Cyber defence faces a growing disconnect between perception and reality.
There are two main camps in the information security world today, and their arguments can be compared to the recent sports debate over whether Tim Tebow can be successful as an NFL quarterback in the long term.
In one camp, we have salespeople, marketers, various security entrepreneurs and “experts” telling executive decisionmakers that cybersecurity is straightforward, if you just do it their way. This is strikingly similar to sports pundits who insist that a quarterback with limited passing skills (i.e. Tebow) simply can’t cut it against today’s sophisticated NFL defences.
In the other camp, we have self-described pragmatists who in practice often trudge cyber around like Eeyore the donkey, proclaiming that hackers with zero day exploits not only can get into your systems, but in fact are already there, and will never leave. This group corresponds to Tebow’s most ardent supporters. They’ve made their decision regarding Tebow, and their “he just wins and has a great attitude so ignore the rest” argument seems to trump other measures of success.
I would argue that both camps, in cyber defence as in football, have blind spots, holes in their perception that limit their effectiveness. Let’s look at the Tebow argument a bit more and see what it can teach us about our cyber defence mission.
Team one: “Cyber defence is as easy as stopping Tim Tebow”
Overheard: “We offer better protection, more peace of mind, and a complete security solution for less money with our new managed ‘xyz’ product/service.” This boilerplate marketing claim makes cyber defence appear as easy as buying a car. All you need to do is hand over the virtual keys to your new trusted security partner!
The more sophisticated members of team one will readily acknowledge past mistakes and security industry product and service failures. In fact, mocking recent tactics by other companies and discussing new global threats facing the cyber defence business is an important part of their intriguing sales pitch.
Nevertheless, they insist that their new offering is somehow different. The pitch goes something like, “We know why that ‘their’ last product failed to live up to expectations, but we’ve incorporated a new rigour, new secret sauce, a new approach into our patented solution that are competitors are missing. We’ve gone back to the basics to uncover the reasons why everyone else lacks what we have.”
This group tends to be overconfident with bold victory predictions. “This is really very easy. There is no way that our product or service will fail. We’ve now figured cybersecurity out.”
Before we go on, you may be wondering: Why compare corporate cyber defence with the NFL defences trying to stop the Denver Broncos’ quarterback?
It’s simple: We more readily see our blind spots, and we all have blind spots, when they are put into another context that is not as threatening to our professional situation.
Since we’re heading into the NFL playoffs and since everyone seems to have an opinion on Tim Tebow, this analogy could be helpful. This comparison is meant to be taken in fun and not viewed literally. Of course, Tim Tebow is not a “bad guy” hacker.
Tebow’s Broncos are both popular and controversial because in mid-season they kept defying logic and winning in unconventional ways. In one game against the Kansas City Chiefs, Tebow completed exactly two forward passes. This is a stat you might expect to see in a college football box score from 1910 or so. And many of the Broncos’ wins were accomplished through exciting last-quarter comebacks.
Some say Tebow is leading a team that is easy to stop on Sundays. This group, called Tebow-haters by many on team two, insist that the Heisman Trophy winner from the University of Florida will never be a successful NFL quarterback. Even through Denver’s winning streak, team one remained defiant, saying that Tebow was lucky.
Others said Tebow is statistically flawed and bound to eventually fail. Their slogan: “Tebow can’t throw!” Chicago linebacker Brian Urlacher, even after losing to Denver, could only give Tebow a backhanded compliment by calling him “a good running back.” Denver’s three end-of-the-season losses have strengthened this viewpoint.
View full post on National Cyber Security » Computer Hacking