A report released by the bipartisan leadership of the Senate Intelligence Committee Thursday (July 25), one of the more bipartisan committees in Congress, says the government should come up with an "overarching cyber doctrine." 

That was one of the recommendations in a voluminous report on Russian election meddling focused on infrastructure.

The report concluded that the U.S. should make it clear to its adversaries, in a sort of "this could mean war" declaration, that it will treat an attack on election infrastructure as a hostile act, whose response may not be limited to cyber activity. 

Further, it said, "[i]deally, this principle of deterrence should be included in an overarching cyber doctrine for the U.S. Government. That doctrine should clearly delineate cyberespionage, cybercrime, and cyber attacks.  

"Further, a classified portion of the doctrine should establish what the U.S. Government believes to be its escalation ladder in the cyber realm—what tools does it have, what tools should it pursue, and what should the limits of cyber war be. "[P]olicymakers should consider what steps the U.S. will need to take to outstrip the capabilities of Russia, China, Iran, North Korea, and other emerging hostile actors in the cyber domain," it said.  

It also suggests the world community needs to get together to talk about cyber norms, "[j]ust as the international community has established norms and treaties about the use of technologies and weapons systems." 

It said the U.S. should lead the conversation about both the norms and the limits of cyber activities (say, declaring tampering with nuclear reactors off limits, as the world did with chemical warfare after the First World War).  

The report was released by Senate Select Committee on Intelligence Chairman Richard Burr (R-N.C.) and Vice Chairman Mark Warner (D-Va.). 

Few companies in the cable and telecommunications industries have escaped the cyber attacks that continue to wreak havoc on just about every layer of the supply chain.

Varying degrees of security breaches at Comcast, Cox Communications, Time Warner Cable and other cable providers have raised the red flag in the cybersecurity space and prompted a new mantra: Now is the time to raise the level of security.

“A fundamental evolution is taking place and the security implications are numerous,” Michela Menting, research director at consulting firm ABI Research, said. “Above all are the issues raised by the transition to all-[Internet protocol] networks, which are already highly exploited by threat actors and will be a boon for malicious cyber-agents — and all sectors are vulnerable.

“Investment in security services and corresponding hardware and software is not something they can ignore or put off , except at great cost to their services, reputation and client base,” she said.

Cybersecurity concerns have become so paramount that in its Charter Communications-Time Warner Cable merger order, the Federal Communications Commission required Charter to submit a plan to manage its increasing security risks during the transition.

And according to the Hewlett Packard Enterprise/Ponemon Institue “2015 Cost of Cyber Crime” study, hacking attacks cost U.S. firms, on average, some $15.4 million a year. Globally, U.K. insurance firm Lloyds estimates that cyber-attacks are costing businesses a staggering $400 billion a year.

There’s also the shaken confidence of clients and subscribers about the safety of their data. And not everyone is convinced the cable industry is prepared for any attacks.

“Cable networks are archaic in many respects, as they extend the life of existing systems, and frankly, the security posture of networks and the less time spent on security leads to a lot of holes,” Chris Simkins, CEO and co-founder of supply chain analysis and risk management firm Chain Security, said.

PricewaterhouseCoopers (PwC), a consultancy moving deeper into the cybersecurity space, believes cable companies are getting the message that shoring up their networks should be of the highest priority.

“There’s a lot going on with MSOs and we’re seeing the awareness lev el rising,” Mark Lobel, a principal in PwC’s U.S. advisory practice and Cybersecurity Technology, Information, Communications & Entertainment leader, said. “But cybersecurity is like a chess game with no kings, and trying to stay ahead of who’s across the board.”

And just who is across the board?

“There are many threat vectors,” Irfan Saif, a principal in Deloitte’s Cyber Risk Services practice, said. “There are service-disruption actors, those looking at the backbone to propagate malware and those who want to compromise customers. It’s a broad range of threat actors and companies must be cognizant of them all.”

That will require a holistic approach, Saif noted. “You must understand what behavior is considered normal and what indicates a threat of attack and what are the crown jewels that require higher-grade protection.”

Cisco Systems, another player in the cybersecurity space, concurred with Saif’s assessment.

“The best approach is a holistic look at security and where each layer builds on top of each other — firewalls, advanced malware protection, email and core technologies like conditional access, DRM and anti-piracy technology — a breadth of security,” Cisco senior product and solutions marketing manager Sam Rastogi said.

Another less glamorous threat, but just as dangerous, comes from the inside.

“Employees or vendors with access to information is a growing concern,” Rastogi sad. “Who’s accessing information and how, and is there abnormal activity? A risk-based program with alerts, authentication measures and more will give companies more insight.”

CableLabs, the cable industry’s research and development consortium, is accelerating its cybersecurity activity with two initiatives: It’s working with the Wi-Fi Alliance to ensure links to hotspot access points are secure, and it’s reaching more deeply into home managed access points.

“The level of engagement is very high and there are real questions being asked,” The mindset is changing,” CableLabs principal security architect Steve Goeringer said.

That’s a good thing, said Rick Michaels, CEO of CEA, a cable industry-focused investment bank. “It’s one thing that cable is carrying 60% of the Internet traffic, but now there are data centers and multiple services with different touch points in cable. Cybersecurity should be of paramount interest to the cable industry.”

Most cable companies are understandably reluctant to discuss their cyber security strategies. Comcast, which in March hired Noopur Davis as senior vice president of product security and privacy, offered a statement from Myrna Soto, senior vice president and global chief information security officer: “We’ve committed extensive resources with a focus on risk management and built resilient and smarter networks with many security layers that are monitored continuously. Using automation, tooling and analytics is key.”

