Have We Reached the Cyber Tipping Point?

The numbers are getting kind of crazy, people. And I am not just talking about the big national cyberattack stories that we are seeing, but also the personal stories that go on daily within our homes and organizations. Just in the last month, I have seen several colleagues (don’t worry I won’t name names) get their emails compromised to the point that they sent me a malicious file to open. And, let’s be honest, when a close industry friend sends you a document to check out, it just takes a momentary lapse of reason to click on said attachment. But I digress.

The main focus of my blog is on the major cyberattacks that are going on, the ones that are affecting critical infrastructure, agriculture and technology on such a scale that we are beginning to see the ripple effects, such as higher gas, energy and food prices, for example, not to mention the possibility of a future catastrophic cyberattack that could shut down a national power grid for an extended period of time.

So I guess the big question we are all wondering is when will we, if ever, reach the tipping point where these major attacks are mostly prevented and thwarted, not just reported on and responded to after the fact. And yes, I know there are millions of attacks that are thwarted on a daily basis – plus the ones that happen that aren’t reported – and I know the war on cyber is never-ending, so I understand we can’t eradicate these attacks completely. That would be naïve to even suggest.

But what I am asking is, have we reached the tipping point yet where these horrific cyberattack stories become fewer and far between? According to the majority of SSN readers who responded to our most recent News Poll, they feel things will get worse before they get better. In fact, 85 percent feel we have not reached that tipping point yet.

“We need to make very sure that OT people are leading any projects to protect industrial control systems,” said one respondent.  “OT is VERY different to IT – many of the 'normal' IT rules either don't apply, or are very wrong in the OT environment.”

Many News Poll respondents (62 percent) feel the President’s recent executive order to address the gaps in cybersecurity will not make a difference.

As one reader pointed out, “The EO adds more bureaucracy. The solution to this problem is: 1. Increase redundancy. 2. Minimize predictability of changes to security protocols and change them in a manner so authorized individuals continue to have access. 3. Investigate every breach until the culprit is found, instead of 'plugging the leak' and pretending the problem is solved. I thought we had full cooperation between all these federal agencies with an EO that was issued after 9/11?”

Following the announcement that the DOJ will give ransomware attacks the same level of priority as terrorism, one reader feels a response should even involve the military. “The U.S. Government needs to respond to these cyberattacks with military force that is many times greater than the attack against the U.S.”

Looking at what is being done within the industry, the good news is there is some momentum going on in cybersecurity, most notably with the recent announcement of a new cybersecurity credential developed by the Security Industry Association (SIA) with support from PSA Security Network and Security Specifiers, with the goal of providing an industry standard we can all rally behind.

When asked about the new industry standard, nearly half of the respondents (45 percent) feel it will make a difference, with another 40 percent saying “maybe” and only 15 percent feeling it would not.

So while it is good to see a renewed focus – and funding – from the top, as many of you know, for us to make any real progress on this national issue, the real work and progress happens in the trenches, with the security, IT, OT and cybersecurity professionals, as well as security equipment manufacturers, suppliers and associations – and yes, even end users – as we each play a role in the war on cyber terrorism.