Challenges of Cyber Security and a Fundamental Way to Address Cyber Security

Abstract

There is almost never a day that the topic of cyber security is not on the front page of a leading newspaper or a prominent website. It seems to be a constant game of cat and mouse between the hacker community and the security community in terms of providing the protection for information, user data (corporate, financial, etc.) and user privacy to the point that the security community cannot provide hot patches and fixes fast enough. Adding to this is the undisputed evidential linking of many hacking incidents and capabilities to sponsorship from powerful and capable states that can provide almost unlimited attack avenues. In the past, security controls and protocols for the Internet, communication, and systems are all practically built as an after thought and the need to have the system working and demonstrated trumps the need to make sure the system works in a secure manner. Functions over security, as many have seen and employed in the past simply does not work and it is the number one cause for many of the cyber security attacks that are on the front page today. Obvious, this model has not worked very well in the industry because we continue to see cyber security threat as the number one threat in many literatures and surveys. While recognizing this is a fundamental problem that we are facing for many years, why is it that this continues to be the number one issue, year after year? What is preventing the problems to be dealt with head-on? 190There are countless of security professionals, organizations, and governmental agencies that are committed to deal with this and yet the problem persists. What is working and what is not?