Cyber-warfare is disruption of the enemy’s communications and sources of information. Ideally, the enemy should doubt the integrity of his networks and the security of his transmissions. At a minimum, he will have to verify the information he receives, and use extra precautions in passing information on. Everything slows down. At best, he may not know who the attacker is, or even doubt it is an attack at all. Prudence requires defending what is vulnerable, but paranoia means defending against what does not exist, which is exactly what the attacker wants. When the CIA slipped bad software to the USSR and blew up a gas pipeline, the real damage came from the Soviets’ efforts to find whatever else may have been embedded in their systems.

The counter to cyber-warfare is not just building up defenses, but taking active measures to push the burden of uncertainty back onto the attacker. How well can the defender identify the attacker’s origins and routes of attack? Are there defenses that the attacker suspects but cannot be sure about? What kind of retaliation is available to the defender? Will the attack leave the attacker’s own resources vulnerable, and if so, which ones? Does the attacker even know the extent of the defender’s resources? In other words, which side can disrupt the opposing commanders’ ability to plan and act?

If knowledge is power, then FUD (fear, uncertainty, doubt) is ammunition.