Buy new:
-39% $20.14$20.14
$3.99 delivery January 30 - February 4
Ships from: Shakespeare Book House Sold by: Shakespeare Book House
Save with Used - Very Good
$2.18$2.18
$3.98 delivery February 4 - 5
Ships from: glenthebookseller Sold by: glenthebookseller
Download the free Kindle app and start reading Kindle books instantly on your smartphone, tablet, or computer - no Kindle device required.
Read instantly on your browser with Kindle for Web.
Using your mobile phone camera - scan the code below and download the Kindle app.
Follow the author
OK
Cyberdeterrence and Cyberwar
Purchase options and add-ons
- ISBN-100833047345
- ISBN-13978-0833047342
- PublisherRAND Corporation
- Publication dateNovember 16, 2009
- LanguageEnglish
- Dimensions6.1 x 0.57 x 9.15 inches
- Print length244 pages
Products related to this item
Editorial Reviews
Review
"Federal Security Spotlight," Federal News Radio, November 12, 2009
Martin Libicki is among the coterie of analysts and experts that have been pioneering the strategic study of cyber warfare at the RAND Corporation since the early 1990s, and is today one of the main researchers in this field. His book Cyberdeterrence and Cyberwar, as one of the first systematic attempts to apply the notion of deterrence to cyberspace, is groundbreaking in many respects.... A major challenge for twenty-first-century strategists is to gauge how much and how far theoretical concepts and legal regimes that were invented for a different era and different fields will be applicable to cyber and outer space. [This book is] a useful starting point for this task.
Survival, August-September 2010
From the Inside Flap
From the Back Cover
Product details
- Publisher : RAND Corporation (November 16, 2009)
- Language : English
- Paperback : 244 pages
- ISBN-10 : 0833047345
- ISBN-13 : 978-0833047342
- Item Weight : 13.6 ounces
- Dimensions : 6.1 x 0.57 x 9.15 inches
- Best Sellers Rank: #3,222,475 in Books (See Top 100 in Books)
- #365 in Military Sciences
- #3,537 in Political Intelligence
- #3,633 in Terrorism (Books)
- Customer Reviews:
About the author

Discover more of the author’s books, see similar authors, read book recommendations and more.
Related products with free delivery on eligible orders
Customer reviews
Customer Reviews, including Product Star Ratings help customers to learn more about the product and decide whether it is the right product for them.
To calculate the overall star rating and percentage breakdown by star, we don’t use a simple average. Instead, our system considers things like how recent a review is and if the reviewer bought the item on Amazon. It also analyzed reviews to verify trustworthiness.
Learn more how customers reviews work on AmazonTop reviews from the United States
There was a problem filtering reviews right now. Please try again later.
- Reviewed in the United States on October 17, 2015As a non-cyber expert, I like how this book highlights main talking points & concerns on the topic of Cybersecurity. This report has excellent references and definitions for entry-level students (or self-study employees). I cannot verify if the conclusions are "correct" or the research is "accurate," but it does attempt to address the questions surrounding cybersecurity and how the nation/DoD/gov't should approach the topic.
- Reviewed in the United States on March 28, 2013The book is good from a historical perspective, but this area has moved ahead dramatically and this is only history. Current situation is very different and very high risk
- Reviewed in the United States on November 17, 2014The audio book is difficult to start and stop because the tracks don't correlate to the chapters.
- Reviewed in the United States on January 20, 2013Doing the association between cyberwar and deterrence is interesting.
You should read it in order to understand cyberwar through another lens.
- Reviewed in the United States on December 6, 2009This is the first cogent look at the efficacy of waging strategic cyber war and I hope will serve to slow the rhetoric coming from the US Defense community about acquiring cyber offensive capability. I wrote before about the National Resource Council's report, "Technology, Policy, Law, and Ethics Regarding US Acquisition and Use of Cyberattack Capabilities". That report explored many of the same difficulties addressed by Libicki but came to different conclusions.
