What we should do to prevent another cybersecurity Pearl Harbor-esque attack

If you’re still waiting for a cybersecurity 9/11 or a ransomware Pearl Harbor to punch us in the gut, wake up. The equivalent has already happened. More than one, in fact.

Maybe SolarWinds and Colonial Pipeline1 didn’t have the same devastating visuals of those other American tragedies. But make no mistake; those cyberattacks exposed deep vulnerabilities in how we run our world and live our lives, and how deeply bad actors have penetrated our society’s inner workings, with devious effect.

It’s a massive sign of weakness. We’ve allowed foes to infiltrate our infrastructure and stay there, undetected. And our response? We issue fines2. It took a pandemic for people to understand they need to stay home when they’re sick. What is enough for people to wake up to this threat?

Three Things We Must Do

Long gas lines and spent fuel tanks weren’t enough, apparently. Crippling our ability to care for medical patients4 wasn’t enough, either. What’s next? A power grid attack like the one in India? Do we allow someone to shut off power to the East Coast during a heatwave? People will die if you shut off the power. We can’t afford to wait.
Like 9/11 and Pearl Harbor, if we give the problem our full attention and the right level of risk management, we have the ability to mitigate the worst impacts — or stop attacks altogether. But right now, we’re so far away from doing the right thing that people can’t even wrap their minds around what they have to do next. So, where do we start?

First, this requires a World War II-level of mobilization: either you’re in the fight, or you support the fight. We can’t have the dynamic like in some recent military conflicts where a minority does all the work and the majority offers rah-rah, and little else.

Second, our critical assets like government agencies, the power grid, hospitals, banks, the defense industrial base, and other infrastructure and industries need to take stock of their situation by asking themselves these questions:

• What’s on your network? What assets are supposed to be connected?
• Who’s on your network? Is everyone working remotely supposed to be there?
• What data are you trying to protect?

For most organizations, these things are complete unknowns. Yet, these are the most basic elements of cyber hygiene — the rules and routines that help us protect the data and intellectual property that powers our modern world.

Third, we need to shift people’s mindsets to solve problems with a risk-based approach. Too many decision-makers stick to the way they’ve always done it. Too many institutions choose the probability of a fine over the cost of change, even though it’s much more costly to recover from an incident than prevent one.

(How costly is it? Breached companies with no security automation suffer an average of $3.58 million more in losses than if they had fully deployed security automation6. Almost $3.6 million!)

Doable, But We Need To Take Action

Achieving constant cybersecurity effectiveness, and not just compliance or maturity is eminently doable, even if it’s not the conventional way of doing it. My team is here to help guide you on that journey, which incorporates taking a risk-based approach to cybersecurity, thinking about it holistically, and gaining a much better understanding of what’s happening in your environment in real-time. You must pick up new habits and ditch old ones.

However It’s done, we need to start now because the attacks won’t stop. At worst, taking a risk-based approach mitigates the impact of cyberattacks. At best, these measures will completely prevent one. We missed our opportunities to avoid a cybersecurity 9/11 and a ransomware Pearl Harbor. Let’s not wait to take action before something worse happens.

About Jeffery J Engle
Jeff Engle is Chairman & President at Conquest Cyber where he brings a broad spectrum of experience in Risk Management, National Security and Business Process Optimization. He is responsible for the development and implementation of all strategic initiatives including cyber risk management and secure digital transformation programs. He has served as a consultant for the Department of Defense’s premier adversary emulation team and has conducted vulnerability assessments and training all over the world.