Defensive Information Warfare with Non-localizable Command and Control

I loosely define "hard" information defenses as those assurance mechanisms that tend more to prevent (rather than recover from) the ill effects of security breaches and which tend to be more static in nature. Similarly, I loosely define "soft" defenses as assurances that tend to rely more on recovery from security breaches and offer a more dynamic/adaptive kind of information protection. Information protection, especially for critical information infrastructure, should balance the use of "hard" and "soft" information defenses owing to their often-complementary characteristics.