Category: #IT/CYBER/TECHNOLOGY

Posted on

The Cybersecurity Canon: The Seventh Sense: Power, Fortune, and Survival in the Age of Networks

We modeled the Cybersecurity Canon after the Baseball or Rock & Roll Hall-of-Fame, except for cybersecurity books. We have more than 25 books on the initial candidate list, but we are soliciting help from the cybersecurity community to increase the number to be much more than that. Please write a review and nominate your favorite. 

The Cybersecurity Canon is a real thing for our community. We have designed it so that you can directly participate in the process. Please do so!

Book Review by Canon Committee Member, Dr. Mansur Hasib, CISSP, PMP, CPHIMS: The Seventh Sense: Power, Fortune, and Survival in the Age of Networks (2016) by Joshua Cooper Ramo, Little, Brown, and Company: New York.

Executive Summary

Our hyperconnected world, comprised of myriad networks – both machine and human – has brought us to the precipice of a fundamental revolution and redefinition of the human experience and our socio-political and military world order. This is what author Joshua Cooper Ramo wants us to grasp in the book The Seventh Sense: Power, Fortune, and Survival in the Age of Networks.

The Industrial Revolution was a similar event. The advent of the personal computer, which replaced the typewriter, and the subsequent era of enterprise networks were others. Then came the internet era. Now we exist in a mesh of networks, which feature both concentration and distribution, and remarkable levels of persistence and resilience. The old definitions and practices of information security and governance, cybersecurity, and business strategy, developed in the era of the past no longer work.

Failure of executives to grasp this pivotal change, and their concomitant failure to tailor organizational and business strategy to the new reality, is the primary cause of organizational malaise and the massive cybersecurity breaches we have experienced. The author calls for a new breed of digital-native executive leaders who will inherit the problems and need to develop lasting solutions for the future.

We have experienced such revolutions in the past. Each time a new world order was created, decision-making and practices of the old world order ceased to function. Organizations and leaders who practiced outdated thinking were quickly wiped out or reduced to irrelevance. Each new world order also realigned the centers of power.

British imperial power and the subjugation of wide swaths of the world were fueled by superior technology, naval power, and education. Then, when the rest of the world began to innovate for a new era, there was a fundamental realignment of power. Today terrorism, war, cybersecurity, privacy of data, and even human relationships are being redefined by the network.

As the author states, “…networking something fundamentally changes its function.” Executives need to recognize that – yet they are not doing so because they lack the appreciation and understanding of the new networked world order and are still making decisions using models of the past, and both making decisions and developing strategy with the thinking of a bygone era.

Review

I have noticed political and business executives making seriously flawed decisions using models of the past. I have observed them being completely baffled by the hyperconnected new world. The book The Seventh Sense: Power, Fortune, and Survival in the Age of Networks (2016) by Joshua Cooper Ramo helped me understand why. The author helps us understand why we critically need cybersecurity leadership and digital strategy of a new kind.

The book has three parts, which I have broken down for you herein.

Part One explains the nature of the current age. This section explains why hyperconnectivity and the networking of everything, including human relationships, through networks and digital connections needs to be viewed differently. This is similar to recognizing that the world of analog systems and analog networks is gone. Analog thinking is anachronous in a digital world. Similarly, failure to recognize the new hyperconnected era, and failing to adapt to the exigencies of this new world order, can result in existential threats to leaders, organizations, and nations.

Part Two discusses what the author calls “The Seventh Sense,” which is a new way to view everything. Connectivity, as the author states, changes the very nature of everything. Thus, a networked heart monitor or pacemaker cannot be regarded as just a heart monitor or a pacemaker anymore. Similarly, terrorism, crime, pornography, bullying, forensics, and warfare conducted through the digital signals of a global network cannot be dealt with using the knowledge and models of the past. Executives need to think differently.

Humans have developed an intuition for dealing with events and circumstances of the past; some have called this the sixth sense. The author calls upon everyone – especially executives in charge of making consequential decisions – to develop a seventh sense to make strategic decisions relevant for a digitally hyperconnected new world. Business organizations, countries, and societies that fail to adapt to this new world are in real danger of becoming irrelevant.