An introductory statement from Libicki:
All this might lead to a belief that the historic constructs of war--force, offense, defense, deterrence--can be applied to cyberspace with little modification.
Not so. Instead, cyberspace must be understood in its own terms, and
policy decisions being made for these and other new commands must
reflect such understanding. Attempts to transfer policy constructs from
other forms of warfare will not only fail but also hinder policy and
planning.
And:
As long as nations rely on computer networks as a foundation for military
and economic power and as long as such computer networks are
accessible to the outside, they are at risk. Hackers can steal information,
issue phony commands to information systems to cause them to
malfunction, and inject phony information to lead men and machines
to reach false conclusions and make bad (or no) decisions.
Continuing:
Yet system vulnerabilities do not result from immutable physical
laws. They occur because of a gap between theory and practice. In
theory, a system should do only what its designers and operators want it
to. In practice, it does exactly what its code (and settings) tells it to. The
difference exists because systems are complex and growing more so.
In all this lies a saving grace. Errors can be corrected, especially
if cyberattacks expose vulnerabilities that need attention. The degree
to which and the terms by which computer networks can be accessed
from the outside (where almost all adversaries are) can also be specified.
There is, in the end, no forced entry in cyberspace. Whoever
gets in enters through pathways produced by the system itself.1 It is
only a modest exaggeration to say that organizations are vulnerable to
cyberattack only to the extent they want to be. In no other domain of
warfare can such a statement be made.
Elaborating:
The salient characteristics of cyberattacks--temporary effects and
the way attacks impel countermeasures--suggest that they be used
sparingly and precisely. They are better suited to one-shot strikes (e.g.,
to silence a surface-to-air missile system and allow aircraft to destroy
a nuclear facility under construction) than to long campaigns (e.g., to
put constant pressure on a nation's capital). Attempting a cyberattack
in the hopes that success will facilitate a combat operation may be prudent;
betting the operation's success on a particular set of results may
not be.
Questioning:
But can strategic cyberwar induce political
compliance the way, say, strategic airpower would? Airpower tends to
succeed when societies are convinced that matters will only get worse.
With cyberattacks, the opposite is more likely. As systems are attacked,
vulnerabilities are revealed and repaired or routed around. As systems
become more hardened, societies become less vulnerable and are likely
to become more, rather than less, resistant to further coercion.
Answering:
Can cyberattacks disarm cyberattackers? In a world of cheap
computing, ubiquitous networking, and hackers who could be anywhere,
the answer is no.
Warning:
Can escalation be avoided? Even if retaliation is in kind, counterretaliation
may not be. A fight that begins in cyberspace may spill
over into the real world with grievous consequences.
And concluding:
The United States and, by extension, the U.S. Air Force, should not
make strategic cyberwar a priority investment area. Strategic cyberwar,
by itself, would annoy but not disarm an adversary. Any adversary that
merits a strategic cyberwar campaign to be subdued also likely possesses
the capability to strike back in ways that may be more than
annoying.
Lubicki is cafeful to make the distinction between espionage (CNE) and cyberattack which seeks to disrupt or corrupt.He also makes the point that attack is cheaper than defense. Thus deterrence could save money neeeded for defense but goes on to say:
The better one's defenses, the
less likely it is that an attack will succeed and so the less often a cyberdeterrence
policy will be tested. The longer such a policy goes untested,
the more credibility it acquires, if only through precedent.
Another good point:
...a good defense adds credibility to the threat to retaliate,
much in the way Herman Kahn argued that having bomb shelters
made nuclear deterrence more credible.
Libibki is not omniscient though.
Footnote 20 on page 11:
A fiendish variant is to attack computers that control manufacturing processes to retard the production of, ruin, or render dangerous the products of the processes. Such an attack could have nasty echoes. It is not clear, however, why any manufacturing process should be exposed to the outside world without very high levels of network protection.
From my discussions with manufacturers they have done little to segregate their production
environments from the Internet. They have even deployed Windows system down to the machine cell for management and reporting. Systems that do not lend themselves to frequent patching/rebooting schedules. Manufacturing is very vulnerable to these "fiendish variants".
