For Cyber Security, Think Holistically

Merging security and convenience is one of the keys to cyber security, expert says.

True cyber security cannot be achieved through a piecemeal approach – it must be tackled holistically, says Booz Allen Hamilton principal Andy Singer, who took part in a recent cyber security symposium at the University of Pennsylvania, in Philadelphia.

It is critical, says Singer, to focus on the “end-to-end” security of a network, rather than relying solely on piecemeal solutions such as firewalls and anti-virus software. And resilience must also be built in, so that when a cyber attack does get through network defenses, operations can be quickly restored, he says.

Singer outlined this big-picture approach during a panel discussion at the event, “Convergent National Security Risks to Government and Business: A Symposium.”

One key to cyber security, Singer told the symposium participants, is to “merge security and convenience” – that is, to make it easier for people to use secure systems. As an example, he cited special Department of Defense telephones that can encrypt conversations, but which require extra effort by users. A solution, he said, is technology that allows people to use the phone normally – but which still makes the call secure.

“We need instantaneous and secure communication, and we’re technology-smart enough to make that happen,” says Singer.

During the panel discussion, Singer also noted that it is common in government and business to blame computer users for security breaches. “They put the burden on the person – they say, ‘Well, it’s your fault, you opened the attachment on the email and brought the virus into the system.’ ”

A better approach, says Singer, is to build in more security in software and hardware. There’s a reluctance to do that because it can be more expensive. But, says Singer, “Some experts say you can build in more security without it costing too much more.”

Security is also not always a top priority because technology companies are often focused on rushing new products to market. “Whoever gets there first gets the buzz,” Singer notes. However, he says, we should encourage software and hardware companies to avoid the rush, so that more time can be spent on building in reasonable security.

The symposium was sponsored by Penn’s Institute for Strategic Threat Analysis and Response, and the school’s International Relations Program. The other participants on the panel were by Roger Cressey, Good Harbor Consulting president and NBC News analyst; Elad Yoran, Security Growth Partners CEO; Joseph McGrath, Unisys Corporation former CEO; and Joel Brenner, Office of the National Counterintelligence Executive, National Counterintelligence Executive and Mission Manager for Counterintelligence.

story posted May 5, 2009