Important steps needed to create a cybersecurity ecosystem so we can stop reacting to cyberattacks alone.

By Bobbie Stempfley, Vice President, Business Unit Security Officer, Dell Technologies 

The year is 2031 and, as predicted, organizations, governments and individuals worldwide are experiencing ransomware attacks every two seconds, costing cyber victims trillions of dollars. Losses like this make me want to go back in time and build an ecosystem that not only defends against those attacks, but also focuses on proactive end-to-end security protection. That time is now.     Thankfully, other cybersecurity experts in both the private and public sectors share this sense of urgency. Last month, the Cybersecurity and Infrastructure Security Agency (CISA) released its Strategic Plan 2023 – 2025, which seeks to improve the ways in which industry and the federal government collaborate to bolster the nation’s cybersecurity. The good news is collaboration across public and private sectors, within the security community and between commercial sectors is better than ever. This creates an ecosystem that has the potential to rectify the asymmetry that exists between those defending against cybercrime and those committing these crimes. Information sharing has evolved to operational collaboration and we have examples of this collaboration reducing risks. It is progress, but there is more to do.  

By taking this collaborative and coordinated approach to our digital ecosystem, a more resilient future is possible. Cybersecurity professionals must live in the past, present and future simultaneously. Our past is full of security and technical debt, but our future is an ecosystem backed by a collective effort to defend against increasingly sophisticated attackers.   

This more resilient future requires several important steps including:  

1. Enable organizations to better understand themselves so they can react faster to threats and build trust in their environments.  

2. Encourage innovations through secure software-driven solutions. 

3. Establish scalable collaborations that bridge public and private sectors. 

This starts with creating stability and visibility in organizations’ environments. Digital transformations have created complex environments with multiple on-premises and as-a-service providers making it difficult for organizations to establish a clear picture of digital workloads and the technologies that process them. Establishing visibility in these environments enables better detection and reaction to threats, as well as faster recovery when incidents occur. It’s about going back in time to identify patterns, previous cyberattacks and bad actors. It’s about focusing on the current activities in the environment, learning from them and engaging with the ecosystem for collective defense.  

As the National Cyber Director Chris Inglis describes, “with each of us playing our part, we can make it so that our adversaries will have to beat all of us to beat one of us.” This ecosystem doesn’t happen without industry collaboration. The private sector is a key player in this ecosystem and must make security, privacy and resiliency central to the design, development and manufacturing process, and operations of solutions and services. By incorporating these elements into our processes and collaborating with the public sector, we can create a hive-mind that fuels trust.  

Software-driven solutions can be an enabler and not viewed as only a risk, as this software-defined world can enable new models of protection. We’re already starting to see some of this happen in mature software shops. With current development models, vulnerabilities are not in the system as long and update cycles are coming in faster cadences. There is a flexibility with software that allows us to constantly utilize threat information to inform our development processes. This enables better utilization of the information we share, the data being created at the edge, so that we can quickly get back to a known state.    

By linking between the federal government and the private sector, we are creating a model for success. Operational collaboration through programs such as the CISA Joint Cyber Defense Center, information sharing activities like the FBI InfraGuard, and shared innovations produced through the NSA Cybersecurity Collaboration Center are vital in addressing ransomware and other distributed modern threats facing the ecosystem.  

This future is not guaranteed.

A secure and resilient ecosystem doesn’t just happen and there is certainly more to do. But, as is evident from the Strategic Plan CISA recently released, today’s collaborations have established a foundation that can enable the innovations and agility necessary. Can you see it?  Are you ready to put security, privacy, and resiliency at the center of your development process and share your knowledge?