Cybersecurity: Are We Fixing the Wrong Problem—or Asking the Wrong Questions?

My reading habits are eclectic.

Somewhere between business news, technology, politics and whatever else catches my eye, I came across this Le Monde story about more than 700 French supermarkets being hit by cyberattacks on their refrigeration systems.

Yeah, refrigerators.

Attackers were reportedly able to change settings, overheat equipment and destroy food.

At first, it sounds almost amusing.

Then you think about it. If somebody can remotely manipulate refrigeration systems in hundreds of supermarkets, what else could be manipulated the same way?

Well, I imagine things like power grids, water systems, telecommunications networks, and hospital equipment and patient vitals.

And here is what really troubles me:  Despite all the money, technology, expertise, regulation and management attention we have poured into cybersecurity, it seems to be getting worse rather than better.

Maybe that is too simplistic. But serious attacks keep happening, the consequences keep growing, and many of the underlying causes sound remarkably familiar.

That led me back to an uncomfortable question I have been asking for some time: Is our current approach to cybersecurity really working?

What also bothers me about the supermarket story is how “same old, same old” the underlying problems sound: old technology, known vulnerabilities, internet-connected equipment, systems that were difficult to configure and maintain securely, and unclear accountability between users and suppliers.

We have seen variations of these problems over and over again, across companies, industries and countries.

At some point, I think we have to ask: Is this a flood of separate, unrelated cybersecurity incidents — or is it evidence that the way we manage cybersecurity is flawed, perhaps fundamentally flawed?

Maybe we are working the problem from the wrong end

We spend enormous amounts of time and money finding vulnerabilities, monitoring networks, detecting attacks, patching software, conducting audits and responding when something goes wrong.

Obviously, we need to do all of that.

But I wonder if we spend too little time on a more basic question:

Why are so many vulnerabilities making it into the field in the first place?

I think of cybersecurity vulnerabilities as simply software quality or design defects: bad code, bad architecture, unsafe defaults, and products so complicated that reasonably competent people can easily configure them incorrectly.

Coming from an operations background, I find our approach strange.

Imagine a manufacturer producing millions of a component with quality defects, installing them in Customers’ equipment all over the world, and then depending on every Customer to find and repair the defects before something bad happens.

We wouldn’t call that a good quality system.

We would attack the defects at the source.

The best vulnerability to patch is the one that was never shipped.

I think four things need to change

1. Dramatically reduce the vulnerabilities being shipped

Treat serious cybersecurity vulnerabilities as software quality defects.

Measure them.

Find the root causes.

Change development and testing processes.

Hold management accountable for driving defect rates down.

Not to zero. That is probably impossible.

But dramatically lower than what we seem willing to accept today.

I bet the technologists can figure out how to do it.

2. Make technology much harder to operate insecurely

Some IT, networking and connected equipment may simply be too complicated to configure safely.

If secure operation depends on thousands of administrators, contractors and Customers getting dozens of settings exactly right, predictable mistakes are going to happen. That is not only an operator problem. It is also a product-design problem.

Security should be the default.

Dangerous configurations should be very difficult to create.

Unsupported software should be obvious.

Known critical vulnerabilities should be hard to ignore.

Updates should be as automatic and painless as reasonably possible.

We have used the same idea in quality and safety for decades: design systems so human mistakes do not turn into disasters.

3. Manage cybersecurity like an operating-performance problem

Companies using the technology still have plenty of responsibility. Management should know:

What do we have?

What is connected?

Who owns it?

Which systems are obsolete?

What serious vulnerabilities remain open?

How long have they been open?

Who is accountable for fixing them?

What happens to the business if somebody exploits them?

And when we outsource part of the operation, who inside the company still owns the result?

You can outsource the work. You cannot outsource accountability.

Then measure performance: time to discover, assess, remediate and contain; repeat failures; actual business impact; and potential business impact.

Then do what good operators do: use root-cause and Pareto analysis to concentrate management attention on the relatively small number of problems creating the greatest risk.

4. Make serious, preventable failure expensive

Perfect software does not exist.

I am certainly not suggesting fines every time somebody discovers a vulnerability.

But preventable defects are different.

So are known critical vulnerabilities that linger.

So are companies that operate critical systems sloppily despite knowing the risks.

At some point, maybe big fines may need to be part of the answer.

We know management attention increases when failure becomes expensive.

That is true in safety, environmental compliance, financial controls and product quality.

Why should cybersecurity be different?

One more uncomfortable question

I hate being cynical. It’s contrary to my fundamental faith in people and organizations.

But I do wonder whether the current cybersecurity establishment is equipped to drive the kind of change that may be needed.

There is now a very large ecosystem built around cybersecurity: software, consultants, security organizations, auditors, regulators, insurers, vulnerability management, patch management and incident response.

I am not suggesting bad motives.

But people and organizations naturally become very good at solving the problem as they currently frame them.

And much of cybersecurity today seems organized around coping with vulnerabilities after they exist.

So I wonder:  Are we spending too much effort managing vulnerabilities—and not enough effort eliminating the reasons we keep creating them?

Will it take a catastrophe?

This may be what concerns me most.

Will it take a massive cybersecurity catastrophe before we decide incremental improvement is not enough?

A major power failure or telecommunications outage?

A water system compromised?

Hospitals unable to operate?

Lives lost?

I sincerely hope not.

Too often, we tolerate warning signs for years and make fundamental changes only after a disaster makes sticking with the old way untenable.

That would be a terrible way to learn a lesson we may already have enough evidence to understand.

Maybe cybersecurity needs its own quality revolution

Years ago, many industries changed the way they thought about quality. Quality was no longer something inspectors were supposed to catch at the end. The objective became to design quality into the product and process from the beginning.

Perhaps cybersecurity needs the same kind of change:

Fewer vulnerabilities shipped.

Products that are secure by default and hard to configure insecurely.

Clear operating accountability and measurable performance.

Serious consequences for serious, preventable failure.

And, because we will never eliminate every vulnerability, much stronger resilience for the failures that remain.

I certainly don’t pretend to have the answers, but I do think I’m asking good questions.

I spent much of my career managing large, complicated operations. When the same kinds of failures keep recurring despite enormous amounts of effort and money, eventually you stop asking how to fix the latest failure.

You start asking what is wrong with the system that keeps producing it.

This is my thinking-out-loud on cybersecurity.  I would genuinely like people who know this field better than I do to challenge my thinking.

Where is my logic wrong?

And if it isn’t wrong:  What are we waiting for? And who in the cybersecurity community is going to lead the way?