That’s not to say the defenders don’t see the enormity of the challenge they face.

Phyllis Schneck, deputy undersecretary for cybersecurity and communications for Homeland Security’s National Protection and Programs Directorate, said one of the hardest problems is clearing “some of the ridiculous noise out of the Internet,” separating the run-of-the-mill attacks from the advanced threats.

The first goal of the defender is “to make it less easy for the adversary so that we can start to hunt and find the really sophisticated stuff,” she said. This was immediately followed with, “Game on.”

Similarly, Defense Secretary Ash Carter announced a new bug bounty program for the Pentagon, opening its networks to white hat hackers. While this is becoming an industry standard, for the Department of Defense — which, by its nature tends to take a more conservative position on these sorts of things — inviting this level of scrutiny feels like a bold move. (One I applaud them for making.)

During a panel espousing the effectiveness of automation — another worthy endeavor — National Security Agency Special Assistant to the Director for Cyber Philip Quade cited an agency facing a billion incidents each day. By automating significant parts of the detection and mitigation process, the agency was able to go from resolving a few dozen incidents a day to tens of thousands. That’s a huge leap, for sure, but “tens of thousands” still doesn’t come close to “a billion.” Cassandras“The barbarians are at the gates,” he said. Though what’s worse, today, “There aren’t any gates.”

But everyone at the conference recognized the threat is real. And maybe some over-confidence — a little swagger — isn’t such a bad thing, so long as you can face down the horde when it comes knocking.

That was the thrust of a presentation by ZeroFOX head security writer Spencer Wolfe and NATO Ambassador to the Cooperative Cyber Defense Centre of Excellence Kenneth Geers at this year’s RSA Conference in San Francisco.

Wolfe set up the conversation, offering five important lessons from the major battles that shaped the ancient western world, from the rise of Greece to the fall of Rome. Geers followed up each lesson with how it applies to the modern world of cybersecurity.

Lesson 1: Choose your battlefield.

The first lesson was taken from two of the most iconic and important battles of all time: the Grecian defense against the Persians at Thermopylae and Salamis.

In both battles, Greek forces held off significantly larger and better resources attackers by picking the best locations available. The Greeks knew their home turf and led the Persians into traps.

Similarly, an adversary might make initial inroads in an attack but a smart defense will leave them chasing their tails.

“As you architect your cyber defense, you should think in terms of traps, in terms of tricks, in terms of a unique style that no one has ever seen before,” Geers said. “Present the hacker with something that is a challenge because from the hacker perspective, your network is a black box.”

Lesson 2: Be original.

Later in Grecian history, the city-states often warred with each other, often using the same phalanx battle technique, with thin lines and the strongest troops positioned on the right side of the formation. However, during the battle of Leuctra, Theban general Epaminondas turned that tactic upside down, putting his best troops head-to-head with the strongest Spartan units on the field.

“The left side goes forward, meets the Spartans best troops and are able to break them … and of course when you see your best troops defeated and fleeing, the rest of the army folds,” Wolfe explained.

“Pitched battles and cybersecurity are games of wit,” he said. “Originality is your ace in the hole.”

Lesson 3: Know thy enemy.

Wolfe broke from the western-theme briefly to quote Sun Tzu, the famous Chinese philosopher who wrote “The Art of War.”

“If you know your enemies and yourself, you will not be imperiled in a hundred battles,” Sun Tzu wrote. “If you neither know your enemies nor yourself, you will be imperiled in every single battle.”

Wolfe pointed to Phillip II, father of Alexander the Great, as a perfect example of this tactic.

Phillip faced four major powers in his quest to conquer and unite the Greeks: the Paionians, Thracians, Dardanians and Athenians. Knowing he couldn’t take on all four at once, Phillip bought off the first two and married a Dardanian princess, enabling him to focus on defeating Athens.

Today, Geers said understanding the common thread in major cyber incidents can help defenders understand the enemy.

