The National Institute of Standards and Technology (NIST) develops cybersecurity standards, guidelines, best practices, and other resources to meet the needs of US industry, federal agencies, and the broader public. Our work ranges from specific information that can be put into practice immediately to longer-term research that anticipates advances in technologies and future challenges.

As part of our efforts to cultivate trust in information, systems, and technologies and to help organizations measure and manage risk, we carry out cybersecurity assignments defined by federal statutes, executive orders, and policies, including developing cybersecurity standards and guidelines for federal agencies.

Indicators of suspicious activity that threat hunters should look for include:

• Unusual inbound and outbound network traffic,
• Compromise of administrator privileges or escalation of the permissions on an account,
• Theft of login and password credentials,
• Substantial increase in database read volume,
• Geographical irregularities in access and log in patterns,
• Attempted user activity during anomalous logon times,
• Attempts to access folders on a server that are not linked to the HTML within the pages of the
  web server, and
• Baseline deviations in the type of outbound encrypted traffic since advanced persistent threat
  actors frequently encrypt exfiltration.

The United States’ reliance on networked systems and the high costs associated with cyber attacks have led many leaders in the US government and the Department of Defense (DOD) to prioritize protecting our critical networked infrastructure. Part of that focus is trying to develop a strategy for deterring adversaries from attacking our networks in the first place. This effort has led to much debate around the question of whether cyber deterrence is possible.

Answering this question is difficult since the number of adversary groups capable of attacking US networks is large and our ability to deter each group will vary based on its motives and levels of risk tolerance. The United States should not expect a cyber deterrence strategy to achieve the kind of results seen with our nuclear deterrence strategy during the Cold War. However, a limited US cyber deterrence strategy is possible. To be effective, this strategy must be multilayered and use all instruments of US national power. The strategy employed against one adversary group (e.g., criminal actors) will be different than that against another group (e.g., state or state-sponsored actors).

This paper explores (1) the difficulties of deterring unwanted cyber activities by each group of cyber threats, (2) realistic expectations for a deterrence strategy, and (3) proposals to help mitigate the problems.