Building a Defensible Cyberspace

Building a Defensible Cyberspace NEW YORK CYBER TASK FORCE Contents Forward 1 Members of the New York Cyber Task Force 3 Executive Summary 4 Introduction: The Upside and Downside Risks of Cyberspace 6 Factors that have Undermined Cyber Defense 8 Past Innovations to Make Cyberspace Defensible 10 Toward a More Defensible Cyberspace 12 Leverage: The Key to Success 13 From Essential to Albatross 14 The Lessons of Leverage 18 Curveballs 21 Future Innovations to Make Cyberspace Defensible 22 Future Research 28 Conclusion 29 End Notes 31 A more defensible cyberspace is possible, but only through leverage: innovations that give defenders the most advantage at the greatest scale at least cost. Building a Defensible Cyberspace: Report of the NY Cyber Task Force Foreword Providing satisfactory security controls in a computer system is in itself a system design problem. A combination of hardware, software, communications, physical, personnel, and administrative-procedural safeguards is required for comprehensive security. In particular, software safeguards are not sufficient. “ Security Controls for Computer Systems: Report of the Defense Science Board on Computer Systems” (aka, The Ware Report)1 For decades, cybersecurity professionals have been During the course of dozens of meetings over 2 years, treading water, putting in never-ending effort but we carefully examined ways to make cyberspace more rarely making progress. The quote above would not defensible, focusing on four core questions: seem obsolete if it appeared today on a slide in a ven- • Why hasn’t cyberspace been defensible? dor presentation or at a computer security confer- • What innovations in technology, operations, and ence, yet the report it was taken from was published in 1970. policy have made the biggest difference on the Nearly five decades have passed, yet the problems largest scale and at the least cost? remain the same. It is time for defenders to change their approach. • What common factors contributed to the success of these innovations? The New York Cyber Task Force was formed in the Fall of 2015 to try to break this stalemate. Our conclu- • Based on these past successes, what new innova- sion is that defense is possible, but only if we identify tions deserve attention and investment? and prioritize the right innovations. This report presents our consensus on ways to make In keeping with the recommendations of the Ware cyberspace more defensible without sacrificing what Report, the task force was compromised of ~30 experts makes it essential to our national economies and per- with varied backgrounds in cybersecurity, including sonal lives. We coalesced around a concept that can be many members from New York City, who contributed expressed in a single word: leverage. a distinct, practical, in the trenches perspective. As the The most successful innovations have been those that nation’s political capital, Washington, DC can sink into were leveraged, they operate on an internet-wide scale pessimism over cyber threats, the “new domain of war- and impose the highest costs (roughly measured in fare”; Silicon Valley, the global technological capital, both dollars and effort) on attackers with the least cost sometimes falls victim to its own unbounded optimism. to defenders. For New Yorkers, balancing threats with opportunities Leverage is not the same as increased cybersecurity is as natural as crossing the street. New York is one of return on investment, as understood by business exec- the global cities; participants want the best for Amer- utives; nor does it simply increase costs to attackers, ica but understand these interconnected and complex a strategy commonly employed by military and law problems require global solutions. Building a Defensible Cyberspace: Report of the NY Cyber Task Force | 1 enforcement. Rather, it facilitates broader thinking to as many other practitioners and academics who pro- maximize the impact of these and similar strategies, at vided valuable input. Our special thanks to Jason Internet scale, for the least cost to the defender. Healey, the author of this report, for playing a lead Some of our colleagues have given up on defense in role in conceptualizing and organizing this effort. favor of more counter-offensive attacks to disrupt the Not all members fully concurred with every finding in operations of our adversaries. Others place their faith this document, but a broad consensus emerged on the in some kind of cyber deterrence. Such tactics have goal of making cyberspace more defensible, the impor- a role when they provide leverage, but they are only tance of leveraging innovations to achieve that goal, part of the solution. At the core of our recommenda- and that “to do nothing” is not an option. tions are