Arris, another key equipment supplier to cable networks, said in a statement (in part): “Security remains a top priority at Arris, as it does for all manufacturers of Internet and network-connected devices” and that it “employs a variety of protective measures to help ensure the safe and reliable operation of our devices including, but not limited to, DOCSIS compliance, vulnerability scanning, and monitoring programs.” It works “actively with security organizations and our service provider customers to identify and quickly resolve any potential vulnerabilities to protect the subscribers who use our CPE devices.”

Breaches cut across both residential and business markets, added Sander Smith, president of Sericon Technology.

“It’s clear that very soon we’ll see consumers filling their home networks with IoT devices, and these devices will be rushed to market with very little thought given to security.”

Yet even with the increase in cyber attacks (PwC reported a 38% increase in 2015 vs. 2014), there is cautious optimism that with emerging cybersecurity innovations, an expanding community of cybersecurity companies and a heightened awareness among service providers, security is being strengthened.

“We’re seeing various levels of maturity in cable and telecom and a raising of awareness in those organizations,” PwC’s Lobel said. “But they can’t lose focus.”

The National Cable & Telecommuications Association is focusing its cybersecurity attention on two areas, senior vice president, science and technology and chief technology officer Bill Check said.

“We are leading the industry’s Cybersecurity Working Group and working with the FCC’s Communications Security, Reliability and Interoperability Council (CSRIC), along with various cybersecurity-related working groups,” he said. “The challenge is to anticipate current and future threats and design systems of early detection and resistance, because cyber-criminals will always look for new exploits.”

Cyber attacks on communications networks will likely increase in the next 10 years, and a majority of experts polled (61%) by Pew Research Center say those will include a major attack somewhere in the world by 2025 that causes tens of billions of dollars in damage and "widespread harm to a nation’s security and capacity to defend itself and its people?" The other 39% of respodents believe there would be no such attack, with mitigation efforts keeping pace with the bad guys.

That is according to the Pew Research Center's latest "Digital Life in 2025" report, released Wednesday (Oct. 29). It is the latest offering in its ongoing project saluting the 25th anniversary of the creation of the World Wide Web.

The "canvas" -- it is not a randomized survey -- is based on 1,642 respondents, billed as "experts and Internet builders," all of whom were asked for predictions about the future of cybersecurity threats.

“Cyber attacks are already pervasive, and it is trivial even for children to acquire the means to inflict serious damage," said software engineer Robert McGrath who helped develop the World Wide Web. "The United States has already attacked other countries, and other deliberate attacks are suspected. Losses are already in the tens of billions...It is only a matter of time before there is a serious incident, i.e., one that journalists recognize as an event.”

One software tech CEO active in Internet standards development (respondents did not have to provide their names) warned that the major attack could be a high-altitude electromagnetic pulse attack that could do a number on cloud storage systems that would require a long and complex recovery period. On the other side of the major attack issue was telecom engineer Peter McCann. "The potential for destructive terrorist acts carried out through computer networks has been dramatically over-hyped," he said. "To the extent that computers are put in control of life-critical processes, there will be air gaps and safeguards in place that prevent malicious outside instructions from interfering in their operations.”

Darel Preble, founder of the Space Solar Power Institute, suggested concerns about the security of the power grid might be misplaced. "The major damage to our national power grids is not from cyber attacks but from natural causes—squirrels, ants, ice, falling trees, wind, and simple human error," he said.

Hal Varian, chief economist at Google, also sees more danger in mother nature than malicious actors. “There will certainly continue to be cyber attacks around the world. However, I don't think that such attacks will involve losses of tens of billions of dollars," he said. "For that to happen we would have to see systems down for several days. Katrina was the costliest US hurricane and it did about $100 billion of damages. Most hurricanes have been in the $20 billion range. I don't see cyber attacks coming anywhere close to hurricanes in terms of the associated property losses.”

Pew summarized the key themes put forth by both camps.

For those who said there will be a major cyber attack, or attacks, causing widespread harm, the reasoning was:

1) "Internet-connected systems are inviting targets. The Internet is a critical infrastructure for national defense activities, energy resources, banking/finance, transportation, and essential daily-life pursuits for billions of people. The tools already exist to mount cyber attacks now and they will improve in coming years—but countermeasures will improve, too.

2) "Security is generally not the first concern in the design of Internet applications. It seems as if the world will only wake up to these vulnerabilities after catastrophe occurs.

3) "Major cyber attacks have already happened, for instance the Stuxnet worm and attacks in nations where mass opposition to a regime has taken to the streets. Similar or worse attacks are a given."

4) "Cyber attacks are a looming challenge for businesses and individuals. Certain sectors, such as finance and power systems, are the most vulnerable. There are noteworthy divides between the prepared and the unprepared."

For those saying they did not think there would be a major attack, their reasoning was as follows:

1) "There is steady progress in security fixes. Despite the Internet’s vulnerabilities, a distributed network structure will help thwart the worst attacks. Security standards will be upgraded. The good guys will still be winning the cyber security arms race by 2025.

2) "Deterrence works, the threat of retaliation will keep bad actors in check, and some bad actors are satisfied with making only small dents in the system so they can keep mining a preferred vulnerability and not have it closed off.

3) "Hype over cyber attacks is an exaggeration of real dangers fostered by the individuals and organizations that will gain the most from creating an atmosphere of fear."