He pointed to Russia as the one to watch, as the country has been at the center of most major incidents since the 1980s. Knowing the kind of attack vectors and intent of the attackers will help defenders anticipate the next incident and mitigate the effects.

Lesson 4: Lead from the front.

Phillip’s son, Alexander the Great, surpassed even his father to become one of the greatest generals of all time. One of the reasons for his success was the unwavering support from his troops, largely due to his prowess as a general but also because he led them into battle from the front lines.

In modern times, we’ve gone from “Alexander the Great to Alexander the Geek,” Geers said, referring to former NSA and CyberCOM Director Gen. Keith Alexander.

Under his tenure, U.S. warfare took on a cyber element as never before.

“He oversaw the rapid expansion of cyber integration into signals intelligence,” Geers said. “Such that now if Seal Team Six goes into Libya, they not only have air cover but they have cyber cover taking them in and protecting them.”

Lesson 5: Fight fire with fire.

The final lesson was taken from one of Rome’s greatest defeats: the Battle of Cannae, in which the Carthaginians slaughtered the Roman army. Carthage used advanced maneurvering to flank the Romans on both sides, enveloping the army and closing off their retreat, Wolfe explained.

As the Punic Wars raged on, Roman general Scipio learned from that defeat and used the same tactics against the Carthaginians in the Battle of Ilipa 12 years later to great effect.

“The lesson here is not only to think like the enemy but also to act like them,” Wolfe said. “Act like a hacker. You have to both think and act like the adversary to understand the threat that’s coming in.”

Conclusion: The modern perimeter.

Wolfe wrapped up the presentation with a look ahead — namely the security issues posed by the widening perimeter caused by the spread of BYOD and the Internet of Things.

“The barbarians are at the gates and, unfortunately, there aren’t any gates,” he said. “The perimeter is that thin.”

Why does DHS go to big cybersecurity conferences like RSA?

We thought it was really important for the Department of Homeland Security to be here. For a number of years now we’ve been coming to this conference and we do so for a number of reasons.

One is to make sure we understand the innovation and the trends that are happening in this very important area of cybersecurity solutions and cybersecurity technology because we need to benefit from that innovation and that technology.

It’s also important to us that the folks out here and across the country that are working in that innovative field understand what we do and the role of the department in protecting particularly the .gov space but also working to protect critical infrastructure and private sector cybersecurity.

And then, third, we’d like to recruit some more of the best and the brightest to fill our ranks.

What trends have you seen at the conference so far that have piqued your interest?

There are all kinds of things that are happening out here that are very interesting to us and important to us. We have developed for the .gov space an important platform called Einstein that we hope to continue to build by adding innovation, innovative products and developments from the private sector.

Similarly, out Continuous Diagnostics and Mitigation program, which looks at the health of the network and who’s on the network from the inside is really bringing into the government technologies and products produced by the private sector.

So the kinds of things folks are talking about out here — the innovative approaches to achieving scale, for example, how do we make sure the things we’re doing we can do on a scale that matches our adversary; the speed with which our adversary is moving; the ways in which we have to be able to learn, do machine learning; be able to recognize things we’ve never seen before. This is work that we’re undertaking at the department and we’re benefiting from some of the innovation out in the public sector.

What are you telling industry while you’re here?

We want industry to know that we are very interested in not competing with the private sector. But in collaborating with the private sector — mostly in benefiting from the kinds of innovation and technology that’s being developed out here.

We want to make sure they understand the challenges we’re seeing in trying to bring both tools and techniques to the civilian government space but also in helping the private sector do better risk management.

And I’m pleased to see out here that there’s a lot of talk about the recognition of the need to move to a risk approach and a mission-based approach to cybersecurity.

How do you motivate people to join the government when the private sector offers much higher salaries?

In terms of building the cyber workforce, I’ve been talking for some time now with my colleagues in the private sector about working together to both put resources into building that pipeline. Going to colleges and universities to make sure that we’re appealing to students to go into cybersecurity but also providing some resources to help there.

