Better Questions, Better Results

A different approach to cybersecurity for 2010 and beyond.

I strongly believe that our futures are shaped by the questions we ask. Poor questions manifest poor results…and disappointing futures. To date, cybersecurity has delivered abysmally poor results. Every significant indicator of cybersecurity is heading in the wrong direction. Cybercrime is pandemic, on-line fraud is exploding, economic incentives for attackers are increasingly compelling, nation states are becoming more aggressive in cyberspace, cost and complexity of cyber defense is rising, skill gaps are widening, and desired outcomes of cybersecurity strategies regularly fail to materialize, just to name a few.

Cybersecurity’s abysmal results are often blamed on the sophistication of cyber attackers, ambivalent and/or ignorant owners of IT systems, lack of national leadership, and ignorant and/or uneducated and/or unaware users.  Everyone and everything is to blame, it seems, for the sorry state of cybersecurity, except us – the cybersecurity community.

I believe cybersecurity’s abysmal results are driven by our poor questions, not by our customers or adversaries. After reviewing security-related news stories from 2007 thru 2009, and wading through the litany of 2010 predictions, I’ve identified at least three poor questions asked regularly and repeatedly:

• Where are the next new threats coming from and how do we get ahead of them?
• How do we get organizations to consistently and sufficiently protect IT systems and data?
• How do we prevent cybercriminals/hackers from exploiting system (and human) vulnerabilities?

These are poor questions precisely because results have been poor…for over a decade by my reckoning. Considering that many national cybersecurity strategies are based on these questions – or at least attempt to answer these questions in part - I am convinced the future of cybersecurity will continue to be an expensive and unproductive struggle. That said, I remain optimistic. Different results mandate asking different questions.

The more promising approach, I believe, for improving cybersecurity in the years ahead is to disavow the above questions, decouple national strategies from answering these questions, and ask better questions, such as:

• How do we make it more expensive for cyber-attackers to exploit vulnerabilities than for cyber-defenders to protect against them?
• How do we negotiate private and social costs of cyberspace activities so that national and economic security is promoted rather than undermined?
• What would it take to drastically reduce the total number of products, processes, and practices for “good” cybersecurity?
• What if end-users did not need to alter personal on-line behaviors to thwart cyber attackers? What would those systems and applications look like?
• What will it take to know our actions are making tangible differences?

Far from simply intellectual exercise, these questions drive different thinking processes, different approaches, and thus potentially different results. But these are just my thoughts. What are the better questions we should be asking for 2010?

Comments

[Cappella]

I concur with the better questions that you raise. Unfortunately, we lived in a society where people dominantly just want a quick fix solution, thus the 3 lousy questions.

One latest example is the Delta 253 attempted bomb incident. Right after it, all TSA knows is to put in more scanners, do more pat downs, but they will not think differently and ask different questions.

Until we can get more people to change their expectations and be more proactive, we will forever see decision makers asking the wrong questions.