Elevating Cyber Security by Bridget Walshe

Key Concepts

Cybersecurity integration, historical evolution of cyber threats, the cycle of technology development and threat exploitation, national-level cybersecurity outcomes, impact of standards and regulations, incentivization of good cybersecurity practices, cross-sector collaboration, risk communication.

Historical Context and Evolution of Cyber Threats

The speaker begins by emphasizing the increasing criticality of cybersecurity and its need to be integrated into all aspects of business operations, similar to financial planning or HR. They highlight their role at the Canadian Centre for Cyber Security, providing operational support to the government and advice to Canadian industry and citizens.

The speaker then provides a historical perspective, recalling the decommissioning of the NSFNET on April 30, 1995, marking the transition to the commercial internet. This transition is framed as a pivotal moment, initiating a cycle of technological advancement followed by the emergence and adaptation of cyber threats.

• 1960s: Early network development.
• 1969: Creation of ARPANET by the US Department of Defense to enable communication between research institutions.
• 1971: The first computer virus, "Creeper," demonstrated the potential for self-replicating software to spread across networks.
• 1986: The National Science Foundation Network (NSFNET) expanded the internet beyond military use.
• 1989: The first commercial internet provider emerged.
• 1980s: Appearance of widespread viruses and worms, including the Morris worm in 1988, which caused significant disruptions. This era also saw the development of antivirus software, illustrating the cyclical pattern of threat and defense.
• 1971: First email sent, leading to spam in the 90s and malware delivery in 2000 (e.g., the "I Love You" virus).
• 1975: Data Encryption Standard (DES) became available, but encryption was later used for malicious purposes like ransomware by 1989.

Technological Advancements and Associated Risks

The speaker discusses how advancements intended to improve communication and security have been exploited by threat actors.

• Large Language Models (LLMs): While enhancing efficiency, LLMs also enable threat actors to operate more quickly.
• Internet of Things (IoT) and Industrial Control Systems (ICS): Increased efficiency comes with the need to protect core infrastructure.
• Quantum Technology: While promising, the development of large-scale quantum computers poses a threat to current public-key cryptography. The transition to quantum-resistant algorithms is underway but will take time, leaving vulnerabilities.

Cybersecurity Innovation and Response

The speaker highlights various innovations and responses to cyber threats:

• Sensor Technology: Development of sensor technology to provide layers of protection beyond antivirus.
• Malware Detection and Analysis Tool (Assembly Line): Open-source tool for malware detection and analysis.
• Computer Emergency Response Teams (CERTs): The first CERT was deployed at Carnegie Mellon University in 1988.
• Secure by Design Methods: Automating security processes, such as moving from manual to automatic updates.
• Standards and Norms: Development of standards by organizations like the Internet Engineering Task Force (IETF) to ensure interoperability and minimum security requirements.

Fundamental Questions for Improving Cybersecurity

The speaker poses three fundamental questions to examine and improve cybersecurity:

1. What has worked across all those Innovations? What has provided the greatest improvements to cybersecurity, and what are their characteristics? The speaker emphasizes the need to understand what makes a cyber defense mechanism successful on a broad scale. They mention the Cyber Centre's focus on solutions that provide a national-level outcome, such as sharing indicators of compromise through Canadian Shield, a free DNS firewall service. They also suggest learning from other domains, such as studying traditional forms of extortion to disrupt cybercrime.
2. What impacts have standards, norms, laws, and regulations had on Cyber threat Behavior? Are norms and standards easy to implement, and do they have a high uptake and significant impact? The speaker notes the interjurisdictional aspect of the internet and how regulations in one country can impact operations in another, citing the GDPR as an example. They also discuss unintended consequences, such as how data privacy legislation can be used by ransomware actors as a psychological means of extortion.
3. What are the reasons that good cyber security is prioritized? What factors incentivize good cybersecurity practices? The speaker questions whether there is a clear expression of risk that helps to push cybersecurity. They highlight the differences in how risk is perceived across sectors (government, banking, health) and the need to develop mechanisms that describe risk in a way that easily translates across sectors. They also emphasize the importance of incentivizing secure design and encouraging small and medium-sized businesses to invest in cybersecurity.

Synthesis/Conclusion

The speaker concludes by emphasizing the need for a different approach to cybersecurity, one that integrates it into the daily fabric of how businesses operate. They encourage collaboration across disciplines, adapting the way cybersecurity is communicated, and sharing research on the cybersecurity ecosystem. The main takeaway is that cybersecurity must no longer be viewed as an afterthought but as a fundamental aspect of how we conduct business, innovate, and deliver value. The speaker advocates for a deeper understanding of the cybersecurity ecosystem, including its economic, psychological, and criminological aspects, to break the cycle of threat and defense.