The Wall Street Journal reports that the NSA is creating a cybersecurity directorate. It will ``replace the . . . information assurance directorate''. The paper reports that ``[t]here is a growing consensus that the U.S. . . . has often been too reluctant to engage offensively with cyber capabilities and that effective defense demands a more aggressive posture with adversaries.''
Like all information regarding the operations of the National Security Agency, there is no substantive information available. What does it mean to adopt a ``more aggressive posture''? Does this mean more deployment of cyber weapons?
In the absence of any formalized system of negotiations regarding arms control, it is silly to expect that NSA or its counterparts in Russia, China or elsewhere will provide any listing of its cyber weapons capabilities. Yet, even if such a list were sanctioned by national authorities to be shared, one wonders what would be listed. How can cyber weapons be enumerated?
NAMING SYSTEM FOR CYBER WEAPONS
Defined Bundles.
One option would be to have a defined code set for each weapon. A weapon would be defined by the specific action it is to take. Since there are a number of similar codes that accomplish almost the same thing but on different platforms, then this would require creation of a naming taxonomy that accounts for variations in software code.
Naming Convention by Code.
Another way to name a cyber weapon is by using a series of pre-assigned digits in a naming convention. In an alphanumeric code, an arrangement could be made that would identify the cyber weapon according to variables such as: (1) Operation system; (2) General type; (3) Class of target on which it is aimed; (4) Origin identifier; (5) National attribution; (6) General type of effect (erasure, modification, change of data); (7) Mechanism of transmission. So a sequence might be 1-BC-T7-AA-BB-EMC-74.
Although such a naming convention would be challenging to create, it might be useful when accepted. It would have the advantage of being able to keep track of a very large number of different weapons. Furthermore, it would make it easier to assess over time trends in vulnerabilities and attack strategies.
Such a type of numbering and identification system for cyber weapons would be robust enough to handle the thousands of types of malware. It would work in the same way that science is able to categorize genes, bacteria or viruses.