Can New Technologies Restore a Robust Federal Cyber Perimeter?

Over the past week, I scheduled time to play with my new Dell gaming computer. I spec’ed out a monster rig for myself a couple of months ago with all the best components that can handle any video game for the foreseeable future. The problem is that I have been too busy to spend very much time with it. So last week I actually put “gaming time” into my schedule, and it was a pretty brilliant idea, or at least a fun one.

Looking at all the new games available on the Steam platform, I finally settled on one called “They Are Billions” by developer Numantian Games. It checked all the right boxes for me: It’s a real-time strategy title and involves a huge amount of zombies. People in the reviews section were complaining about the game bogging down their systems with too many units on the screen, but I figured that would be a fine test for my new system too.

Set on a post-apocalyptic planet, "They Are Billions" is a steampunk strategy game where you must build and defend colonies to survive against billions of zombies who want nothing better than to eat the few remaining humans still surviving in the world. If you play through enough missions, you can eventually recapture the world for the humans and end the undead scourge. I am a long way from that goal.

I have played a lot of real-time strategy games in the past, including anything World War II-related like the classic “Company of Heroes” series. So I am a fairly adept armchair general. “They Are Billions,” however, really challenged me. The game drops you into an almost unwinnable position with every mission, where the enemy has almost all of the advantages. In fact, it was a lot like trying to defend a network from cyber threats these days.

When you start a mission, you have to build a town in the middle of a huge map, including housing for your new settlers to live in, buildings to mine resources, and a military to defend yourself. Your resources—at least a first—are limited, while the enemy, as the name of the game suggests, is not similarly taxed. Threats can also come at you from almost any angle, and the game even spawns more zombies from off the map to come charging at you from time to time.

But the real challenge of “They Are Billions” is very much like the one facing cybersecurity professionals today: The enemy only has to win one time, while defenders have to win every time. In the game, this is evident because if a single zombie gets into your town, they can attack a house or a resource building and convert it, which means that the four or five people who live or work there become zombies too, and quickly branch out to infect more places, not unlike the horizontal movement of hackers once they infect a single endpoint. You can lose an entire city to a zombie infection in just a few minutes if you can’t get the cascading attack under control.

It’s this same situation that has led to a defeatist attitude in cybersecurity today. You have all heard the missive that “It’s not if you will be successfully breached, but when.” As such, many agencies are deemphasizing traditional notions like perimeter security and concentrating more on the concept of resiliency, recovery and ways to mitigate the effects of a breach.

It’s no wonder that people think that way. Like with my towns in the game, the threats leveled against government easily rank well into the billions. Nextgov reported the Pentagon alone was stopping 36 million email-based attacks every single day in 2018. That’s 13 billion attacks every year just at the Pentagon, and just with email as the threat vector. Of course, people are going to expect that something will get through. The numbers are just not on the good guys’ side.

The general thought process today in cybersecurity seems to be to throw something up to stop low-intensity threats at the perimeter, and then get ready to mitigate whatever gets through. And with current technology, that was about the best that people could hope for in this lopsided conflict. However, I am starting to see some interesting new technologies, especially in the areas of artificial intelligence and machine learning, that could restore the balance between attackers and defenders, and make perimeter security a powerful asset once more.

One of the other things I get to do is review emerging and enterprise level technology for CSO Magazine, kicking the tires of some of the most cutting-edge cybersecurity defenses. One of the most promising is training machines to think like a human, identifying threats and restoring a solid perimeter.

One of the first platforms that I found that did this was BluVector, which was able to maintain a stable perimeter even when besieged with some of the most advanced fileless malware. It was able to flag potential zero-day attacks by looking at factors like what the malicious code wanted to execute, the rarity of the host sending the file and other elements like a strange nomenclature that would have probably tipped off a human threat hunter had they been looking in the right place at the right time.

Some of the newest platforms I’ve recently tested will have their reviews run over the next few weeks. One of those is Blue Hexagon, an advanced defense that uses machine learning and a tightly focused intelligence to find new and even polymorphed threats that defy easy categorization. From its position just behind the network gateway, it was able to spot camouflaged and highly obfuscated threats, even when heavily encrypted and slipped into normal traffic.

Last but not least is Perimeter 81 with its concept of zero-trust networking. Whereas most cybersecurity platforms assume that everything inside the network is safe, under Perimeter 81, every device and user must authenticate before using network services. It makes it so that the external perimeter is reinforced, but also establishes smaller perimeters around every single device within an enterprise network. Even if one node is compromised, the infection will stop there.

I am sure that there are more platforms like these on the horizon as well, and I look forward to testing them out. Perimeter security is not a bad concept. It just got overrun in recent years. Some of these new platforms that tap into emerging technology like machine learning may help to restore it.

Perimeter security even worked out well for my towns in “They Are Billions.” Once I finally researched walls, defensive towers and secure gateways, I could start putting them around my buildings and my towns. 

Like most federal networks, I am still very much outnumbered when defenders are compared with threats. But the secure perimeter makes my job a whole lot easier.

John Breeden II is an award-winning journalist and reviewer with over 20 years of experience covering technology. He is the CEO of the Tech Writers Bureau, a group that creates technological thought leadership content for organizations of all sizes. Twitter: @LabGuys