The deal that I make with the private sector is: I’ll hire them right out of school and we’ll give them on-the-job training for a few years, then you lure them away with a bigger salary, more money. And then when they’ve put their kids through college, they’ll miss the mission and they’ll come back to us.

That’s the way we’re going to have to begin to think about our workforce, which is different for the government. Not getting someone in and keeping them for an entire 30- or 40-year career.

It starts with sharing information about an incident — just that it took place — and progresses to how the breach was detected, how the damage was mitigated and so on.

“It’s not just good enough to understand what to look for but what actions you take based on that,” Quade said.

Sharing information about threat vectors, signatures and new malware is an important aspect of a robust cybersecurity posture for any organization. But too much information is almost as useless as none at all.

Adding automation to the process — letting computers do the heavy lifting at machine speed — is the answer, according to Quade.

“What we’re trying to get to is automated decision making with a human above the loop,” he said. “It’s a robot that’s making the decisions, to take the burden of the minutia off the human being.”

The vendor space hasn’t quite caught up to that need, he added.

“There are lots of pitchers but not a lot of catchers,” Quade said, with plenty of tools to transmit threat data but few capable of high-level intake and processing.

Bringing together multiple data sources in a unified system is a lot like conducting a symphony where everyone is using different sheet music. The keys to making it work are automation and orchestration.

“We rely very, very heavily on automation and integration,” said Philip Quade, special assistant to the director of NSA for cyber.

He pointed to a federal agency that was getting hit with more than a billion incidents a day. Prior to automating its security operations, the agency was only able to handle approximately 65 of those a day through manual processes. Additionally, manually reviewing an incident took anywhere from 11 minutes to 11 hours.

“They turned on the COTS [commercial off-the-shelf] secure orchestration and instead of doing 65 events a day, they started doing tens of thousands of them simultaneously,” Quade said. “And they were doing that in anywhere from 0.1 seconds and 1 second. They were able to increase security and increase efficiency at the same time.”

Quade offer four lessons the NSA has learned from its efforts to automate its threat identification systems.

Cyber defense means protecting networks inside and out

“We need to have active cyber defenses at the boundaries of our networks,” Quade said. “However, boundary defense alone is not sufficient.”

Quade equated it to only focusing on cyber hygiene, which is important but only one aspect of cybersecurity. To have a truly robust security system, defensive tools need to focus on protecting the perimeter as well as the data flowing inside the network.

Orchestrate, don’t replace

Quade noted it isn’t practical to expect organizations — whether federal agencies or private companies — to replace their entire enterprise architecture just to automate threat detection. Rather, organizations should be looking for orchestration products that can be bolted on to boost security monitoring on existing systems.

For NSA, that means having a “bring your own security enterprise approach,” he said.

“Whatever products you already have … you need to embrace existing COTS products on your network and get them to work as a team,” he said.

Products should act as one

“One-off solutions have proven unwieldy,” Quade said. “You can’t expect customers to buy three or four or five, six, twelve different products, each with its own dashboard and figure out a way to manage all those on the enterprise.”

Instead, organizations should look to integrate as many products as possible.

“It’s all about integration and automation to accommodate security at speed and scale,” he said.

COTS, meet GOTS

Finally, Quade noted the immediate depreciation of products as soon as they’re developed, a problem that is perhaps most stark when it comes to government off-the-shelf solutions (GOTS).

“GOTS products that the NSA or someone else might advocate … their shelf-life starts ticking down the second they’re conceived,” he said. “What we really need are COTS-based solutions that use standards — an open standards based approach,” so they can be integrated with new tools as those become available.

“Secure orchestration is a game-changing approach,” Quade said, so long as it’s done correctly.

Editor’s Note: A previous version of this story quoted Quade speaking about a specific agency. He actually referred to an unnamed agency CIO. The story has been updated to reflect this.

