Asymmetrical Threats in Cybersecurity

Originally published on LevelBlue

Security and defense theory are inextricably entwined. Consider medieval castles — defensive mechanisms that provided security to civilians hiding behind walls from invaders. Within cybersecurity, multiple concepts from defense and war theory apply directly to the cyber risks facing organizations today.

What Is Asymmetrical Warfare?

Asymmetrical Warfare can be summarized as the asymmetry that exists between two adversaries and the tactics used by the weaker party to render the strengths of the stronger party irrelevant.

Despite fielding arguably the most powerful conventional military in history since WWII, the US has struggled in Vietnam, Somalia, Iraq, and Afghanistan — against lesser-equipped insurgents applying asymmetric tactics. Prussia fell to Napoleon. The Soviet Union was defeated in Afghanistan after a decade of guerrilla war. Superior military might alone cannot win against a determined, creative, adaptive adversary.

As Mao Tse-Tung illustrated in On Guerrilla Warfare (1961), the contrast is stark: precision missile systems on one end of the spectrum; a man with a rifle and three days of rice on the other. Both capable of decisive effect.

Defining Asymmetric Threats

An Asymmetric Threat in cybersecurity must meet three criteria:

1. It must involve an exploit, tactic, or strategy that the adversary both could and would use against an organization.
2. It must involve an exploit, tactic, or strategy that the organization could not or would not employ against the adversary.
3. It must involve an exploit, tactic, or strategy that, if not countered, could have serious consequences.

Example: An adversary attacks a company with a Distributed Denial of Service (DDoS) attack. The company would not respond with a DDoS attack against the attacker. Therefore, the threat is asymmetric.

Why Pure Defense Fails

As Julius Caesar observed:

"There is no fate worse than being continuously under guard, for it means you are always afraid."

Companies still stuck in the mindset of deploying expensive technology and skilled technicians purely defensively are akin to hiding behind castle walls while an adversary mines, undetected, beneath them. Phishing campaigns that establish a foothold before deploying ransomware are a textbook example of asymmetric attack — bypassing the "castle wall" of a firewall entirely.

Countering Asymmetry: Intelligence Is Paramount

As General Sir Frank Kitson observed in the context of Counter-Insurgency (COIN) operations:

"If it is accepted that the problem of defeating the enemy consists very largely of finding him, it is easy to recognize the paramount importance of good information."

The key to defeating an insurgency lies in dominating the information battlefield — not in the supremacy of military might. The same principle applies to cybersecurity. Threat intelligence, dark web monitoring, behavioral analytics, and proactive hunting are the cyber equivalents of COIN intelligence operations.

Conclusion

Organizations facing today’s cyber threat landscape are in a position of near-constant asymmetric disadvantage — defending against a creative, motivated, and adaptive adversary with fewer resources but greater agility. Understanding asymmetry is the first step. Building intelligence-led, adaptive defenses is the answer.