Distinguishing Cyberattacks by Difficulty

Abstract

Some discussions of cyberattacks paint them broadly as low cost and widely available, failing to distinguish cyberattacks by difficulty. However, as the literature has long recognized, cyberattacks are not all alike. The most sophisticated attacks require greater capabilities, including noncyber capabilities, that are commanded by only by a handful of states. Assessment of the difficulty of cyberattacks therefore requires a broader view of a cyberattack than a view focused on gaining and maintaining unauthorized access to a computer. The proposed Cyber Effects model of a cyberattack looks to the ultimate effect sought by the attacker, which may be focused only on gaining access to a device or may seek access to produce a cascade of external effects. This model can then be used as a conceptual model to organize factors that bear on attack difficulty for assessment.