Averting catastrophe in cyberspace: core requirements

The information revolution has transformed every facet of commerce and culture, including the military enterprise. Unfortunately, it has also empowered extremists, criminals and agents of enemy nations who can use cyberspace to subvert or destroy information resources vital to US security. The federal government has launched a comprehensive cybersecurity initiative to counter such threats. The most advanced, persistent threats are posed by state-sponsored perpetrators, especially those operating in China and Russia.

The federal government has made major strides in developing defences against cyber espionage and aggression. However, its efforts are impeded by the changing character of threats and the infancy of techniques for addressing them. The absence of agreed standards and metrics for assessing performance sometimes leads federal agencies to select cybersecurity providers who lack the breadth and depth to cope with all potential threats. The government cannot sustain a truly comprehensive cybersecurity posture unless its top providers satisfy five core requirements:

1. Situational awareness. Capable providers must be able to precisely monitor the performance of information systems and networks they are protecting, predicting and/or detecting threats based on extensive understanding of adversary behaviour. Awareness of dangers must be shared with potential victims in time for them to minimise harm, and providers must then be able to assess the success of remedial actions.

2. Full-spectrum skills. A comprehensive cybersecurity posture requires providers with expertise and experience in the full array of relevant skills. That includes all the major disciplines associated with computer-network defence, computer-network attack, and computer-network exploitation. Without an integrated understanding of all the necessary skills, federal providers cannot deploy the full panoply of tools needed to counter advanced threats.

3. Operational agility. The pace of activity in cyberspace requires providers that are extremely agile in responding to new threats. Ideally, those providers should be able to apply their situational awareness and full-spectrum skills to anticipate danger before it actually occurs, but at the very least they must have the capacity to detect, analyse, isolate and defeat enemy moves quickly, even when the threat is a “zero-day” attack with no previous history.

4. Organisational maturity. Maturity models are used in many fields to assess organisational effectiveness in applying best practices. In the cybersecurity arena, such models can be used to assess both government preparedness and the practices of outside providers. Mature solutions to cyber challenges typically stress values such as affordability, scalability and technical readiness. Companies capable of providing those solutions tend in turn to have mature cultures stressing retention of talent, continuous training, and diverse expertise.

5. Enterprise commitment. Cybersecurity is an infant industry with many recent entrants. The commitment of some providers to the business is hard to gauge. However, it is not feasible to fashion comprehensive responses to cybersecurity challenges unless customers and providers alike are committed to the mission. The commitment of providers can be determined by assessing how long they have been in the business, how deeply they have invested in talent, and how extensive their collaborative ties are with other centres of expertise.

Excerpts from a Lexington Institute report