the many new innovations across technology, The views represented and attributed herein are those operations, and policy that will give defenders far more of the participants and do not represent the policies or advantages than we have today. opinions of the organizations to which they are cur- Many in the field have called for a “moonshot” or even rently, or were previously, affiliated. a “cyber Manhattan Project,” a massive surge of effort Many others helped us along this journey, including our to improve cybersecurity before it is too late. Perhaps colleagues at Harvard University’s Belfer Center for that is indeed needed, but it should not detract from Science and International Affairs, Stanford University’s the incredible progress that can be made with the Center for International Security and Cooperation, patient application of those innovations that provide McKinsey and Company, PricewaterhouseCoopers, the most leverage. Barclays, Baker McKenzie, participants of the Black Our task force includes leading cybersecurity executives, Hat and New York State Cyber Security Conferences, world-recognized technologists, former White House the Cyber Green Initiative, Spencer Francus of JP and government officials, and renowned academics. Morgan Chase for his assistance with graphic design, Some of our recommendations are directed at com- and several SIPA students, including Christian van de panies dependent on cyberspace. Others are aimed at Werken, Joyce Dong, Alex James, Claudia Shrivastava, policymakers, at technology executives developing the and Christine Taylor. next generation of standards and IT tools, or at aca- To these and others, we give our thanks and the demics and think-tank experts. We believe that together, reminder that defense is possible. We hope that our we can establish a more defensible cyberspace. conclusions in this report contribute to the ongoing We give our thanks as co-chairs to the members of essential dialogue regarding how we further enhance the task force, who gave their time and ideas, as well the security of cyberspace, the world depends on it. Merit E. Janow Gregory Rattray Phil Venables 2 | SIPA: School of International and Public Affairs Members of the New York Cyber Task Force Dmitri Alperovitch, CrowdStrike Marcus H Sachs, NERC Angela McKay, Microsoft Yurie Ito, Cyber Green Initiative Edward G Amoroso, TAG Cyber Karl Schimmeck, Morgan Stanley Jeff Moss, DEF CON and Black Hat Merit E Janow,† Columbia University Steven M Bellovin, Columbia University Adam Segal, Council on Foreign Relations Derek O’Halloran, World Economic Forum James Kaplan, McKinsey John W Carlson, FS-ISAC Timothy Strabbing, Viola Foundation Gary Owen, Time Warner Elena Kvochko, Barclays Gordon M Goldstein, Silver Lake Phil Venables,† Goldman Sachs Neal Pollard, PricewaterhouseCoopers Arthur M Langer, Columbia University Royal Hansen, American Express Matthew Waxman, Columbia University Gregory Rattray,† JPMorgan Chase David C Lashway, Baker McKenzie Jason Healey ,* Columbia University John Yetter, NASDAQ Katheryn E Rosen, Atlantic Council Aaron K Martin, JPMorgan Chase Melody Hildebrandt, 21st Century Fox Larry Zelvin, Citigroup * Task Force Executive Director † Task Force Co-Chairs Building a Defensible Cyberspace: Report of the NY Cyber Task Force | 3 Executive Summary In a little over 20 years, the percent of the global Our task force started by asking, “what technological, population with access to the Internet (and the larger operational, and policy innovations have had the great- cyberspace of connected devices and information, terms est impact in thwarting attackers?” We found that the this report will use interchangeably) has gone from less highest-impact innovations shared two key traits: than one to about 40, over 3.595 billion people.2 In • Defense advantage: Any innovation by defend- the United States alone, the Internet sector makes up ers must impose far greater costs on attackers. an estimated six percent of GDP; the “mobile internet A “dollar of defense” (or hour or other measure and app services” subsector alone has a “contribution of input) should yield not merely a “dollar of to the US GDP [of] approximately 3.11%, putting attack,” but should force attackers to spend con- it at approximately the same size as the Automotive siderably more to defeat it. industry.”3 Yet, as the reach and benefits of the Inter- net have increased, so too have the economic costs. • Hyperscale: The innovation must easily, even A 2015 study indicated that cybersecurity costs were automatically, work across enterprises or cyber- likely to rise above $1.2 trillion by 2030 costing a total space as a whole. of roughly $20 trillion over those 15 years.4 The task force members and the colleagues we inter- The costs are high because

Load more