Daily Security Blog

As we all know in addition to massive death and social destruction the pandemic has also brought economic collapse on many dimensions. Our economy, like just about everything else, is ultimately reliant on cyber systems. If the purpose of the legislation on the Senate floor is COVID relief then that needs to include making sure our economy recovers and our economy cannot recover unless the core systems of the economy – which in the 21st century are cyber – also recovers.

The foundational assumption of the expert agency regulatory model is that government knows what to do; all that is needed is to compel a recalcitrant private sector to follow government mandates. There is no evidence that government has attained that degree of expertise in cybersecurity. In fact, the data suggest the opposite.

Today The World Economic Forum, in collaboration with the National Association of Corporate Directors the Internet Security Alliance and PWC is today publishing a new set of principles for boards of directors to follow in exercising their duty of cyber risk oversight. While a number of these principles will be familiar to those who have followed the ISA/NACD work one important additional principle has been added.

A major reason why we are not making progress in securing cyberspace – and we are in fact losing ground rapidly– is that for the most part we have mis-analyzed the issue as a case of traditional corporate malfeasance.

Virtually any proposed solution to the cybersecurity problem that begins with the phrase “All you have to do” …. is almost certainly wrong. Despite what some marketers of their secret formulas and special sauce may claim, cybersecurity is a difficult problem to address sustainably.

Yesterday was Martin Luther King Day.  Tomorrow is Presidential Inauguration Day.  Both days should be celebratory of one of our nation’s great heroes and our nation’s proud democratic tradition. Instead, Washington DC looks incredibly ugly today.  The barricades, the barbed wire, the fences, the National Guard, the weapons.  All this has turned one of the […]

ISA congratulates CISA’s National Risk Management Center, and Director Kolasky for this vitally needed initiative.  The SolarWinds attacks have brought to everyone’s attention the need to rethink how we are conceptualizing cyber-attacks.  As we have pointed out in numerous blogs over the past two months the SolarWinds attack is a paradigm shift that makes future […]

In previous posts we have argued that the traditional regulatory model is ill-suited to address the nature of threats we see in cyberspace. It is too slow, too reactive, static and it sets minimums when what we need is a dynamic model equipped to grow with the ever-evolving threat.

If anything characterizes the 21st century it is speed and change. A generation ago people most typically had one phone in their house for their lifetime. Now we change phones (smart phones) every couple of years – at least. Waiting a FULL TWO SECONDS for a computer, or app, to download is, let’s face it very annoying.

Doing the same thing over and over and expecting different results is the definition of insanity. —Albert Einstein