Moving on, Libicki's conclusion from chapter 6:
It is thus hard to argue
that the ability to wage strategic cyberwar should be a priority area for
U.S. investment and, by extension, for U.S. Air Force investment. It
is not even clear whether there should be an intelligence effort of the
intensity required to enable strategic cyberwar.
And I cannot resist lauding a final conclusion that I have oft said:
This investigation suggests that, in this medium, the best defense is not necessarily a good offense; it is usually a good defense. -Excerpted from [...]
- Reviewed in the United States on December 16, 2015Wonderful.
- Reviewed in the United States on January 21, 2010I haven't read the book, but these reviews helped me realize, with all the other choices of where to spend my time, this isn't it.
If this quote is accurate:
"Yet system vulnerabilities do not result from immutable physical
laws. They occur because of a gap between theory and practice. In
theory, a system should do only what its designers and operators want it
to. In practice, it does exactly what its code (and settings) tells it to. The
difference exists because systems are complex and growing more so.
In all this lies a saving grace. Errors can be corrected, especially
if cyberattacks expose vulnerabilities that need attention. The degree
to which and the terms by which computer networks can be accessed
from the outside (where almost all adversaries are) can also be specified.
There is, in the end, no forced entry in cyberspace. Whoever
gets in enters through pathways produced by the system itself.1 It is
only a modest exaggeration to say that organizations are vulnerable to
cyberattack only to the extent they want to be. In no other domain of
warfare can such a statement be made. "
...then Mr. Libicki, with all due respect, is living in another universe.
The quote is not informative (worth republishing), nor alarmingly wrong through...
"Yet system vulnerabilities do not result from immutable physical
laws. They occur because of a gap between theory and practice. In
theory, a system should do only what its designers and operators want it
to. In practice, it does exactly what its code (and settings) tells it to. The
difference exists because systems are complex and growing more so.
In all this lies a saving grace. Errors can be corrected, especially
if cyberattacks expose vulnerabilities that need attention."
Although these errors can be corrected, it is incredibly childish analysis to leave it at that! The concept essentially follows: I'll figure out my weaknesses as my adversary attacks them, I'll then fix them, then go to bed. To not addresses the conditions which lead to these errors, or to anticipate that these "errors" will be vanquised is IMHO ridiculous. To not consider a counter attack (which may or not be cyber based) is irresponsible leadership.
But where I feel compelled to join Richard in considering this book (even if it is by this paragraph alone) potentially "harmful" is...
"The degree to which and the terms by which computer networks can be accessed
from the outside (where almost all adversaries are) can also be specified.
There is, in the end, no forced entry in cyberspace. Whoever
gets in enters through pathways produced by the system itself.1 It is
only a modest exaggeration to say that organizations are vulnerable to
cyberattack only to the extent they want to be. In no other domain of
warfare can such a statement be made."
I've read this at least 8 times now and cannot conceive that I'm misinterpreting it....
The utter lack of experience, rigor in analysis, and general operational ignorance demonstrated by this passage is ASTOUNDING! The ONLY way this statement could have any relevance is in a Information Security market where defenders have perfect information and infinite resources...reference, "Mr. Libicki, with all due respect, is living in another universe".
- Reviewed in the United States on August 31, 2010Well, this book has certainly stirred up some emotion. If you're on the fence about reading this book, you can get the PDF at the RAND web site and make up your mind about whether it belongs in your library (it is in mine).
This is a good book on a timely topic and adds quite a bit to the debate about the utility of the principle of deterrence through cyberweapons. Keep this focus in mind as this is not a general book about information/network security or even cyber warfare and its conclusions should not be taken out of context (which I humbly suggest Bejtlich did).
So, if you're interested in whether it makes real sense for the US to develop cyberweapons in the hope that our ability to do unto others will deter them from doing unto us, then do read this book as its conclusions may surprise you.