Cybersecurity 9/11 already happened. When will we act?
If you’re still waiting for a cybersecurity 9/11 or a ransomware Pearl Harbor to punch us in the gut, wake up. The equivalent has already happened. More than one, in fact.
Maybe SolarWinds and Colonial Pipeline1 didn’t have the same devastating visuals of those other American tragedies. But make no mistake; those cyberattacks exposed deep vulnerabilities in how we run our world and live our lives, and how deeply bad actors have penetrated our society’s inner workings, with devious effect.
It’s a massive sign of weakness. We’ve allowed foes to infiltrate our infrastructure and stay there, undetected. And our response? We issue fines2. It took a pandemic for people to understand they need to stay home when they’re sick. What is enough for people to wake up to this threat?
Three Things We Must Do
Long gas lines and spent fuel tanks weren’t enough, apparently. Crippling our ability to care for medical patients3 wasn’t enough, either. What’s next? A power grid attack like the one in India?4 Do we allow someone to shut off power to the East Coast during a heat wave? People will die if you shut off the power. We can’t afford to wait.
Like 9/11 and Pearl Harbor, if we give the problem our full attention and the right level of risk management, we have the ability to mitigate the worst impacts — or stop attacks altogether. But right now, we’re so far away from doing the right thing that people can’t even wrap their minds around what they have to do next. So, where do we start?
First, this requires a World War II-level of mobilization: either you’re in the fight, or you support the fight. We can’t have the dynamic like in some recent military conflicts where a minority does all the work and the majority offers rah-rah, and little else.
Second, our critical assets like government agencies, the power grid, hospitals, banks, the defense industrial base, and other infrastructure and industries need to take stock of their situation by asking themselves these questions:
- What’s on your network? What assets are supposed to be connected?
- Who’s on your network? Is everyone working remotely supposed to be there?
- What data are you trying to protect?
For most organizations, these things are complete unknowns. Yet, these are the most basic elements of cyber hygiene — the rules and routines that help us protect the data and intellectual property that powers our modern world.
Third, we need to shift people’s mindset to solve problems with a risk based approach. Too many decision-makers stick to the way they’ve always done it. Too many institutions choose the probability of a fine over the cost of change, even though it’s much more costly to recover from an incident than prevent one.
(How costly is it? Breached companies with no security automation suffer an average of $3.58 million more in losses than if they had fully deployed security automation5. Almost $3.6 million!)
Doable, But We Need To Take Action
Achieving constant cybersecurity effectiveness, and not just compliance or maturity is eminently doable, even if it’s not the conventional way of doing it. My team is here to help guide you on that journey, which incorporates taking a risk-based approach to cybersecurity, thinking about it holistically, and gaining a much better understanding of what’s happening in your environment in real time. You must pick up new habits and ditch old ones.
However It’s done, we need to start now, because the attacks won’t stop. At worst, taking a risk-based approach mitigates the impact of cyberattacks. At best, these measures will completely prevent one. We missed our opportunities to avoid a cybersecurity 9/11 and a ransomware Pearl Harbor. Let’s not wait to take action before something worse happens.
1 https://www.cnn.com/2021/05/13/opinions/colonial-pipeline-ransomware-attack-was-stoppable-vishwanath/index.html
2 https://www.csoonline.com/article/3615489/us-sanctions-russian-government-security-firms-for-solarwinds-breach-election-interference.html
3 https://www.nbcsandiego.com/news/local/what-we-know-about-scripps-health-cyberattack/2598969/
4 https://www.businessinsider.in/tech/news/chinese-cybercriminals-are-targeting-the-indian-power-sector-according-to-a-report/articleshow/81274093.cms
5 https://www.ibm.com/security/data-breach
The Impact of Cybersecurity on Tribal Organizations: Protection and Cultural Preservation
There are currently 574 federally recognized tribes in America. Each of these tribes is its own nation – with intricacies, culture, history and more. They operate efficiently on their own for everything from healthcare to education. As Tribal organizations continue...
Using the Tools at Our Disposal in Nontraditional Ways
Too often, our response to cyberwarfare in the U.S. is reactive. Companies’ key leadership don’t seriously contemplate what they could be doing better until after they’ve already suffered a cyberattack, and by that point, the damage has already been done. Our...
Cybersecurity Month
Cyber attacks are on the rise. According to a 2022 Mimecast report, three out of four organizations have been victims of a ransomware attack. Although 64% paid the ransom, nearly 40% failed to recover their data. In spite of these widespread attacks, less than...
