How to Build National Cybersecurity: 4 Imperatives

U.S. national and economic security depends on secure, trusted, and resilient technology. But digital threats keep disrupting critical systems in government and industry. The U.S. is straining to counter the threats despite spending billions of dollars on the problem year after year. And in the next two decades, officials expect cyber threats to civilian and military infrastructure multiply and cyber conflict grow more consequential as the digital and physical worlds merge. 

The U.S. must take unprecedented action: It must design and activate a whole-of-nation cyber strategy and a supporting cybersecurity system. Seizing this opportunity will require a broader scope of effort, integration of cyber defense and offense to provide a credible deterrence policy, greater day-to-day collaboration between the public and private sectors in critical cyber domains, and the mobilization of the cyber technology and innovation base.   

To be sure, the Biden administration is directing major advancements and committing significant resources to improve the cybersecurity and resilience of federal systems and critical infrastructure, much of which is privately owned and operated. U.S. officials are calling for whole-of-nation cyber plans. Such efforts can help deter cyber threats by denying hackers their objectives.  

To effectively get ahead of the threats, however, the nation must do 4 things:  

1. Broaden the Scope of Cybersecurity

The U.S. needs full-spectrum capabilities to both project power and defend against cyber espionage, sabotage, and influence operations emanating from a multitude of nation-states and criminal groups. This means developing policies, plans, programs, and activities for a whole-of-nation effort focused on full-spectrum cyber activities and actors.  

2. Leverage Offense and Defense

The U.S. must better integrate and synchronize the way it conducts cyber offense and defense with a refreshed national strategy, related policies, whole-of-government operating models, doctrine that goes beyond military minutiae, and greater clarity and deconfliction around roles and responsibilities. 

What would success look like? For starters, defenders must capture the tactics, techniques, and procedures used by attackers and feed them to the National Security Agency and U.S. Cyber Command to support defense-led offensive operations. As the Pentagon’s policy chief told Congress earlier this year, the U.S. must deter cyber adversaries through punishment—by retaliating in cyberspace and other domains against those who attack the nation. Otherwise, cyber defense costs will become untenable. But that’s not all.  

The U.S. should broaden the military’s “defend forward” concept to include “using all of the instruments of national power” as the U.S. Cyberspace Solarium Commission urged. 

What’s more, the government must find ways to capture insights from offensive cyber operations, anonymize them, and share them with defenders to accelerate defensive improvements. This is vital for making U.S. critical infrastructure resilient enough to withstand cyber attacks and sustain operations. And building greater resilience is essential if the U.S. expects to deter cyber threats without conflict escalating out of control. The nation needs to do this at “net speed.”  

3. Reimagine Public-Private Cooperation

The public and private sectors must improve cyber threat information sharing so that businesses gain access to actionable threat intelligence. Cybersecurity and Infrastructure Security Agency (CISA) Director Jen Easterly rightly calls information sharing the agency’s “superpower”—and it must be used to full advantage. CISA’s new Joint Cyber Defense Collaborative (JCDC) is a good first step to provide public and private partners greater shared awareness and analysis. Ultimately, what is needed is more face-to-face, side-by-side collaboration between government and industry professionals in a new national cybersecurity center.  

Through collaboration, the U.S. must advance its understanding of threats, develop countermeasures, take down malicious infrastructure, and intensify preparation, prevention, and recovery efforts. And when the nation overcomes digital threats, it must find ways to pass those methods to defenders. Armed with more actionable intelligence, organizations must ramp up proactive threat hunting to root out hackers hiding in their internal networks. 

As U.S. National Cyber Director Chris Inglis has said, the private sector and government must work in an integrated, collaborative way to counter cyber threats. This should include not only broader real-time information sharing but also more federal resources to help critical infrastructure companies resist threats from nation-state adversaries. Also, when developing cyber strategies and operations, U.S. officials must be mindful of the potential effects on the private sector.  

Business leaders, in turn, should embrace the shared responsibility of building greater cyber resilience, as well as the opportunity for leading resilient companies to achieve improved economic performance over the long term. 

The U.S. needs more collaboration on cybersecurity standards to make it easier for companies to focus on cyber defense mitigation rather than compliance. Also, stakeholders need more publicly available blueprints, off-the-shelf tools, grants, and funding to shore up cyber defense, building on the work of the National Institute of Standards and Technology. And officials must streamline increasingly complex regulations to ease burdens on medium and small businesses so they can focus on risk reduction and mitigation. 

4. Build Novel Solutions

To create tomorrow’s cybersecurity solutions, the U.S. must harness the national cyber tech and innovation base. The government needs to cultivate the base—building on multibillion-dollar venture-capital spending—and it should consider doing so with allied partners. Imagine, for example, an international cyber innovation ecosystem that lets the “Five Eyes” (the U.S., United Kingdom, Australia, New Zealand, and Canada), NATO, and Israel share best-of-breed technology. What’s more, the U.S. needs to assess the vast number of cybersecurity tools and products and ferret out the real best-in-class innovations. What's needed isn't more tools, but rather more integrated and proven solutions.  

The Biden administration has prioritized protecting the U.S. cybersecurity innovation edge. And the Pentagon’s Defense Innovation Unit (DIU)—which has offices in Silicon Valley; Boston; Austin, Texas; and Washington, DC—collaborates with CISA on cybersecurity initiatives. But there is more work to do.   

At Booz Allen, we’re uniquely positioned to advance this fourfold vision for national cybersecurity. Our experience supporting U.S. government work in cyber defense and offense has given our cybersecurity practitioners a deep understanding of the adversarial mindset, tactics, techniques, and procedures used by nation-state threat actors. We know how to protect the missions of federal civilian, military, and intelligence organizations, as well as privately owned critical infrastructure businesses. And we’re investing in DarkLabs, an elite team of security researchers, penetration testers, reverse engineers, network analysts, and data scientists, dedicated to stopping cyber attacks before they occur. 

It’s time to transform the U.S. national cyber capabilities and expand the nation's global competitive advantage. Together, government and industry must take a stand against advanced adversaries.