Hacking back from a glass house

Our nation’s IT applications and infrastructure are quite vulnerable; public and private organizations are reluctant to harden these assets sufficiently to provide assurance against devastating counter attacks. An adversary may retaliate at a weak point, perhaps with little concern for precise attribution. Thus offensive operations should be conducted from an “all-of-government” perspective, ensuring that the likely results are worth the potential adverse outcomes. Even then the unintended consequences can be substantial. For example, the most enduring legacy of the Stuxnet virus may be a well-funded and potent Iranian cybersecurity threat. We literally live in an IT glass house and therefore we need to be cautious when starting a stone-throwing contest.