Hacking power grids; hacking elections; hacking ATMs and the financial system; hacking the key cards for hotel rooms: The cybersecurity problem is vast and daunting.\n<\/p>\n\n\n\n
“The scope of the critical infrastructure cybersecurity problem is so big that we’re mostly paralyzed as a nation on how to solve that problem,” said Phil Quade, former director of the NSA’s Cyber Task Force and newly named CISO at Fortinet, during a talk at the 2017 RSA Conference in San Francisco. “What we need is a new way to approach that.”\n<\/p>\n\n\n\n
Rather than allow the breadth of the problem to overwhelm, Quade suggested a coordinated approach that breaks the challenge into less-daunting pieces.\n<\/p>\n\n\n\n
“It’s about deconstructing a very, very large problem into manageable parts,” he said.\n<\/p>\n\n\n\n
He outlined such an approach using four broad categories modeled after the moonshot in the 1960s \u2013 a comparable challenge that ended with the U.S. landing men on the moon.\n<\/p>\n\n\n\n
The first step is to establish the ultimate goal of such an endeavor, Quade said. He framed suggested goals in five categories:\n<\/p>\n\n\n\n
“Our goal is to \u2026 sustain economic competitiveness<\/strong> \u2013 our companies that we all earn money from or are otherwise dependent on, their viability depends on available, secure and reasonably-priced infrastructure. Our national security<\/strong> depends on secure and available infrastructure \u2026 Privacy and civil liberties<\/strong> \u2013 a fundamental value of the U.S. \u2013 depends on secure and trustworthy infrastructure. Public safety<\/strong>, often a euphemism for law enforcement and Homeland Security, guess what it depends on: Secure and available infrastructure; as does our pursuit of happiness<\/strong>,” he explained.\n<\/p>\n\n\n\n The next step, according to Quade, is to set the horizon: View the full scope of the problem and set a window \u2013 say, 10 years, as in the case of the moonshot \u2013 in which to achieve it.\n<\/p>\n\n\n\n “There’re lots of challenges ahead of us,” he said. “Some of them are mountains, some of them are valleys, some of them are forests. There’s a lot to traverse.”\n<\/p>\n\n\n\n Looking out into such a horizon is often when the immensity of the task sets in. But, just as a journey of a thousand miles begins with a single step, Quade believes he knows where to start.\n<\/p>\n\n\n\n In Quade’s assessment, there are three steps that can be taken now, and it all starts with sharing information.\n<\/p>\n\n\n\n “It’s big enough to be meaningful but not so big we’re trying to boil the ocean,” he said.\n<\/p>\n\n\n\n There are many initatives currently underway with regard to information sharing, including DHS’s automated information sharing program, sector-specific Information Sharing and Analysis Centers (ISACs) and among cybersecurity companies and researchers.\n<\/p>\n\n\n\n The second step is consequence-based engineering. Rather than working to predict every vulnerability and patch every hole, those developing critical systems should work to “engineer out bad consequences,” as Quade put it. If adverse effects are impossible, there’s nothing for a bad actor to target.\n<\/p>\n\n\n\n Quade’s final first step is boosting the cyber workforce.\n<\/p>\n\n\n\n The federal government \u2013 in which Quade worked for some 33 years \u2013 has gotten very good at encouraging the early stages of workforce development, incentivizing colleges and universities to start and expand cybersecurity programs and promoting STEM early in young students’ education. But the focus on later stages \u2013 the journeyman and master levels \u2013 has been lax, with fewer resources put into career-long training.\n<\/p>\n\n\n\n “What are we doing as a nation to, at scale, move people from the apprentice to the journeyman and what are we going to do move the journeymen to the masters?” Quade said. “And do this in a sustainable way so we have a constant influx of people from bottom to top?”\n<\/p>\n\n\n\n After the first steps comes the long journey.\n<\/p>\n\n\n\n “I don’t know what those 1,000 steps are that it’s going to take to get to a secure and resilient critical infrastructure state,” Quade said. That will be a group effort among stakeholders, he added, like the ones present at RSA and working in the trenches in the public and private sectors.\n<\/p>\n\n\n\n “What I’m proposing here is that people self-organize to commit to taking the thousand-mile journey \u2026 but in the meantime let’s break this down.”\n<\/p>\n\n\n\n Quade expressed optimism in the nation’s ability to meet this challenge, referencing the moonshot once more.\n<\/p>\n\n\n\n “We rocked it, as a country,” he said, an example that we “can do heroic things. I think that same analogy applies to securing critical infrastructure.”<\/p>\n","protected":false},"excerpt":{"rendered":" Former Director of the NSA’s Cyber Task Force Phil Quade wants us all to undertake a heroic mission: Fully securing the nation’s infrastructure from cyberattack.<\/p>\n","protected":false},"author":7,"featured_media":80886,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":10,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[3574],"tags":[],"coauthors":[2349],"class_list":["post-28585","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber"],"acf":{"subheadline":"","legacy_arc_id":"NPIF4VQY5NHP3NJBAYAETDIODI","arc_canonical_url":"\/home\/2017\/02\/15\/starting-the-1000-mile-journey-to-cyber-secure-infrastructure\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\nHorizon<\/h2>\n\n\n\n
The First Steps<\/h2>\n\n\n\n
All the Steps<\/h2>\n\n\n\n