1. The Internet of Things is opening a whole new set of complications.

2. Medical devices are part of it.

3. Why hacking back is a bad idea. (Hint: Legalities.)

4. Sometimes you pull one string and unravel a whole ball of twine.

5. Divine intervention is a two-edged sword.

Want more from RSA? See all of our coverage.

Thomas Ruoff, director of technology innovation and mission integration for the Department of Homeland Security, likened provenance to a professor trying to determine whether a student actually wrote a paper or whether it was plagiarized it.

By breaking down the code and comparing certain attributes to other forms of known malware that have been seen before, defenders can identify see patterns that tell them the signs to watch for. From there, through statistical analysis, they can assign a trust score to the traffic coming from certain sources or bearing certain signatures of malicious intent.

While this tactic isn’t perfect — true zero-days pop up all the time — it is a fast and efficient tool DHS and others are using to identify and block a large swath of attacks, Ruoff said during a panel discussion at the 2016 RSA Conference in San Francisco.

“It enables us to rapidly make a probability [determination] of authorship, probability of intent,” he said. Furthermore, “it also allows us to think about the reuse of code and how the actors readily reuse malware, change it a little bit — therefore change the hash — that approach is somewhat nullified if you have to change a tremendous amount of the object to make it not attributable … It means the economics and the sweat equity of the bad guy are changing.”

DHS is working with the FBI, Justice Department, National Security Agency and others to pull in and analyze more code to build better provenance profiles. But, as the private-sector work in this area continues to grow, the government is also looking to industry to provide additional data.

Some of that will come through information sharing — the framework of which is just being established — while other data will be purchased directly from companies trading in threat intelligence, according to Phyllis Schneck, deputy undersecretary for cybersecurity and communications within the DHS National Protection and Programs Directorate (NPPD).

Using multiple sources of information enables analysts to build a more comprehensive trust score, adding in indicators and knowledge from all angles.

Even then, the system is far from perfect. But it is effective at identifying software at the far ends of the spectrum, Schneck said.

“Probabilities on this tend to be very reliable on the good end and on the really bad end and that’s what we’re most concerned with. The middle is a science project that we’re looking at,” she explained. “But it’s the ability to clear some of the ridiculous noise out of the Internet; to make it less easy for the adversary so that we can start to hunt and find the really sophisticated stuff.”

Schneck compared it to a bank robber making a slight costume change and then attempting to rob the same bank. He might not be the smartest robber out there, but he needs to be stopped and this is one way to do it.

“To truly cause pain to this adversary we have to cut the business model and make sure they stop reusing and just tweaking software and they get right back at us and get in,” she said. Creating a robust provenance and attribution system gives agencies “the ability to absolutely destroy the model where the adversary simple takes a piece of software and sends it back out again.”

During a fireside chat with Ted Schlein, a general partner at Kleiner Perkins, Caufield & Byers, titled, “A Conversation on Collaboration Between Silicon Valley and the Department of Defense,” Carter cited the department’s new Defense Digital Service, the brand-new Defense Innovation Advisory Board and a satellite office that recently opened in Silicon Valley.

All these are intended to bridge the divide between DoD and the private sector and help the former innovate more like the latter.

“Reach out to us,” Carter said. “Whether you’re looking at our problems and offering us a solution; whether you’re offering your own commitment for a year, six months. We have lots of avenues for you to connect with us and we’re trying to create more every day.”

Defense Digital Service

The Defense Digital Service — modeled off the U.S. Digital Service and similar teams on the civilian side — is a great way for individuals to test the waters of working at DoD without having to jump all the way in, Carter said.

The DDS is designed to be a way for private sector cyber and IT experts to do tours of duty with the DoD for one or two years at a time.

“Come in, work with us … no strings attached,” Carter said, adding that he would have loved an opportunity like this when he was starting out in the private sector. “You don’t have to become part of the government. Come in, try it out, work on an important problem for a year or two, see how you like it.”

After the tour is up, those people can leave to do something new or sign up for public service and continue their work.

“That’s an example of a people bridge between the innovative sector and the government,” he said.

