Through extensive research and technological development, the guidelines for trustworthy cyber security operations have evolved. Secure systems advanced and now provide capabilities, functions and services to prevent a wide range of disruptions, threats and hazards.
At the same time, hacking techniques and tools have advanced. From the breaches that keep occurring, it is obvious that cyber offence is still a step ahead of defence.
Background
Most industrialised nations have experienced explosive growth in information technology. The world has computing and communication tools that previous generations could not have foreseen. The majority of the population is more dependent than ever on IT in personal and professional life. At the same time, we are seeing an increasing number of successful cyber attacks by nation states, terrorists and hacktivists stealing intellectual property, national secrets and private data.
The problem is simple
Our fundamental cyber security problem can be summed up in two words: too complex. There are simply too many software, firmware and hardware components in critical infrastructure and business systems. Increasing complexity means a bigger attack surface, giving adversaries a limitless opportunity to exploit weaknesses. Reactive measures (intrusion detection and response) help, but they do not address fundamental weaknesses in system architecture and design. Those can only be addressed by a holistic approach based on systems security engineering and security design principles.
What it will take
The cyber security threats to government, business, critical infrastructure and citizens are as severe as the threats of terrorism. Overcoming them needs significant investment, involvement of government, industry and the academic community. Creating more trustworthy, secure systems requires a holistic view, the application of science and engineering principles, and leadership focused on doing the right thing even when it is unpopular.
Originally published 21 April 2017. Migrated to the new IRC site in 2026.