Michael Daniel
President and CEO
If economics is the ‘dismal science,’ then cybersecurity is the ‘dismal profession.’ It thrives on fatalistic assessments about the present and gloomy projections about the future.
Optimism is reserved for marketing materials touting the latest technology, but the repeated failure of advertised widgets to solve the problem fosters cynicism. A reasonable person might conclude that nothing can be done to make cyberspace more secure.
Three ingredients of a safer cyberspace
That assumption isn’t true. We can improve our digital security and reduce the impact of malicious cyber activity. We cannot eliminate cyber risk, but we can make cyberspace safer. Achieving this goal requires at least three ingredients: changing mindset, enabling collaboration alongside competition and reallocating some of the security burden.
The popular images for cybersecurity usually involve locks, walls, shields and similar metaphors. The problem is that a “castle and moat” mindset for cybersecurity will inevitably fail, because the bad guys will eventually find a way in. However, if we think about cybersecurity as preventing bad guys from achieving their goals, whatever those are, then the nature of success changes dramatically. Defenders must only succeed once, while the adversary must succeed at every step, or they fail.
we need to reallocate some of the security burden
Combining collaboration and competition
The second ingredient involves combining collaboration with competition. Societies should incentivise cybersecurity providers to share information about threats and collaborate on actions against malicious actors. At the same time, robust competition among cybersecurity providers in technology, customer experience, timeliness, and other factors drives improvements in these areas. Effective cybersecurity requires both collaboration and competition. Finally, we need to reallocate some of the security burden. As societies, we have put the entire security burden on the end-user, even if that end-user is a small flower shop or a retired grandmother. In most other areas, we expect manufacturers and larger organisations to bear a portion of the safety and security burden. For example, we don’t expect people to install their own anti-lock brakes in their car. We need to take a similar approach with cybersecurity and shift some of the burden to those organisations best able to shoulder it.