There are numerous examples of previously powerful business organizations, nations, and societies that dominated in an older world order, but were rendered irrelevant and powerless in a new world – simply because they failed to anticipate, recognize, and adapt as the world around them changed. The author shares examples of such companies as Google and Uber that not only anticipated, embraced, and shaped the new world but were able to find gaps and unfulfilled opportunities, which allowed them to redefine the new world order in a way that benefited them. In doing so, they also became existential threats to organizations that were still living in the old world order.

The author shares how strategic leaders like Steve Jobs were able to imagine the future of smartphones, music consumption, and even movie production in a hyperconnected digital world, while many other contemporary leaders were still dabbling in an analog world. Leaders need to be able to recognize when the playing field has changed. Leaders cannot afford to play chess on a two-dimensional board when the board itself has morphed into multiple dimensions.

They cannot denigrate the new dimensions either – but must embrace them. I still remember the time in the late 1980s and early 1990s when we were building email systems and enterprise networks to replace the mainframes; people in the mainframe world called these systems a passing fad. Today, these very email systems and enterprise networks have become obsolete as new forms of human communications and hyperconnected business networks have become the new normal.

Yet, many enterprise technology organizations and executives have not adapted to the new world and are still focused on perimeter security in a world where there is no perimeter. They wish to control endpoints in a world where these endpoints do not belong to them. These executives are still discussing and demanding security as a static desired state when there is no such thing as absolute security anymore.

Cybersecurity is certainly not synonymous with security. Rather cybersecurity is a process of dynamic, continuous innovation and dynamic, continuous risk management – full of opportunities as well as pitfalls.

Part Three discusses how the power structure is being redefined in this new world. The author details several historical shifts in global power. Control of rivers, water supplies, and other land-based routes determined power during an era. At some point, it was replaced by control of the global waterways. Global naval superiority determined the British dominance of the globe. This was replaced by the rise of American global power through an unprecedented rate of innovation, which led to global domination in air power, military might, and economic strength. Sheer technological and financial superiority powered by an unprecedented pace of innovation unleashed by capitalism replaced all other forms of power.

Today, global power centers are in the process of realignment. A lot of power now resides in knowledge and information, as well as the control and sharing of such knowledge and information. Power will also be determined by the ability to understand and control the protocols and networks used for transmission. In a hyperconnected world, especially with unimaginable amounts of information being fed into the network, false information with rapid dissemination mechanisms can have dramatic consequences. Therefore, Facebook and Twitter have far more consequential relevance in this new world than traditional communication media, such as newspapers and TV.

In such a world, personal and corporate brands, and messaging, can shape people’s beliefs about reality. Once an affiliation with a brand is established, that brand can shape reality through messaging disseminated rapidly using new forms of communications. Failure of leaders to appreciate and harness the power of new forms of communications and develop the strategies, rules, regulations, and even laws that cater to the modern era can have massive implications in determining the winners and losers in the new world order.

Conclusion

The need for executives to think differently and have a digital strategy is acute. Author Joshua Cooper Ramo provides an easy to understand explanation of the new world, along with an analysis of the major epochal shifts we have seen in the past several hundred years.

Personal computers and the network were invented in the United States. In the past, as nations fought for domination of the land, water, air, and space dimensions – since the cost barrier for domination of these dimensions were extremely steep – the economic might of the United States allowed it to quickly overwhelm other nations in these dimensions.

However, global hyperconnectivity has created a completely new dimension, and the cost barrier for entry into this dimension is very low. In addition, the United States has done very little to restrict global open access into its systems. Readily available, low-cost access to technology has democratized the power of communications, influence, and even warfare into the hands of individuals. Therefore, a small band of malicious actors can cause massive damage on a global scale. Most often, their acts are not even regarded as acts of war. While international treaties related to conventional or even nuclear and chemical weapons exist, such treaties related to cyberweapons are non-existent.

