While Alex has dealt rather masterfully with the consequences of the trumped-up Russian SCADA hacking incident, I’d like to point to a different aspect of it: the cybersecurity “wake up call.” The Springfield incident was immediately called a “wake up call” for cybersecurity practitioners. Of course, we now know that it was not a cyber attack. But suppose , for the sake of argument, that it really was the work of nefarious Russians. That would be a real cause for concern, wouldn’t it?
As Bob Gourley tweeted, we’re now in our 4th decade of “cyber wake up calls.” The only thing more played-out in the cybersecurity field is the phrase “digital pearl harbor.” So why does the phrase continue to predominate? Some of our panelists at the FedCyber Government-Industry conference talked about problems with the private sector’s lack of attention and budgetary emphasis on security and lack of recognition from policymakers of the evolved nature of the threat. While these are worthy explanations, perhaps something else is at play: the cyber snooze button that we perpetually hit whenever we are “woken up.”
Cybersecurity obviously is a huge concern to policymakers and analysts. The private sector is also taking note. But the problem, as Bob has said in the past, is that on a day-to-day basis security is simply not a priority. It is seen as a technical matter rather than policy issue that demands the attention of CIOs, and is based on a reactive model rooted in point defense of all access points rather than defense in depth, does not tackle enterprise management as a whole, and is rooted in the fallacious assumption that the PC as the only point of vulnerability within an organization. Moreover, as Martin Libicki points out in his book Conquest in Cyberspace, there is no such thing as forced entry in cyberspace. The vast majority of successful attacks are the result of simple weaknesses that were not proactively addressed.
To be more simple, the cyber snooze button is continuously hit because many simply do not want to wake up to the reality that cybersecurity is no longer an exotic subfield limited to a small cadre of technical experts. It is a basic element of living in a hyperconnected world that will only grow more so as more and more elements of our lives become networked. Trusting your toaster will be the least of your concerns. But for whatever reason, we cannot accept this reality and make prudent–if sometimes painful–adjustments.
Rather, cyber is cast in terms of an exotic and unstoppable threat akin to megaterrorism or nuclear warfare. The problem with this is that it tends to encourage outlandish and unworkable solutions, lead to scares akin to the one that Alex has analyzed, and casts cyber as a strategic matter to be dealt with by politicians rather than an problem with multiple dimensions. There is the nation-state based cyber threat, certainly, but many firm and agencies deal day to day with opportunistic criminals–not Stuxnet or a crack team of elite PLA infowarriors.
Until we can learn to see cyber in less dramatic terms, we will continue to have multiple wake up calls, and a few scares like the Illinois water pump incident. Unfortunately, some organizations and individuals will have hit the snooze button one too many times, and will face threats—although certainly less severe than Vladimir Putin’s colleagues wiping out critical infrastructure–with the potential for serious fiscal, personal, or public relations damage.
