Security isn’t what it used to be, especially in the area of computing. It has become far more ephemeral, less obvious and much more important. To keep pace with the evolving threat landscape, we all need to reset our expectations about what cybersecurity actually is in today’s world and look carefully at what it might become.

Early Computing

In the earliest days of computing, physical security was the name of the game. The door to the mainframe room had a lock on it, and if you couldn’t get in, you didn’t have access to what the computer produced. Computers did their work in disconnected silos, communicating to their human supplicants only through paper coming out of their printers.

In the mid-1970s, users could talk to their computer with a 3270-style video terminal that absorbed information typed on a keyboard, and perhaps the computer responded in some cryptic way. The paradigm was based on physical access, and networks were constrained and local in scope.

The Network Phase

When networks were added to computing, the prevalent physical model was carried along with it. This way of thinking had served well in the past and seemed intuitive. The network itself was not designed securely; at the time, it was often thought that if an attacker didn’t get access to the wire itself, all would be well. Simple, physical threat models made for simple networks.

Interconnected systems became the standard after that, leading to the introduction of networks that learned to talk only to trusted partners. Of course, establishing such trust was a new field. Cryptography-based security grew rapidly. The community considered the mathematical effort required to decode such encryption sufficient to assure the integrity of information.

Insecure Sharing

Still, the underlying software that ran the linked commercial computers did not advance in secure ways. Developers designed methods to share information in this brave new networked world, which had flaws that were not immediately apparent. Even when they became glaringly obvious, efforts to patch them across all affected systems were unsuccessful.

The operating systems used for commercial microcomputers were also constructed insecurely. For example, a major commercial software-maker used the strcpy function in C to handle external data movement. The function performed no inherent limit or bound checking, and data that passed by it could easily lead to heap corruption during execution.

Second-Order Effects

Over time, computing moved from linear threat models, in which relationships could be directly and simply expressed, to models that involved more quadratic associations. Activity in one part of a system could have unintended yet serious effects in another area. Furthermore, the deleterious impact of any systemic change might not be directly demonstrable.

Today, we have computer systems that cannot be reasonably well-secured, mostly due to the inherent complexity of their interoperation. These systems perform tasks involving the resultant efforts of other, uncontrolled actors that may be functionally insecure and use data sources that cannot be verified. Even when those sources have been secured, the system itself may exhibit insecure behaviors.

There are new forms of insecurity as well. Someone still using the physical threat model as a guide might worry about someone listening to his or her phone calls. But a threat actor could use metadata derived from such a call to come up with actionable information. In these cases, a pattern may be as important as the specifics.

There is no truly objective way to measure security, because it always comes back to how humans interact. It is, at its core, a sociological rather than a science problem.

Society Depends on Computing

The information that a computer system handles is crucial to society’s function. If computers were to melt down today, so would civilization. To start, all trade would stop — that’s how deeply technology has been embedded in society. There would be no banking, retail, movement of food or law enforcement. We would be living in “Mad Max,” basically.

Still, total meltdown is not the goal of most threat actors. They want systems to continue functioning so they can hijack them for their own purposes using stolen information.

Cybersecurity Is Your Responsibility

Cybersecurity needs to be understood as a direct personal responsibility. Today, devices are interconnected and threat actors are more dangerous and subtle than ever before. Money can be stolen from you by someone on the other side of the world, not just by someone down the street. Similarly, an organization’s data can be manipulated by both competitors and state-based actors.

This issue is too serious to be handed off to some faceless committee. The closer you are to a situation, the more you know about it, and the more effectively you can keep it stable and secured.

There are always further actions you can take to improve your security posture. However, they must be comprehensive and wide-ranging to address the wide scope of threats. Security products can help, but they are not one-size-fits-all solutions. For example, all the end-to-end encryption in the world cannot stop an insider from stealing information. The complexity of today’s technology landscape requires a holistic set of integrated solutions to complete the security picture.