Reacting to cyber‐intrusions: the technical, legal and ethical dilemmas Available to Purchase

Introduces the subject with the classical three‐layer security paradigm for information assurance of “protect, detect, react”, noting that it leaves open the question of who or what should react, and how. Lists 15 technical possibilities for a reactive defence to a presumed intrusion which vary greatly in their degree of aggression, mentions the problem of false positives in cases of active defence strategies, and relates the strategies to relevant legal and ethical considerations. Concludes that verification of a genuine intrusion incident is often very difficult, but the cost of failure will also be high; this is linked to the asymmetric nature of information warfare, where the cost of defence is much higher than the cost of attack.