Are US Cyber Deterrence Operations Suppressing or Inciting Attacks?
summary
Argues the US now uses offensive cyber operations to impose friction for deterrence and offers a repeatable framework to assess whether that reduces or amplifies attacks. Proposes concrete metrics — OPM-style incidents as a quick signal, volumetric metrics (malware, C2 sightings), target-set checks (election or grid access), metrics of recklessness and brazen TTPs — and demonstrates using Cyber Threat Alliance observables plus severity scoring, while noting baseline, attribution and visibility gaps prevent strict causation.
AI-written summary · about
chapters (15)
- 0:00Intro
- 2:20The US Argument
- 5:15How Do We Start
- 6:18Baseline
- 11:55Reckless
- 13:50Aggressive
- 14:28Other categories
- 15:28CTA data collection
- 17:24Future research
- 18:03What is acceptable adversary behavior
- 20:14How do you handle the sample bias problem
- 22:24Should we consider interpreting the APT29 spearfishing campaign as a public rebuke
- 24:19Government regulation of deterrence policies
- 26:22The wrong criteria for measuring success
- 29:09How to deter capability development from less sophisticated adversaries
related talks
47mRough and Ready: Frameworks to Measure Persistent Engagement and Deterrence
40mDeterrence and Strategic Response to Cyber Operations
21mFull-Spectrum Information Ops for Critical Infrastructure Attacks & Disruption
29mCyber War in Perspective: Analysis From the Crisis in Ukraine
09mDisrupting Cyber Adversaries: Meta's Approach to Deterrence
49mResponding to a Cyber Attack with Missiles
24mHow to prevent cyberwar
10mCCyberattacks: Is the Juice Worth the Squeeze?