In the past, in order to influence political outcomes in foreign countries or expand global power, nations had to fight wars, conduct espionage, and even resort to assassinations. Now, such actions can take a different form. Character assassinations through negative ads (frequently with no basis in fact), and false stories as well as pictures and videos are just as effective as actual assassinations – sometimes more so.

Information war and cyberwarfare are also incredibly cheap. Since laws and international agreements in these new areas are non-existent, foreign nations can influence political outcomes in countries as powerful as the United States or France without even being accused of warfare or crime. They do not have to use bombs to blow up communication systems, roads, or bridges; they can target networks controlling information media, or the networks controlling the national critical infrastructure, and exact far more consequential damage without the expense, stigma, or loss of lives created by conventional warfare.

Large swaths of people and even politicians and governments do not even view such actions as acts of war. Clouded by the thinking of the past, they use mild terms, such as “meddling” or “interference.” Even the active participation of a political campaign to support or benefit from foreign acts of cyberwarfare is viewed mildly and accepted by many as “opposition research.” If the same actions had taken place in a different dimension, such as a land attack, a sea attack, or an air attack, the language used would have been completely different.

Information-based decision-making at both the personal and organizational level is no longer possible using decision-making models of the past. Most of these models are not capable of differentiating between true and fake information. Decisions based on fake information will be seriously flawed.

Whether we call it The Seventh Sense or a new industrial revolution, or a completely new epoch, the old world is gone – and will never return. Executives who recognize, embrace, adapt, and rapidly develop a strategy to address this new world will leap ahead in the future power structure of this new world order. Joshua Cooper Ramo’s book The Seventh Sense: Power, Fortune, and Survival in the Age of Networks is a Cybersecurity Canon nominee for providing us a succinct and convincing analysis of a new world order that we all must understand in order to survive and thrive in it.

[Palo Alto Networks Research Center]

Posted on

Increased Cyber Awareness Must Lead to Equivalent Action

Recent and widely publicized cyber attacks must be the impetus for a renewed and more concerted and coordinated global commitment to strengthen cyber security capabilities.

In May, the WannaCry ransomware attacks struck, underscoring the potentially disastrous consequences for health care facilities and their patients when medical records and medical devices are compromised. June brought yet another major attack in Petya, originally characterized as another widespread ransomware attack, but later revealed to draw upon a form of malware that does not steal data but, in fact, destroys it.

These types of attacks, and those that will follow, accentuate the increasing concerns about the continued escalation of the global cyber security crisis. It’s no longer just about stealing money and data, but one that’s now placing human lives at risk. While health care has been a primary target this time around, more threats loom on the potential for breaches or compromised access to industrial control systems that could result in penetration of critical infrastructure systems such as electric utilities, oil and gas facilities, or nuclear energy plants. This shines a spotlight on the need for a unified global response now.

Amidst the challenges of the current threat landscape, there are promising signs that an increasing number of enterprise leaders and boards of directors are making the defense of their organization against ransomware and other cyber threats a top priority. ISACA’s State of Cyber Security 2017 research showed the percentage of organizations with Chief Information Security Officers (CISOs) is up to 65 percent, a 15-point rise over the year before. And in a micro-poll of the ISACA professional community in the immediate aftermath of the Petya incident, half of respondents indicated they took action after WannaCry to bolster their defenses – in case something like Petya showed up.

Additionally, half of the post-Petya poll respondents indicated their organizations provide ransomware awareness training to their staff, and more than half of organizations are applying software patches within the first week that they are available. That’s a good start. Promoting cyber security awareness and adhering to basic cyber security fundamentals needs to be as common in the global digital economy as seatbelts are in cars. We have a long way to go to make this the reality.

While the past several months have created an aura of inevitability around major attacks, more than 4 in 5 respondents to our micro-poll indicate they expect ransomware attacks will be even more prevalent in the second half of 2017.We cannot accept this level of havoc as a ‘new normal.’ Putting in place a viable incident response plan is critical, but what’s worthy of further investment is protection before an attack happens. Every organization should proactively employ cyber security awareness for all staff, performance-based cyber security skills training, timely hardware and software updates, and the hiring of the most highly skilled staff to ensure preparedness for the next attack, ransomware or otherwise. Start with an assumption that your organization will be the next target of a cyber attack.