Defense Innovation Advisory Board

Earlier in the day, news broke that DoD would be establishing an advisory board of tech experts to help advise the secretary and the department.

“This is going to be some people who are the best technical minds who come in and spend some time telling me how we can be more innovative,” Carter said.

That effort will be led by Eric Schmidt, executive chairman of Alphabet (formerly known as Google), who will also be tasked with filling out the board’s ranks. Carter said he plans to give Schmidt “substantial latitude” in those appointments.

Once the board is fleshed out, the members will travel to bases and installations around the world to get a sense of how the DoD works and the inherent challenges to innovation.

Then, the board will “tell me how we can do better,” Carter said.

Silicon Valley Office

Carter said the DoD bureau stationed in Silicon Valley is just getting off the ground but he hopes it will be a place where private sector experts can come meet the department one-on-one and find out where they can work together.

“It’s a place to connect,” he explained. “I’ve given it a very open charter: Just make connections. Make money connections — that is, help people understand the places in the department where they can secure funding for ideas they think are relevant for defense — where they can get to know the programs I’ve described — like if they want to take a tour of duty — it’s a place where our people can be and connect with all of you.”

Carter said DoD is still experimenting with the best structure for this office but encouraged anyone with an interest to visit.

Ultimately, the branch will be successful so long as it fosters conversations between the sectors.

“Our job is to protect you and we’d love your help,” he told the crowd.

While the Justice Department and other law enforcement agencies are fully behind the FBI’s efforts, some in government — like Defense Secretary Ash Carter — aren’t sure building “backdoors” to encryption is a good idea on the whole.

While speaking at the RSA Conference in San Francisco, Carter said he wouldn’t comment on the specific case before the courts. However, in general he said he’s “not a believer in backdoors or a single technical approach” to breaking encryption.

The line got a big round of applause from the cybersecurity professionals in the room.

For the Department of Defense, “Data security — including encryption — is absolutely essential for us,” he said. “None of our stuff works unless it’s connected … So we’re four-square behind strong data security and strong encryption.”

To ensure that this fight doesn’t lead to problems between the private sector and the government, Carter suggested keeping the lines of communication open and trying to find a way forward in unison.

“It’s much better if we do it together. That’s the path we need to be on,” he said. “Let’s be collaborative, let’s be technical … and innovate our way” to a solution.

If that doesn’t happen, then the norms might be decided by another country that doesn’t have American ideals or our best intentions in mind, he added.

No matter where the debate goes, however, Carter said the Apple/FBI case shouldn’t dominate the entire discussion.

“Let’s recognize that [the encryption debate] is not one case, it’s many,” he said.

The question has an answer, and it provides a helpful metaphor to explain core cybersecurity concepts to executives and decision-makers who might not otherwise grasp the technological complexities, said John Elliott, head of information security at the Principality Building Society.

Speaking at the RSA Conference, Elliott said that modern firefighting strategy takes a holistic view of the kill chain, creating the ability contain a fire rather than having it blaze from one building to the next — much as effective cybersecurity contains a threat.

Elliott said the inspiration for the metaphor was a conversation with a manager who was complaining about the never-ending requests from the information security team to buy new technology that was seemingly unnecessary. When Elliott asked him why the building has fire extinguishers when there hadn’t been a fire in years, the manager got it.

In 1666, the city of London was only about a square mile in area. A fire started in a bakery in the pre-dawn hours, and burned down most of the city. Houses made of wood and straw burned quickly, and the narrow streets and closely packed houses enabled rapid spread.

Two hundred years later, much of Chicago burned down, despite having more stone buildings and a greater area. In that case, high winds, blew burning materials into flammable areas.

Today though, fire control begins with prevention; when prevention fails, detection systems alert responders to the fire so that response and recovery can happen fast.

“By using fire and people’s common knowledge of how fire works and spreads, it works really well as a metaphor,” he said.

See all of our RSA 2016 coverage here.