Cybersecurity’s believe it or not

There is a quote by astrophysicist Neil deGrasse Tyson that has always resonated with me.

“The good thing about science,” he stated, “is that it is true whether you believe it or not. That’s why it works.”

I have long believed that just about everything can be explained via the fundamental sciences of chemistry and physics. Mankind experiences its greatest disappointments and disasters when we attempt to work against these fundamentals or fail to acknowledge their reality. 

The science of cybersecurity is no exception.

The fundamentals of cybersecurity

As we increasingly and unfortunately continue to see, when organizations take eyes off these fundamentals—distracted by the shiny object that is sophisticated marketing or the logic-defying promises of new products—we suffer those consequences.

I use the word “we” quite specifically here.

The early internet, constructed decades ago to serve a small, tight-knit community primarily in the academic community, was built upon principles of personal trust, mutual respect and both a practical and a deeper understanding of shared connectivity. Only true Pollyanna utopians would claim that principle of trust has survived the immeasurable expansion of that platform to the global, blisteringly fast digital conduit we know today. (Why else would the Nigerian prince trust them with all that gold?)

No one, however, would argue that we are not exponentially more connected and reachable that any other time in history. So while fundamentals of cybersecurity are certainly essential to protecting ourselves and our organizations from the increasingly severe weather of threat actors and breaches, there is a point that is often overlooked in a hyper-competitive business landscape: Not only do cybersecurity fundamentals protect you—and make you a much less attractive target to bad actors—but they also halo protection across all the individuals and organizations to which you are connected and with whom you regularly share information.

The more we can inspire and encourage the use of these fundamentals—some obvious, some not and some not without controversy—the better off we will all be.

The most fundamental particles of cybersecurity are Speed, Integration and Authentication, without which we are doomed to insecurities and inefficacies. Since security always slows things down, security without Speed is a losing proposition.  Similarly, we all know that security is only as strong as the weakest link in the chain, so security must be based on the Integration of your defenses to leverage your strengths rather than expecting your weakest point to be always better than the adversary’s strongest methods.  The lack of trustworthy Authentication has been the bane of the internet since its very inception. To achieve not only optimal but basically functional cybersecurity, we must have each.  One without the others is a recipe for disaster.

Defenses up!

It goes without saying that speed has been a problem for defenders to date. The velocity with which we can send and receive even the most massive amounts of data is staggering and getting faster every day, yet defensive systems often leach CPU cycles away from the communicators or insist that communicators slow things down.  Neither strategy is an enduring one.

Integrated defenses, a staple of high-end security strategies in all other domains, is a neglected fundamental truth in the cybersecurity domain, with too many point solutions offering Maginot-Line type defenses. Just like the communication infrastructure of the internet is based on cooperative fabric of flexible, integrated mechanisms, the security fabric which underpins communications also needs to be based on an integrated security strategy.

Trustworthy authentication remains elusive. And though our generation has given a pass to the inventors of the internet, the challenges of authentication form the very core of the risk we face. Failed authentication is the common denominator found in nearly every digital breach, crime and exploitation.

Looking forward

Until we solve that problem—effectively authenticating people-to-machines, software-to-hardware, processes-to-operating-system and more—we will forever be compensating for this vulnerability with other essential strategies and mechanisms.

All is not lost in the meantime.  Key mechanisms and strategies, such as agile, macro and micro segmentation, high-fidelity access control and cryptography can take us far. Each of which is in a constant rapid process of evolution and iteration to ensure that it can keep pace with the sophistication of risks.

As an industry, as a community, and—quite frankly—as a species that has rocketed past the point of no return in hitching the most essential components and utilities of modern civilization to digital connectivity, we are presented with a choice stark enough to be a survival imperative. We need to either solve the authentication problem, once and for all, or we need to do a much more effective, consistent and intelligent job of implementing these fundamental strategies and mechanisms—at high speeds with strong integration.

More than ever before, we ignore them at our own substantial risk. Because the increasing—and increasingly devastating—threats we all face are growing rapidly. Whether we believe they are or not.