Governments need to exhibit bold leadership and do more, too. This includes a commitment from G20 nations to expand cyber security research and training, and standardize some of the measures that individual nations are putting in place. G20 nations also should consider providing cyber security resources and support to nations that are not equipped to invest in themselves, as the connectivity of the global digital economy means all of us are in this together. This can help amplify the reach of encouraging efforts that are unfolding at national levels, such as the UK’s National Cyber Security Strategy and the recent executive order on cyber security in the US. Expanding public-private cyber security partnerships, while leveraging the resources of industry associations and academia, also should be part of the solution.

As a global community, we remain vulnerable to the cyber threats that already are here today, as well as the ones that will surface tomorrow. We cannot fall victim to cyber attack ‘fatigue’; attacks like the WannaCrys and Petyas cannot become “business as usual.” Cyber security is everybody’s business. Cyber security is more than pickpocketing; it’s a matter of public safety. Awareness must translate into resolve, not resignation. Only then will we make even greater leaps toward a more safe and secure future.

Editor’s note: This blog post by ISACA CEO Matt Loeb originally appeared in CSO.

Matt Loeb, CGEIT, CAE, FASAE, Chief Executive Officer, ISACA

[ISACA Now Blog]

Posted on

Security Headlines: Hacking ATMs, HBO and more


ATMs, HBO, democracy … what can’t be hacked? Here are the top security headlines for the week of July 31, 2017:

[(ISC)² Blog]

Posted on

Five Questions With Jigsaw CEO and CSX North America Keynoter Jared Cohen

Editor’s note: Jared Cohen, CEO of Jigsaw (the successor of Google Ideas), will deliver the opening keynote address at CSX North America 2017, which will take place 2-4 October in Washington D.C. Cohen, co-author of the New York Times best-selling book “The New Digital Age,” recently visited with ISACA Now about the cyber security skills gap, advancements in machine learning and his extensive world travels. The following is an edited transcript:

ISACA Now: How did Jigsaw come to be?
I was hired to Google in 2010 to build out a new division of the company called Google Ideas. I had gotten to know the CEO while I was still advising Hillary Clinton and we took a trip to Iraq together. It was a transformative trip because we both realized that the vast majority of future Internet users still had not yet come online, and companies like Google needed to be better prepared for that ubiquitous moment. I ran it as a think tank for many years and then a product organization. When the company restructured to become Alphabet, Jigsaw became the letter “J” in the Alphabet suite of companies. We are an engineering organization working on the cutting edge of AI, cyber security, and tackling some of the toughest global challenges with technology.

ISACA Now: What type of reaction have you received to The New Digital Age?
The New Digital Age captures the last mile of an access revolution that has been playing out for the past decade and a half. It is a book about the advent of technology and how it will impact war, terrorism, interactions between states, and so many other geopolitical trends. So much of what we wrote about and predicted in that book has happened faster than expected. So, I suppose the most common reaction I get from people is whether or not I’m surprised that the predictions came true as quickly as they did. I am.

ISACA Now: Which emerging technologies do you foresee being most impactful in the next 3-5 years?
This is a clear answer. The advancements in machine learning are going to be the most important innovation that defines the next decade. We are entering a ubiquitous moment where technology is everywhere and we are all mass producing data at record speed and volume. The combination of data and even bigger data, coupled with the ability to process that data through multiple machines and build deep neural nets, means that we will be able to build machine learning models to tackle challenges never before possible. Eventually we will reach something called inventive AI, where we train a machine on a particular type of data that enables it to tackle a broader set of challenges. This will have a profound impact on everything from security to health.

ISACA Now: The cyber security skills gap is well-documented. What are your thoughts on the best ways to influence more young people to pursue careers in cyber security?
Young people are ambitious and often want to work on the next zeitgeist. It doesn’t get more of the next zeitgeist than cyber security. It is a barren field that is ripe for innovation. It is also a field that bridges the technical and non-technical disciplines. It’s a skill set that will be desired by every sector, discipline and company. If every country in the future is also a technology company, then it is only as good as its security.

