Attacks on information systems are already a fact of life in the Information Age. Although a small portion of these attacks result in significant loss or damage, the vast majority of them result in little or no damageù the crime equivalents of trespassing, public nuisance, minor vandalism, and petty theft. It has been estimated that more than 90 percent of these attacks are perpetrated using available tools and techniques (based upon incidents reported to CERT), that only 1 attack in 20 is noticed by the victim, and that only 1 in 20 gets reported (these last two statistics were a result of a Defense Information Systems Agency (DISA) study and similar rates have been reported by others). However, it appears that reporting rates may be on the increase.
Of more concern is the presence of a technically feasible "strategic" threat. That is, the means exist to cause significant damage and disruption to U.S. public and private information assets, processes, and systems, and to compromise the integrity of vital information. Analysts also have no difficulty identifying groups with the motivations and opportunities to launch such attacks. Given our present vulnerabilities as a nation, a well-planned, coordinated IW attack could have strategic consequences. Such an attack, or the threat of such an attack, could thwart our foreign policy objectives, degrade military performance, result in significant economic loss, and perhaps even undermine the confidence of our citizens in the Government's ability to protect its citizens and interests.
While no "smoking keyboard" has been found to validate such a threat, the very existence of the means to carry out such an attack, when coupled with the myriad of motives and opportunities that exist, results in our present state of vulnerability. These circumstances have created a situation that calls for prudent defensive actions to be taken in the public interest. We need to be proactive rather than be forced to react after an Information Age "Pearl Harbor." Moreover, a successful strategic attack would point the way and encourage others to plan similar attacks. Hence, we need to go on the offensive with a vigorous defense.