Book Review: The third sector: Community organizations, NGOs, and nonprofits, by Kallman, M. E., & Clark, T. N.

do not even know what assets they have within their own networks, nor a complete understanding of the risks associated with various systems, patching timelines, and a bevy of other regularly occurring issues. Second, Mandel highlights the need for a broad public and private decision-making mix. The inclusion of private-sector entities into the broad scope of decision making on deterring or restraining cyberattackers is already an ongoing process and occurs through a variety of venues, tailored to the potential effect that a given attack might have on national security. Executive Orders 13691 and 13231 among others through the creation of Information Security and Analysis Centers (ISACs) and Information Security and Analysis Organizations (ISAOs) begin to form the basis through which the Department of Homeland Security and other agencies work across public and private firms to coordinate norms, policies, laws, and other mechanisms for response, investigation, and remediation of cyber incidents. These organizations are still developing and evolving, but form the starting point for various private entities to engage the government on complex cybersecurity-related issues tailored to their specific needs. Third, Mandel suggests that novel response mechanisms to cyberattacks be investigated in tandem with changes in conventional and unconventional restraints on their use. This proposal potentially opens the door for uncontrolled escalatory behaviors. Combined with his fourth broad deterrent element, the expansion of both within domain (i.e., within cyberspace) and cross-domain (i.e., within cyberspace and beyond) responses, could lead to elevated stakes for any given cyber incident. Last, Mandel indicates there is a need for a fear-based and hope-based mix of strategies to dissuade attackers. Yet it is not clear exactly how these are to be fully accomplished. Subsequently in the conclusion he does propose mechanisms for the integration and stabilization of cyberdeterrence concepts. But the details for how these mechanisms are implemented across a range of actors while, discussed in strategic terms does contextualize the challenges present in implementing the proposals. Although Mandel does not go into the weeds on how to act on many of his proposals, many are already in the process of being implemented across a variety of agencies both state and federal. The proposals are well reasoned and fit within a comprehensive strategic approach to cyberdeterrence. Yet the challenge of implementing them will remain for a variety of reasons. First, the talent pool for cybersecurity nationally is highly constrained and most estimates indicate a workforce shortage nearing approximately 1.8 million persons. Second, cybersecurity and deterrence is a systemic problem, but resources across the system are not and will not likely ever be evenly distributed. Ingress into systems through the weakest link is a common practice, one seen in attacks against Target, Home Depot, or any number of other similar attacks in recent years. Fixing resource imbalances is both a human capital and economics problem. Third, the broadening of cyber response options through enhanced defenses prior to attack is reasonable, but the expansion of responses outside of the state control and into the private sector will likely increase systemic risks rather than reduce them. Even if appropriate parameters are put in place allowing private firms to “hack back” is not a straightforward endeavor and creates unnecessary risk. Optimizing Cyberdeterrence is a detailed and worthwhile read for practitioners and scholars alike. It is one of the first works to take a truly nuanced approach to cyberdeterrence and fits well within the evolving literature. The first several chapters are in line with most of the field in terms of setting the stage and importance of cybersecurity and its challenges. Mandel’s inclusion discussion on paradoxes frames the challenges of deterrence well. The case studies and analyses are detailed and provide context for his later analysis on deterrence strategies. Although the work remains largely at the strategic level, it provides some insights into lower level policy implementation that begins to shift the national security conversations away from generic “we need cyberdeterrence” to “here are the areas where we need to focus our efforts to foster cyberdeterrence. ” As with most political science volumes on the topic, there remains a wide gulf between the technical and policy communities, yet Mandel did seek to understand and incorporate the former in many ways. Cyberdeterrence is and will remain complex and multifaceted. It spans public and private infrastructures, personal and collective security needs. Mandel elucidates the many of these challenges and thereby establishes a gap within which this volume adds substantively to a broader understanding of cyberspace.