Hacker News Reader

Comment by Shmebulock | Hacker News Reader

>for the first time since castles vs. troops without cannon, defense was stronger than offense

In the seminal book "On War" which was published in 1832 and is still required reading in many military academies, Prussian general Carl von Clausewitz explicitly says that defense is stronger than offense.

Maybe this intensified in WWI

View on HN

Potentially what actually happened and von Clausewitz mention something about this, is that the armies had no ability to "think" fast enough to deal with any breakthrough. As mentioned the ability to plan and undertaken the first action was always there; the assault, the counter attack. But the subsequent actions were impossible to plan for and impossible to execute on the fly. These were old school armies; communication was antiquated and initiative was practically non existed.

I mean, to some extent, defense will always be stronger than offense—offense always needs to travel to get there, for instance, while defense happens where you are—but the degree makes a big difference.

If, all else being equal, it takes a force of 1500 attackers to overwhelm 1000 defenders, defense is still stronger than offense, but you can still expect to be able to make progress relatively easily.

If, on the other hand, it takes 5000 attackers to overwhelm 1000 defenders, suddenly you have to make very different kinds of calculations about what is worth the cost, and what is even strategically feasible to take without destroying your army's ability to fight.

This is still true and accepted military doctrine. We look for at least a 3:1 force ratio before considering attack a viable option. It's not exactly scientific and plenty of military historians have questioned the validity of this rule of thumb, but it still is the official doctrine, at least of the US Army. I can't speak for other countries.

Force ratio doesn't have to be strictly numerical, though. Offense can have better weapons, rely on element of surprise, and we also like to attack during really bad weather because it sucks a lot more to be dug in during a rainstorm than to be on the move. There's also some advantage in indirect fire in that it's easier for artillery to hit a stationary target than a moving one, so provided your artillery itself is mobile enough to survive counterbattery strikes, that goes to the offense. Unless the defense is so well dug in that artillery can't even affect it. So it depends on a lot of things.

But in general, defense always has the advantage. They get to choose where to fight, they can prepare their positions, they don't need to expose themselves.

I guess it's reversed in cyberwarfare if you want to think of it that way, but it's really not analogous. It's never been all that difficult to sneak a small surgical force inside an enemy perimeter, but you can't take and hold land that way, which is what attack versus defense force ratios are thinking of. This is more of a law enforcement thing, which has always relied on either having more cops than criminals or extremely harsh punishments. The issue here is we can't enforce the law against foreign actors if the host nation won't help. When actual Americans have been caught breaking into American computer systems, they've totally had the book thrown at them and I think that really has deterred domestically launched cyberattacks. It's not like the NSA can't find you, but if the only way to actually stop you is to send in Seal Team Six, that isn't worth starting a real war over.

> But in general, defense always has the advantage. They get to choose where to fight, they can prepare their positions, they don't need to expose themselves.

I'm curious about the "they get to choose where to fight" question, actually.

I can see where this would apply on a tactical scale, like if I'm preparing an ambush. But on an operational scale, doesn't the attacker choose where and when to fight?

Tactically, defense is stronger than offense in that you need a numerical advantage to defeat a prepared defense.

Strategically, there is a lot of value in the attack because you can choose the time and place of fighting to your advantage. This didn't pan out on the Western Front of WWI for a variety of reasons.

Now we have cyber domain where this is definitely not true.

It's clearly true: it's cheaper to prevent vulnerabilities than to find and exploit them.

Does this assume a stable and relatively slow rate of change? Because at some scales I imagine preventing vulnerabilities could be equally difficult.

"Defense vs Offense" is underspecified for this disagreement. Considering "defense" as the developers writing an application, and "offense" as the reverse engineers attempting to exploit it, defense may still be cheaper in some scenarios.

If you consider "defense" as an organization attempting to provide a service securely, and "offense" as all the security threats they are exposed to, it seems hard to argue that the defensive side has any sort of advantage over all of the attackers.

Is it cheaper to find and prevent ALL vulnerabilities than to find and exploit ONE?

Not sure.

Let's say we have fortifications. People are needed to man them. This is understood by everyone. Entry points are checked, etc.

Compare with 'cyber' systems. How many people are adding features, working on bugs and the like, versus how many are even looking into security vulnerabilities?

Translating to the physical domain, it would be as if we were building a fort, then moving almost everyone to build extensions or new forts, with a handful responsible for the security of all fortresses - and the paths in between them! In the dark.

The fact that most systems are not immediately "owned" speaks volumes on how difficult this is to accomplish. Barring zero days, the main way one gets compromised is by making mistakes (not patching, leaving systems unsecured, etc). That is, there's a door that's open and unguarded...

Reply on news.ycombinator.com