Cyber Statecraft Initiative

Nather in CSO: defining linchpins an industry perspective on remediating Sunburst

The Sunburst campaign underscored the inherent risk of technology to the public and private organizations who use it. It is important to examine what happened, look for opportunities to improve, and move forward. The Atlantic Council’s latest report “Broken Trust: Lessons from Sunburst” introduces the concept of “linchpins,” which it defines as “widely used software with significant permissions … on […]

Herr testifies to the Investigations and Oversight and Research and Technology subcommittees on improving the cybersecurity of software supply chains

On May 25, 2021, Trey Herr, Director of the Cyber Statecraft Initiative within the Scowcroft Center for Strategy and Security, testified to the House Science, Space, and Technology subcommittees on Investigations and Oversight and Research and Technology on improving the cybersecurity of software supply chains following SolarWinds.

Herr, Handler, and Schroeder on the Cipher Brief’s State Secrets podcast

By Atlantic Council

Trey Herr, Simon Handler, and Emma Schroeder join the Cipher Brief’s State Secrets podcast to discuss their recent report on the Sunburst cyber-espionage campaign.

Herr in Foreign Policy: Russia’s hacking success shows how vulnerable the cloud is

Russia’s Sunburst cyberespionage campaign, discovered late last year, impacted more than 100 large companies and U.S. federal agencies, including the Treasury, Energy, Justice, and Homeland Security departments. A crucial part of the Russians’ success was their ability to move through these organizations by compromising cloud and local network identity systems to then access cloud accounts and pilfer emails […]

Handler, Schroeder, and Herr in War on the Rocks: cyber security as counter terrorism seeking a better debate

Earlier this month, a senior Justice Department official referred to ransomware as a potential “cyber weapon of mass destruction.” When hackers subsequently disabled the Colonial Pipeline, causing fuel shortages and disruptions along the East Coast, it seemed to validate this warning. But it would be a mistake for the policy establishment to double down on an outdated […]

Handler, Schroeder, and Herr in War on the Rocks: Cyber security as counter-terrorism: Seeking a better debate

By Atlantic Council

To improve US cybersecurity, policymakers should draw on relevant strategic lessons from the study of terrorism and counterterrorism.

Schroeder, Handler, and Herr for the Modern War Institute at West Point: Population-centric cybersecurity: Lessons from counterinsurgency

By Atlantic Council

In developing strategic responses to conflict within and through cyberspace, the United States should learn from past conflicts with similar characteristics. Population-centric counterinsurgency strategies provide a compelling lens.