land, sea, and air," he said. This recognition implies planning and training to operate in that domain, and to prevail even when you must operate under degraded, contested conditions. 

In short, Ducaru said, cyber is now integrated into the NATO Defense Planning Process. He outlined some of the consequences of that integration. He's been pleased, first of all, with the Malware Sharing Platform (used to exchange indicators of malware), with NATO's Cyber Threat Assessment Cell, and with the NATO Cyber Rapid Reaction Teams.

And this has also opened up the prospect of voluntary contributions of member nations. NATO will not develop its own offensive capabilities, but will instead rely upon those of its member states.

He sees c loser coordination of crisis playbooks becoming increasingly important. "These will extend to operations that fall below the Article 5 level."

Ducaru made a plea that NATO address the digital battlefield on a strategic and operational level. "Bridge the gap between technical and policy dimensions of the cyber domain." This should include a focus on cross-domain deterrence, which he sees as offering many advantages, including especially the possibility of "proportional" responses. "And there must be a finely calibrated strategic communications approach, something the adversary must factor into its calculations."

NATO seems to be raising its cyber defense game, Ducaru concluded, and is becoming a true cooperative defense alliance in cyberspace. "It's about time. And it's important to sustain this momentum."