To Achieve Cyber Agility, Think Long-Term

The federal government’s forced shift to telework in the wake of COVID-19 was not just a blip on the radar; the Senate recently introduced a bill to keep federal employees working remotely as the pandemic continues to linger. Already, the en masse transition to remote work has forced many agencies to take a fresh look at their cybersecurity infrastructure. While telework means newfound flexibility from an employee perspective, it also means a potentially expanded attack surface for adversaries. Telework, or more likely the desire, ability, and acceptance to work away from the office, will persevere long after COVID-19 is behind us. 

To deal with this increased risk, many cyber leaders are focusing on agility. In a recent survey on federal cybersecurity from Meritalk and Forcepoint, many IT leaders listed cyber agility as a key ingredient in their ideal cyber strategy. And yet, for far too many, agility simply means chasing fires by continuing to purchase the latest flashy technology from the industry’s ever-growing pool of vendors. 

The trouble, as McAfee’s Steve Grobman aptly put it in his 2016 book, “The Second Economy,” is that cyber defense tolls inherently become less effective over time. New technologies incentivize bad actors to develop new attack strategies. Thus, many agencies find themselves running around, frantically trying to deal with the threat of the week. True cyber agility, though, means being able to deal with adversarial change in a rapid fashion, which requires what Grobman calls “sustained innovation.” 

Expect Agility from Adversaries

A basic rule of cyber is that adversaries have first mover advantage; they get to pick the time and place of their attack, and they need only be successful once. With ransomware, for instance, adversaries simply pick an industry and send out countless emails. Only a couple have to hit for the network to get infected, user credentials to get compromised, and an adversary has insider access. 

When a particular type of attack is carried out successfully, upstart vendors often come in promising to stop it. But what happens when the adversary shifts their technique—perhaps pivoting from ransomware to malware inserted somewhere in the supply chain? If agencies simply buy a new product every time a new attack vector pops up, they will find themselves spending more money but getting further behind the bad guys.

Prioritize Platform Over Piecemeal Vendors

In order to be agile enough to deal with adversarial evolution, agencies must instead invest in their cyber platform. Platforms allow for rapid innovation in a way that bringing on disparate new vendors does not. Adversaries move in seconds but government agencies and organizations move much more slowly, in part because contracting and deployment eats up precious time. Agencies must integrate their newest vendor into their workflow, which requires tremendous training, a long rollout, and massive time lags. It’s days, minutes, seconds vs. months, years, and not possible, not a winning hand in the game of cyber.

With platforms, though, agencies can build on their existing contract and customer support to upgrade and enable features as they’re needed, with only incremental training and policy changes. Integrating new cyber capabilities into the existing platform will save employees from having to learn and consolidate a new technology repeatedly—an unsustainable task, particularly given the cyber workforce’s severe shortage. 

Use Machines for What They’re Good for

It’s also crucial that agencies integrate artificial intelligence into their platforms, as adversaries are indeed leveraging such technology. AI removes human fallibility from mundane processes, while also freeing up employees to engage in more creative, out-of-the-box thought and analysis. In simplest terms, a computer can perform more actions than a human, more quickly.  

For example, an agency cannot realistically train all of its employees to not click on phishing attempts, but it can program a computer to look for certain cues that suggest compromised credentials or malicious activity. If someone starts logging in from six locations at the same time and they’re all outside their home base, that’s a problem. If I asked an individual to look at the log-in locations of all users, to compare those locations to those of the past three months, and to look for all abnormal events on Tuesdays between 3 and 4 p.m., they’d be lost. For a computer, the same query is effortless. Thus, AI must be a core component of a sustainable platform. Humans create the questions, machines interrogate those questions.

The Bottom Line 

If federal employees are being directed to the latest shiny technology in response to the latest attack vector, one could argue they’re agile, but I would call it reactive, potentially even foolhardy. Both employees and technology need to be able to change with their adversary, and that can only happen with a platform that leverages AI. True cyber agility means building a platform that can achieve a high level of effectiveness over time—not just a few days—which requires automation and rapid integration. This is particularly urgent with employees continuing to work remotely. Adversaries are constantly eyeing and innovating to exploit weak spots and federal agencies must be prepared to respond. 

Eric Trexler is vice president of global governments and critical infrastructure at Forcepoint.