ISACA Now: You’ve traveled to more than 110 countries in your role advising two US Secretaries of State. How has all that travel influenced your view of the transformative potential of technology, from a global perspective?
I’ve seen first-hand how technology is transforming every society around the world, from the most connected to literally the least connected. What I’ve also learned is that the physical world shapes the digital world and vice versa. Every technology we build today has global implications. It expands the digital topography that complements the physical world we know. If all people are splitting their time between both worlds, it also means that the challenges of the physical world are spilling over online. In order to build technology responsibly and in a way that will have impact, we need to make sure we don’t lose the human intelligence side of things. For me, this means showing up places and asking questions, meeting people, and going to countries and places I haven’t visited.

[ISACA Now Blog]

Posted on

Is the Cloud Moving Too Fast for Security?

In February 2017, a vulnerability in Slack was discovered which had the potential to expose the data of the company’s reported four million daily active users. Another breach in February on CloudFlare, a content delivery network, leaked sensitive customer data stored by millions of websites powered by the company. On March 7, the Wikileaks CIA Vault 7 exposed 8,761 documents on alleged agency hacking operations. On June 19, Deep Root Analytics, a conservative data firm, misconfigured an Amazon S3 Server that housed information on 198 million U.S. voters. On July 12, Verizon had the same issue and announced a misconfigured Amazon S3 data repository at a third-party vendor that exposed the data of more than 14 million U.S. customers.

That’s at least five-major cloud application and infrastructure data breach incidents for 2017, and we’re only in July. Add in the number of ransomeware and other attacks during the first half of this year and it’s clear the cloud has a real security problem.

By now, most everyone recognizes the benefits of the cloud; bringing new applications and infrastructure online quickly and scaling it to meet ever changing business demands. Although highly valuable for the business side, when security teams lose control over how and where new services are implemented, the network is at risk and subsequently, so is their data. The balance of allowing businesses to move at the speed of the cloud and maintain the needed security controls is becoming increasingly difficult. With the spike in data exposures and breaches, it shows that security teams are struggling to secure cloud use.

The Slack breach is a great example at the application-level. Slack is simple to use and implement, which has driven the application’s record-breaking growth. Departments, teams, and small groups can easily spin up Slack without IT approval or support, and instances of the application can spread quickly across an organization. Although Slack patched the vulnerability identified in February before any known exposure occurred, if it were hacked, the attacker could have had full access and control over four million user accounts.

In the Verizon situation, a lack of control at the infrastructure level is what caused so many of their customers to be exposed this month. When servers can be brought online so easily and configured remotely by third-party partners, the right security protocols can be missed or ignored.

As more businesses move to the cloud and as cloud services continue to grow, organizations must establish a unified set of cloud security and governance controls for business-critical SaaS applications and IaaS resources. In most cases, cloud providers will have stronger security than any individual company can maintain and manage on-premise. However, each new service comes with it’s own security capabilities, which can increase risks because of feature gaps or human error during configuration. Adding additional encryption and policy controls independently of the vendor, is a proven way for organizations to fully entrust their data to a cloud provider without giving up complete control over who can access it while also making sure employees are compliant when using SaaS applications. These controls allow businesses to move at the speed of the cloud without placing their data at risk.

The reality is that threats are increasing in frequency and severity. The people behind attacks are far more sophisticated and their intentions far more sinister. We, as individuals and businesses, entrust a mind-boggling amount of data to the cloud but there doesn’t exist today a way to entirely prevent hackers from getting through the door at the service, infrastructure or software provider. Remaining in control of your data that traverses all the cloud services that you use is the safest thing you can do to protect your business. Because, in the end, if they can’t read it or use it, is data really data?

Doug Lane, Vice President/Product Marketing, Vaultive

[Cloud Security Alliance Blog]

English
English
Exit mobile version