Ten Reasons for Pessimism About Cybersecurity, According to BeyondTrust's CTO

Morey Haber, chief technology officer at BeyondTrust, set out to catalogue the reasons security teams feel gloomy about their work. His piece was the first of a pair, with a companion article making the case for optimism.

Haber starts from the observation that cybersecurity has become a standing subject of discussion everywhere from the CIO's office to the boardroom, and that defenders seldom get firmly ahead of current threats. Each new breach, critical vulnerability, privileged attack, ransomware outbreak or social engineering campaign adds to a sense of fatigue, and to the feeling that the fight cannot be won. In his view a stalemate is the best realistic outcome, since hackers and other threat actors will always try to undermine governments and businesses and to make money doing it.

He notes that thieves have existed for as long as history has been recorded, and no society outside science fiction has ever got rid of them. Some people find that depressing; others see the same fact as a challenge and a chance to do better. For anyone with a case of the Monday blues, here are his ten reasons for pessimism.

The attackers set the pace

1. Threat actors stay a step ahead

Haber describes modern cybersecurity as reactive. When defenders build a strategy or technology to deal with a threat, attackers change tactics to get around it or find a new vector. Old techniques still work and are used constantly, but the way threats evolve always leaves the attacker in front. Nobody can build a defence against an attack they have not yet imagined, and however skilled a defender is at inventing hypothetical vectors, criminals will come up with something that was missed.

2. Security products lag behind the threats

Designing, developing, maturing, testing and deploying a new security product takes time. By the time it ships, the threat may have moved on, leaving the product behind or even obsolete. Defences, he argues, simply do not evolve as fast as attackers change their methods. The number of virus signatures inside a current endpoint protection product illustrates the point.

3. Defenders may only defend

This is, Haber says, among the most argued-over subjects for white hat professionals. Every tool they have is defensive, and professional ethics forbid hacking back. Doing so would carry heavy legal and moral consequences, so unless something changes defenders will remain purely defensive, which in turn explains the first two points: they can never get in front.

Too few people, rules that stop short

4. The skills shortage

The lack of cybersecurity professionals, and its effect on companies and governments, is well known enough that Haber barely argues it. He does see a bright side here, as universities and private organisations are expanding cybersecurity training.

5. Compliance is not enough

Organisations are subject to a great many regulations, yet Haber finds them inadequate in practice. They give guidance on everything from application control to log management but say little about how to actually do it. Requiring a vulnerability management programme and the patching of every critical vulnerability is one thing; making that work is a separate problem. He rates the guidance in the various frameworks highly and notes how much they have in common, but getting them to work efficiently and affordably in a modern organisation is another matter. He would like regulations to include implementation best practice in place of a bare instruction to get it done.

Old systems, new devices and weak basics

6. No plan for end of life

Modern operating systems last roughly twelve years. Haber considers that far too short. If a system is working well on proven technology and has become part of critical infrastructure, reaching end of life should not by itself force a replacement. Most regulations do in fact require one, yet outdated systems still run power generation and missile defence because replacing them is too expensive and difficult. Once granted an exception, such systems no longer receive security patches or modern defensive technology, so the means of protecting them shrink further the longer they run past their end-of-life date. Businesses kept paper records in filing cabinets for far longer than ten years, as any local library shows, while in the new economy even libraries will have to replace their storage and systems well within a single human generation. His conclusion is that provision for end of life is poor, and that technology of this kind should last at least a generation, which he puts at 25 years.

7. The growth of the Internet of Things

IoT is growing explosively, but many products lack basic security hygiene and some are wired permanently into homes and cars. Haber gives the example of an internet-connected doorbell or thermostat and asks how long it will get security updates and when it reaches end of life. Five years is typical today. He doubts that people will rewire a new doorbell, thermostat or camera every three to five years, depending on where in the product's life cycle they bought it, so older devices stay open to attack, reinforcing every point above.

8. Poor basic hygiene inside organisations

Two decades after the dot-com bubble, organisations have still not mastered the basics: vulnerability management, patch management, privilege management, log management and the rest. These form the foundation of any defence and are essential to any modern security strategy. Without that foundation working properly, evolving attacks will slip past organisations and threats become harder to detect and stop.

Numbness and net neutrality

9. People are desensitised to breaches

A new breach makes the news every week, and people have grown numb to it. Neither the scale, the cost nor the exposure of sensitive personally identifiable information provokes much reaction any more. Everyone knows their personal details are already out there and that nobody can truly stay off the grid in the new economy. Given how serious the breaches of 2017 were, and what had already happened in 2018, Haber sees little room left to shock people or cause them pain. The next announcement of lost data barely registers.

10. Security risks from ending net neutrality

Haber calls the removal of net neutrality one of the most contested technology decisions of the then United States administration. Even if courts held it up for years, he argues its possible security effects go well beyond streaming films or illegal BitTorrent downloads. Every security product depends on updates and signatures, and a provider that throttled that traffic could hamper an organisation's ability to get the information it needs to fend off an attack. He accepts there is no evidence that any provider would throttle antivirus signature updates or operating system patches, but without net neutrality nothing stops them and no law obliges them to give such data priority. Providers would also gain the ability to throttle or block a real attack, yet what they may throttle or block is equally undefined. For these reasons he lists it as the last pessimistic factor with real consequences for the future of cybersecurity.

Haber's prescription is to use these problems as fuel. Some fixes will be a matter of policy, process, attitude or product, but giving in to negativity guarantees failure. Organisations wanting to change a culture of pessimism can pick any one of the ten topics and turn it into a challenge for a team, empowering people to fix or improve it and rewarding them when the result is insight. Disagreement is a strength, he writes, and pessimism is not. None of the ten problems will ever be solved for good, but accepting them as reality and working against the instinct to despair will, in his view, leave defences stronger.