Yonatan Striem-Amit, Chief Technology Officer and Co-founder, Cybereason, provides insight into why cybersecurity is national security for all nations
After months of escalating cyber-attacks that have affected critical infrastructure providers, the food supply chain, and even disrupted distribution of COVID-19 vaccines and hospitals struggling to treat COVID patients, it is time to draw a line in the sand. One thing that is increasingly evident as the lines have blurred for cyber-attacks is that cybersecurity is national security for all nations.
CEOs from 24 leading tech companies, critical infrastructure providers, banks, insurers, and educational institutions recently met at The White House with President Biden and top advisors. After the meeting, the White House announced a number of bold initiatives.
For instance, The National Institute of Standards and Technology (NIST) will collaborate with private sector partners to develop a framework to improve security and integrity in the supply chain. They also formally expanded the Industrial Control Systems Cybersecurity Initiative beyond electric utilities to include natural gas pipelines.
Major tech companies agreed to chip-in with a variety of initiatives. Apple will improve supply chain security, Google will expand zero trust programs, Microsoft will accelerate efforts to integrate cybersecurity by design into systems and Amazon will make its internal security awareness training available to the public for free.
Education and training
One of the most reassuring facets of the meeting, though, was the emphasis on education and training. The heads of Code.org, Girls Who Code, and the University of Texas announced programs to teach basic cybersecurity to students, expand existing and develop new short-term credentials in cyber-related fields to help address the cybersecurity skills gap and make scholarships and career opportunities more accessible and available to underrepresented groups.
While all of that is very encouraging. The SolarWinds breach, followed by the HAFNIUM attacks against vulnerable Microsoft Exchange Servers, and the massive ransomware attacks against Colonial Pipeline and JBS Meat Packing have demonstrated that the public and private sector must work together to stop cyber threats. It is time to stop relying on antiquated technologies designed to protect against threats from 20 years ago, and time to invest in cutting edge prevention, detection and resilience solutions.
Nation-state cyber-attacks
We should also address escalating cyber espionage and nation-state cyber-attacks by introducing financial regulation of Bitcoin and other cryptocurrencies to fight ransomware and limit the ability to monetise cybercrime, as well as legislation to update the penalties associated with cybercrimes, work with our allies to update treaties for extraditing cybercriminals and foster global cooperation to fight back.
After the United States and European Union condemned China for the Microsoft Exchange Server attack, it was a wakeup call to other nation-state adversaries that in the future there will be a cost to cyber-attacks on global targets. More condemnations are needed along with the establishment of clear rules of engagement for offensive operations.
We face a constantly evolving and expanding landscape of threats, and increasingly sophisticated attacks that blur the lines between cyber-attacks and cyber espionage. It will take a collaborative effort between many nations, private and public sector vendors, and government agencies to exchange intelligence and knowledge to improve our ability to fight the rising tide of advanced cybercrime.
