“To know the enemy, we have to become the enemy” — Sun
Tzu’s The Art of War.

Cybersecurity, like any conflict, demands a deep understanding of the battlefield and
the adversaries’ tactics. To effectively defend against cyber threats, organizations must
adopt a strategic mindset, drawing inspiration from time-tested principles of warfare.

Polarity
Recognize that cybersecurity is a constant struggle between defenders and attackers.
Identifying and understanding adversaries is crucial for tailoring effective defenses.

Guerrilla War
Avoid rigid, static defenses. Embrace agility and adaptability in security measures,
constantly shifting tactics and strategies to outmaneuver adversaries.

Controlled chaos
Speed and adaptability are paramount in the cyber realm. Make decisions and respond
to threats faster than your opponents, keeping them off balance and prone to errors.

Perfect economy
Recognize the finite nature of resources and expertise. Choose your battles wisely,
prioritizing critical assets and focusing on high-impact security measures.

Counter-attack
Allowing adversaries to make the first move can expose their strategies and reveal
vulnerabilities. Be prepared to launch a decisive counterattack, exploiting their
weaknesses and turning the tide in your favor.

Deterrence
The best defense is often a strong offense. Establish a reputation for vigilance and
robust security measures. Project an image of unpredictability, leaving adversaries
uncertain about the consequences of attacking.

Non-Engagement
In the face of hesitant or cautious adversaries, seize the initiative. Swift, decisive action
can disrupt their plans and create opportunities for exploitation.

Intelligence
Understand your adversaries’ mindsets, motivations, and tactics. Analyze their actions
and communications to anticipate their moves and develop effective countermeasures.

Blitzkrieg
Overwhelm adversaries with a rapid, concentrated attack before they can mount an
effective defense. This approach can disrupt their command and control, creating
confusion and chaos.

Center of gravity
Identify your adversaries’ critical assets or vulnerabilities—their center of gravity—and
focus your efforts on neutralizing or exploiting them.

Divide-and-conquer
Break down complex cyber threats into smaller, more manageable components.
Address each component individually to weaken the overall attack.

Turning
Divert the adversary’s attention with a feint or secondary attack while striking their flank
or rear where they are most vulnerable.

Ripening for sickle
Maneuver strategically to weaken the adversary before engaging in direct conflict.
Create dilemmas that force them to choose between undesirable options.

Righteous
Maintain the moral high ground by adhering to ethical principles and exposing the
malicious intent of your adversaries. This can garner support and isolate attackers.

The void
The void is a state of strategic ambiguity and disengagement, characterized by an
absence of clear targets or readily available information for adversaries. This tactic can create a sense of unease and frustration for attackers, who are accustomed to having visible targets and predictable patterns to exploit. By maintaining a low profile and minimizing their digital footprint, defenders can lure adversaries into the void, where they expend resources and effort on fruitless pursuits. This allows defenders to conserve their own resources, observe the attackers’ tactics, and potentially identify their weaknesses.

Alliance
Communication is a battleground in cybersecurity, where the objective is to influence
the minds and actions of both internal and external stakeholders. Whether it’s
educating employees about security risks, advocating for increased resources, or
shaping public opinion, effective communication is essential for achieving security
goals.

Chain-reaction
In cyber warfare, a chain reaction attack involves triggering a series of events that
cascade through an adversary’s systems, causing disruption, confusion, and ultimately,
paralysis. This tactic aims to overwhelm the enemy’s defenses, disrupt their command
and control, and hinder their ability to respond effectively.
Examples of chain reaction attacks in cybersecurity:
● Exploiting cascading vulnerabilities: Compromising one system to gain
access to others, creating a domino effect of breaches.
● Distributed denial-of-service (DDoS) attacks: Overloading systems with
traffic from multiple sources, causing them to crash or become unavailable.
● Misinformation campaigns: Spreading false or misleading information to sow
discord, undermine trust, and manipulate public opinion.