–No NC3 cyberattack impact – they’re not possible AND countermeasures solve.
Unal et al. ‘20 [Beyza Unal Head of the Science, Technology and International Security Unit at the United Nations Office for Disarmament Affairs, former Deputy Director of International Security at Chatham House, former Adjunct Instructor at Old Dominion University, PhD in International Studies from Old Dominion University, M.A. in International Relations from Bilkent University; Yasmin Afina Research Fellow in the Digital Society Initiative at Chatham House, PhD in Law from the University of Essex; Calum Inverarity Senior Researcher at the Open Data Institute, International Security Research Associate at Chatham House, M.S. in Conflict Resolution and Governance from the University of Amsterdam. “Ensuring Cyber Resilience in NATO’s Command, Control and Communication Systems,” Chatham House, 07-17-2020, https://www.chathamhouse.org/2020/07/ensuring-cyber-resilience-natos-command-control-and-communication-systems] [MSDI-JE-wk1]
It should be noted that there is disagreement among some experts regarding the actual extent of cyberthreats against C3 assets, in particular those for nuclear operations. NC3 assets are, however, in themselves complex, and are part of a wider – itself more complex – ‘ecosystem’ of networks, software and hardware making up the entire NC3 system. Offensive cyber capabilities are without doubt highly sophisticated at present, and such capabilities are in the hands of a small number of actors. In other words, cyberthreats need to be tailored to the targeted assets along with the NC3 ecosystem of which they are part, which may be difficult given the secrecy surrounding the technical information and specifications of these systems. This, then, could result in scepticism regarding the actual feasibility of conducting any cyber operations at all against NC3 assets: unless adversaries issuing such threats display credibility and trigger actual fear, targeted states will not fully grasp the level of risk such cyberthreats may pose to the NC3 systems. The preparation, conduct and operationalization of cyberattacks against systems as complex as NC3 would require not only a tremendous amount of financial, technical and human resources, but also a great deal of time – which may be further extended if any of the targeted system’s configurations are modified, requiring the malware to be ‘updated’ accordingly. The development of such offensive cyber means would require a high level of expertise and knowledge to:
Map out the NC3 system;
Understand the interaction and dependency between networked assets;
Identify potential vulnerabilities, entry points and additional layers of security;
Disable potential redundancies; and
Develop an accurate, effective malicious programme that would require testing before eventually being implanted to infect the NC3 ecosystem.