Now, the Corona epidemic presents an opportunity for the medical world to learn something from the cyber world.
Cybersecurity is built in layers and there is no one magic solution or layer which will prevent all possible attacks. Furthermore, in the cyber world, it has been realised that it is impossible to protect everything for all eternity. There will be victims. Computers will be attacked, information will be stolen, and activity will be interrupted. It has already been accepted in the business world that it is not possible to maintain an extremely high level of protection, while at the same time enabling a business to run at its required pace.
A compromise must always be found, and risks managed. Extremely high levels of security are possible, but this will give rise to a situation where work may grind to a halt. Businesses accept that by running freely, they expose themselves to various levels of cyber threats.
The challenge, which has become the main responsibility of information security managers, is to learn how to live with these day-to-day compromises. To understand the risks they take, determine what level of risk they can accept, and what level of risk is too great.
Just as businesses weigh various protection approaches, we can see several strategies for protection against Coronavirus being implemented by various countries. In Asia, South Korea, and Taiwan, relatively advanced approaches have been adopted in detecting the threat, finding where it is harboured, and dealing with it surgically wherever identified. All this is in conjunction with a basic layer of disinfecting large areas.
As in the cyber world, this can be seen in the use of advanced concepts of threat hunting and extensive investment in detection and incident responses. All this is above and beyond the basic layer of a standard firewall and endpoint protection in order to provide some basic level of protection throughout the whole organization. This approach is a reflection of an understanding that the “point of contact” to the world will be breached, or in the professional slang, “the perimeter is dead”. It is not possible to achieve full protection and keep the threat outside the perimeter forever. The threat must be sought out on a targeted basis and dealt with wherever identified without giving up on a basic layer of protection, which will succeed anyway in preventing the simpler threats from penetrating.
Traditional approaches
Aside from these countries, most countries in the world, including Israel, Italy, and the USA have adopted approaches that are considered more traditional, according to the cyber world. Israel began with an approach that derives from the belief that there is indeed a “perimeter” and that the threat can be blocked externally and prevented from getting inside - this approach is now widely thought to be inherently irrelevant.
Subsequently, Israel, like Italy and the USA, transitioned to taking a more aggressive policy. In the cyber world, such an approach equates to a policy of a strong lock-down of the network, preventing the transmission of information between points in the network.
This makes any approach to the resources of the network difficult and attempts to reduce traffic on the network. Such an approach can indeed succeed in producing achievements in terms of preventing breaches of the network and the endpoints, but it also has the effect of preventing most of the activity on the network and, consequently, having an adverse effect on the organisation’s business activity.
Such an approach to protection was previously beneficial at sensitive locations such as Defense Establishment Institutions, but over the years, they have also understood that it is impossible to operate over time with such difficulties piling up over the activity of the organisation.
Throughout the industry, it is now difficult to find organisations that still stick with the approach of a robust and aggressive cyber policy. In the last decade, we have witnessed a shift towards more considered risk management, which attempts to strike a balance between the need to facilitate activity and the desire for protection.
Initially, Britain attempted to adopt its own unique approach and attempted to rely upon the immunity of all its citizens. In cyber terms, it was as if they are content with the installation of anti-virus software at all the endpoints. This approach has not been relevant in the cyber world for approximately 20 years, and no organisations would look to use it as their approach for protection, with the possible exception of very small businesses.
Threat intelligence
It is possible to analyse the operational approaches of the countries from another angle in the cyber world, and that is “threat intelligence”. On one side of the spectrum is the USA, which appears to have approached this situation with a profound lack of information, to the point of ignorance in the face of the threat. On the other hand, Israel has learned as much as it could about the threat and has attempted to prepare for it ahead of time.
Today in the cyber world, there is a growing acknowledgment of how difficult it is to build a layer of protection against cyber threats without engaging in the acquisition of advanced information related to threats and their nature. Currently, leading organizations are widely reliant upon information when addressing cyber threats.
Another analogy to the cyber world can be analysed from the public reactions in various countries. Apparently, in Singapore, Taiwan, South Korea, and perhaps other places, the public has strictly complied with governmental directives, understanding the risk and responding well to the threat. On the other end of the spectrum is Italy, which reacted complacently, did not heed governmental instructions, and didn’t understand the size of the threat to begin with.
Thus, in cyber, the sphere of awareness and training which has been gathering momentum in recent years tries to get the personnel of the organisation to appreciate the threat and educate them on proper procedures in the presence of a threat. This is regarded as maintaining “cyber hygiene,” which reminds employees not to open suspicious emails, how to report something suspicious to the organisation.
Organisations that have invested in educating people regarding awareness and correct actions have reported an improvement in the immunity of the organisation to cyber threats.
It appears that in the cyber world, more advanced organisations are adopting more innovative approaches, and the use of advanced tools such as threat hunting, detection, incident response, as well as employee awareness have produced better results in coping with cyber threats. Thus, in the physical world, countries that have adopted similar approaches appear to have succeeded, at least for now, in containing the virus’s threat in terms of a dramatic reduction in the number of cases of infection and are on the point of at least a partial return to routine. Countries viewed as maintaining more traditional approaches and attempting to sanctify the perimeter or apply tough, aggressive policies as their major effort, are finding it very difficult to contain the threat. These countries are still seeing a rise in cases, coupled with a widespread paralysis of economic activity.
If countries wish to learn lessons from the world of cyber protection in order to deal with the Coronavirus threat, then they must bear in mind that building defences must consist of several layers. No one method can avoid the threat.
Investment efforts must be put toward prevention. It is essential to create a basic level of control and monitoring of entrances, but the action is also necessary on the level of detection and treatment.
This can only be done properly by adequately gathering and analysing the latest data.
It is to be hoped that more and more countries will consider adopting more advanced protection approaches, finding ways of applying them in the physical world in order to accelerate the end of the threat and bring about a return to a normal routine.
Author details: Zohar Rozenberg is VP of Cyber Investments for Elron, investing in early-stage cybersecurity and Enterprise software start-ups.