"Strategic Warfare in Cyberspace" (SWIC) takes discussions of information security policy to a new level. Lt Col Rattray is uniquely qualified to write this book, serving as commander of the 23rd Information Operations Squadron in the Air Force Information Warfare Center. While I was a captain in the Air Force Computer Emergency Response Team, he asked me if we were ready to defend against strategic information warfare attacks. His research into this issue forms the core of his excellent book.
SWIC is not written for technical staff. Rattray is a fellow Air Force Academy and Harvard University graduate, and I recognize his writing style and methodology as an effort to develop analytical frameworks. He takes an innovative approach, comparing American strategic information warfare efforts of the 1990's to development of the Army Air Corps' capability to wage strategic precision bombing. Rattray offers four enabling conditions for successful strategic warfare and five facilitating factors for establishing organization technological capabilities. He critiques strategic air war and strategic information war using these elements, drawing policy conclusions and making recommendations for future actions.
SWIC is highly original, very thorough, and well-documented. Rattray and I are both history/political science majors, so I found his discussion of Air Corps history enlightening. Readers more interested in conclusions may be tempted to skip this material. SWIC falls short in its descriptions of technical means to wage digital warfare. Someone with hands-on knowledge of specific attack and defense tools and techniques should have helped Rattray refine his understanding of the technical aspects of computer security. Nine years have passed since Farmer and Venema wrote the 'SATAN' assessment tool, yet contemporary writers still believe it exemplifies current threats. What about Nmap, which is five years old but actively maintained and used daily?
Overall, SWIC seems right on the money in its analysis and conclusions. Rattray correctly identifies that American information warfare defenses are far too crime-oriented, probably due to the FBI's role. He stresses the need to improve people and processes, not just products. He faults the government for omitting technology vendors from the protection of critical infrastructure, and criticizes federal policy mistakes regarding encryption. Government, military, and industry policymakers should read and heed Rattray's book before an adversary tests the United States' capability to wage strategic information warfare.