Information warfare is the use and protection of information to gain an advantage over an opponent. It covers attacks on information systems, efforts to deceive or influence people, and the defence of one’s own data and communications. Modern conflicts, elections and even business rivalries now include an information battle alongside everything else.
This guide explains the main components of information warfare, how information assurance protects against it, real examples and practical defences.
What information operations include
Military doctrine often groups information operations into several capabilities:
| Capability | Aim | Example |
|---|---|---|
| Cyber operations | Attack, defend or exploit networks and systems | Disrupting command networks |
| Electronic warfare | Use the electromagnetic spectrum | Jamming radar or GPS signals |
| Psychological operations | Influence emotions and behaviour | Leaflets, broadcasts, social media campaigns |
| Military deception | Mislead decision-makers | Decoy equipment, fake radio traffic |
| Operations security (OPSEC) | Deny the opponent useful information | Controlling what troops post online |
Together, these aim to achieve information superiority: knowing more, deciding faster and acting better than the other side.
Influence and disinformation
Outside the battlefield, information warfare often means influence campaigns. Actors spread false or misleading stories, amplify divisive content with fake accounts, and leak stolen documents at chosen moments. The goal is to weaken trust in institutions, divide societies or shape decisions. Read more in our guide to psychological warfare.
Information assurance: the defensive side
Information assurance protects the confidentiality, integrity and availability of information, plus its authenticity and non-repudiation. In practice, it includes:
- security policies and awareness training;
- access control and strong authentication;
- encryption of data at rest and in transit;
- backups and continuity planning;
- monitoring, incident management and reporting procedures;
- verifying the source of important information before acting on it.
Real-world examples
- 2007, Estonia: large-scale DDoS attacks hit government, banking and media websites during a political dispute.
- 2015 to 2016, Ukraine: cyber attacks caused power outages, alongside disinformation campaigns.
- 2016 onwards: several governments reported hack-and-leak and social media influence operations aimed at elections.
- 2022, Russia’s invasion of Ukraine: wiper malware, a satellite network attack and a deepfake video of Ukraine’s president urging surrender all appeared in the early weeks.
Why businesses should care
Companies are not only collateral damage. They can be direct targets of disinformation, such as fake news about products or forged statements from executives. In addition, deepfake voice and video now support fraud, for example urgent payment requests that appear to come from a CEO.
How to defend
- Secure your systems: patch, use MFA, segment networks and keep offline backups.
- Verify before acting: require call-back checks for payments and sensitive changes.
- Monitor your brand: watch for fake accounts, domains and false claims.
- Communicate fast: prepare spokespeople and official channels to correct false stories.
- Train staff: explain manipulation tactics and deepfakes.
- Share intelligence: work with industry groups and CERT-In.
Related guides
Sources
Worried about targeted attacks on your business? Our VAPT services find weaknesses before attackers do, and our OSINT investigations show what is exposed about your organisation online. Contact us for a quote.
