Twenty-five years of fast evolving cyber communication had made us more efficient. But as Huston T. Hawkins, Los Alamos National Lab Senior Scientist says, “The greater the efficiency, the greater the vulnerability.” And cyber vulnerability is turning our world into a tinderbox. Every day, everywhere, hacking into the Internet puts our lives, finances, communications and security in grave danger. Twenty-five years of expanding Internet use generated a thriving cybersecurity industry, which despite its efforts has not succeeded in protecting vital assets. Best practices have not been followed by government or industry.
The huge cyber security industry today is organized to try to stop cyber intrusions, information theft, and crippling attacks on the critical infrastructure including our defense systems. The United States government has spent hundreds of billions since the 1980’s (before the Internet) to try to build defenses against cyber attacks. But most of what the spending and efforts of tens of thousands of experts who have worked hard, trying to protect our information systems have to show for is a staggering record of failure. If anything, Americans are less secure today than last year; and less secure last year then the year before. When it comes to protecting cyber systems, we are in an exponential failure mode. Why?
Here are a few reasons why cyber security fails:
1. Today’s systems are hugely complex and rapidly changing and adapting. Such complexity means that even with the best of intentions it is extremely difficult to cover all, or even most, of the potential vulnerabilities in operating systems, software, communications, and networks. Virtually every modern system has been hacked successfully and repeatedly.
2. Modern hardware and software evolve and as new features, capabilities and functions are added, the old features, capabilities, and functions are dragged along and remain built into the newest products. Thus, old weaknesses persist and remain lurking even while new vulnerabilities are added to the risk equation.