Technology & Innovation

Government and cyber economics

November 08, 2016

Global

November 08, 2016

Global
Ryan Kalember

EVP of Cybersecurity Strategy

With more than 15 years of experience in the information security industry, Mr Kalember currently leads cybersecurity strategy for Proofpoint and is a sought-out expert for leadership and commentary on breaches and best practices. His global team of security experts and marketers ensures that Proofpoint’s customers have consistent insight into today’s advanced attacks and how to protect their people, data, and brands.

Under Mr Kalember’s leadership, Proofpoint has established a comprehensive GTM strategy conveying Proofpoint’s uniqueness in the market, enabling customers worldwide to clearly understand how Proofpoint technology helps them stop sophisticated attacks, embrace new communication platforms, and disrupt information loss—all delivered from the cloud.

Mr Kalember joined Proofpoint from WatchDox where he served as both chief product officer and chief marketing officer and was responsible for successfully building and leading the product and marketing teams through the company’s acquisition by BlackBerry. Prior to WatchDox, he was instrumental in running solutions across Hewlett-Packard’s portfolio of security products. He has also held a variety of leadership positions at ArcSight and VeriSign, working as a security practitioner across the US, EMEA, and Latin America.

Mr. Kalember is a member of the National Cyber Security Alliance board and Cybersecurity Technical Advisory Board. He has provided cybersecurity counsel to the National Governors Association and global government delegations including Jordan, North Macedonia, Peru, and Spain, and his expertise has been featured on ABCNews.com, Bloomberg, Bloomberg Radio, CNBC, Forbes, Fortune, NBC Nightly News, USA Today, and WIRED. He received his bachelor's degree from Stanford University, where he studied fault tolerance, cryptography, and authentication algorithms.

Governments are facing an ever increasing wave of cyber attacks but have typically been slow to respond.

The main reason is that systems are archaic, information workers are not educated about cyber risks and citizen data does not have the appropriate protection and access controls in place. This is all set to change. On November 1st, 2016, the UK government announced the creation of its new () along with plans to invest £1.9bn in a cybersecurity strategy that promises to bolster its defences. This follows Barak Obama’s request to Congress in February 2016 for an additional US$19 billion for the Cybersecurity National Action Plan.

The public sector is also waking up to the reality that significant concerted investments — in people, process and technology — must be made to fight cyber crime. Historically, when government investments were made in cybersecurity, initiatives were focused on identifying and protecting critical national infrastructure and updating legacy systems. Whilst network protection should form part of any security strategy, the UK government’s plan represents a much needed shift towards the protection of citizen data and national information.

The new norm

Cyber criminals often exploit the weakest link, people, more frequently than they exploit any system or technology to get access to critical data. The recent attacks on the Democratic National Committee (DNC) and Office of Personnel Management (OPM) in the US were the result of a simple phishing email as the original vector for exposure. Today’s threats have long evolved beyond credit card hacks. During the summer of 2016, an unprecedented amount of credential phishing attacks led to the exposure of sensitive email communications aimed at exploiting, embarrassing, and exposing their intended victims. It is clear that attackers have new value targets in their sights.

Protecting government workers and the information they have access to is critical. Before considering advanced detection and response capabilities such as attacker identification and attribution, governments must first focus on implementing the fundamentals of information security. Critical data assets must be identified and the highest standards of data encryption implemented. Only by protecting its data, and the credentials of those who have access to it, will governments reduce the rewards for cyber criminals, hence deterring them from targeting their organisations.

Making progress

The encouraging news is that plans are being laid out to do just that. An announcement by Phillip Hammond, the chancellor of the exchequer in the UK, unveiled a National Cyber Security Strategy that would focus on not only protecting critical infrastructure and updating legacy systems, but one that also ensures the protection of British citizens and governmental workers. Tactically, the government is focused on preventing criminals from spoofing its identity to trick its employees and citizens into divulging personal, sensitive and confidential information. A concrete example of that is the UK’s email authentication roadmap that aims to prevent the malicious use of gov.uk domains in phishing attacks. By reclaiming control of its domains, the government aims to "crack down on spoof email accounts used in fraud" and effectively make the UK harder to phish. The UK’s plan is a great stake in the ground and demonstrates a noticeable change to prior plans where ‘people’ controls were absent.

So what does this mean for the private sector? What are the implications of the new cybersecurity initiatives being rolled out by governments around the world?

Regulation and compliance to drive behaviour changes

Long negotiated regulations will make private sector organisations become more accountable for how customer data is handled. In particular, the European Commission’s General Data Protection Regulation (GDPR) provides genuine consequences for failing to safeguard personal information, and will drive changes in corporate behaviour. Even when they are breached, private organisations do not typically bear the full economic costs of their lax security, which is often spread amongst both cyber insurers and those whose personal data got compromised.

Whilst the private sector often prefers to regulate itself, examples from the US to Singapore demonstrate that meaningful fines are a highly effective strategy to compel better security, especially when paired with clear guidance on best practices, technologies, and staffing that companies are expected to adopt.

Customer protection moves to the forefront

Public sector organisations are making headway in protecting citizens from interacting with criminals pretending to be trusted government agencies. It is likely that an increased demand for private sector enterprises will follow suit. They will be required to prevent the misuse of their brands and ultimately protect their customers. This will ensure that people are shielded from cyber attacks targeted at them to steal credentials, data or money.

Threat intelligence sharing critical to execution

There will be an increased focus on threat intelligence sharing between private and public sector organisations. In its strategy, the UK outlined plans to create a central hub of cyber threat intelligence that combines data from national Computer Emergency Response Teams (CERT), email reputation data and Internet Service Providers.

It is possible to have private and government cooperation without compromise to customers or individuals. We will see greater demand for the private sector to share best practices and insights with the government in order to partner for a better national cybersecurity posture. In today’s world of advanced cyber threats, the public and private sector need to work together in a way that serves the public interest. This will bring much needed agility to pivot with the evolving threat landscape.

Ultimately, investments in national cyber security programs will disrupt the current cyber economics business model by making nations an unyielding target and increasing the costs and risks to the criminals.

 

The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week