{"id":5767,"date":"2023-10-13T15:56:15","date_gmt":"2023-10-13T19:56:15","guid":{"rendered":"https:\/\/solutionsreview.com\/network-monitoring\/?p=5767"},"modified":"2023-10-13T15:57:14","modified_gmt":"2023-10-13T19:57:14","slug":"what-does-successful-cyber-warfare-look-like","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/network-monitoring\/what-does-successful-cyber-warfare-look-like\/","title":{"rendered":"What Does Successful Cyber Warfare Look Like?"},"content":{"rendered":"

Solutions Review\u2019s\u00a0Contributed Content Series<\/u><\/a> is a collection of contributed articles written by thought leaders in enterprise software categories. Mike Starr of trackd<\/a> charges into battle to redefine what success in cyber warfare looks like in the modern age.<\/strong><\/em><\/p>\n

Conventional shooting or \u201ckinetic\u201d wars used to end with a clear winner and clear loser, and the closure was palpable in ticker-tape parades, terms-of-surrender signings, and mass discharges of returning soldiers. That, clearly, is no longer the case, exemplified by the seemingly endless analyses during our wars in Afghanistan and Iraq that asked a common question:\u00a0 what does victory look like?<\/p>\n

A similar question might be asked about other, less-conventional \u201cwars\u201d, for example, the war on drugs, the war on terror, or the war on poverty, all now decades old, and some more than a half-century. It seems we start to ask the \u201cwhat does victory look like?\u201d question only after a war becomes protracted, and frankly, when it feels very much like we\u2019re losing it.<\/p>\n

So it may be time to ask that question – or a version of it – about InfoSec:\u00a0 what does successful cyber warfare look like? Cybersecurity professionals have been battling threat actors since at least the inception of the public internet, so we\u2019re starting our 4th decade in this war against the bad guys, and I don\u2019t think anyone in the cybersecurity community would say with any degree of seriousness that we\u2019re winning, or even moving in the direction of a conventional victory.<\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\n

What Does Successful Cyber Warfare Look Like?<\/strong><\/h2>\n
\n

In the Trenches…<\/strong><\/h3>\n

It feels more like trench warfare in World War I than the march to Berlin a couple of decades later, and the cybersecurity community has been coming to terms with the reality that the goal of stopping cyber-attacks is giving way to a more pragmatic \u201cmanagement of cyber risk.\u201d That might sound a bit like surrender, but we do live our lives managing risk every day. If we wanted our risk of personal injury to approach zero, we\u2019d never get in a car, an airplane, or leave the house for that matter, but that would certainly limit our prospects for employment, not to mention our enjoyment of life. But, we do our best to minimize that risk with seatbelts, car safety features, etc. Returning to the topic at hand, the equivalent of never driving or venturing outside in cybersecurity would be removing all connections to the public internet (although even that wouldn\u2019t stop insider threats and social engineering attacks 100 percent).<\/p>\n

A business can\u2019t function in 2023 if disconnected from the internet, and humans can\u2019t live fulfilling lives in a protective bubble, so, we accept and manage risk every day. Where the cybersecurity challenge differs, however, is that the probability of occurrence is staggeringly high compared with, say, the probability of having your car stolen (0.3 percent) or being audited by the IRS (0.45 percent). Unlike those sub-1 percent odds, there\u2019s an 80 percent chance of being the corporate victim of a cyber breach, or at least that\u2019s what those charged with defending their organizations against cyber-attacks believe.<\/p>\n

“When”… Not “If”<\/strong><\/h3>\n

Over the past several years, the cybersecurity community has operated under the mantra of \u201cwhen, not if\u201d when it comes to network compromises, which is a tacit recognition that the war against cyber-criminals will not end with a surrender ceremony. Now, the community needs to take that tacit acceptance and make it explicit. \u201cWinning\u201d is no longer defined as avoiding a breach, but rather minimizing the likelihood of a breach while maintaining robust corporate operations\u2026and preparing for an inevitable compromise. A breach should no longer be met with shock and panic but should be planned for, practiced for, and calmly addressed. All things much easier said than done. And this is where senior leadership comes in. Giving lip service to cybersecurity as a risk to the business and then using the CISO and other infosec management as scapegoats when the inevitable happens is unhelpful.<\/p>\n

Encouragingly, the concept of \u201ccyber resiliency\u201d is gaining traction among infosec professionals, and its holistic approach to minimizing cyber risk is not only refreshing, but at its core, explicitly acknowledges that network compromises are an unavoidable element of IT and security operations. An exhaustive treatment of cyber resiliency theory is beyond the scope of this piece, as well as the author\u2019s expertise, but it includes five areas of cyber risk management:\u00a0 prepare\/identify, protect, detect, respond, and recover. The last three of those openly recognize that the first two will not be fool-proof, and that crossing fingers is no substitute for comprehensive cyber security operations.<\/p>\n

Changing the Criteria\/Final Thoughts on Cyber Warfare<\/strong><\/h3>\n

If a compromise is a foregone conclusion, then the cyber security operation must be judged by a different standard than \u201canything less than going undefeated is a failure.\u201d Rather, the criteria should be:<\/p>\n