CYBERSECURITY: Threats and opportunities

Nearly all IT systems today, even those for the most sensitive uses, are hackable by even mid-level attackers, due to hyper-complexity of even high assurance systems, and that powerful nations have stockpiled vulnerabilities and backdoors that they were unable to keep for themselves.

The World is turning into a Hacker Republic, where the most economic and political power accrues to those actors that have hacking and informational superiority in IT and AI, even more than to those formally owning mainstream IT systems and services.

The cybersecurity market has grown 30 times in the last 10 years to $120 billion, yet the cost of cybercrime will accrue to $8 trillion by 2022.

While Enterprises are spending more and more for the security of their critical IT systems, awareness is fast emerging – via scandals like Spectre and Meltdown and CIA Vault 7 – about how their most critical systems are scalably vulnerable to even non-state mid-level attackers that too easily get access to state-grade hacking techniques and tools. While most internal hacks have remained undisclosed, the new GDPR regulation will mandate from May 28th their disclosure within 72 hours, posing a great reputational and stock quotation damage.

Meanwhile Financial institutions are ever more victim of fraud and privacy abuse of their customers, with mounting cash and reputational costs. Their historical role, as provisioners of core trustworthy financial services, is being gravely threatened by cryptocurrencies and blockchains – perceived as potentially safer and cheaper long-term stores of value – and by small and large competitors, unleashed by the EU Directive PSD2, who will be able to offer e-services “over the top” while claiming as much or higher trustworthiness than banks.

Hacking of electoral and primary democratic processes, critical autonomous systems, and social media are fast becoming the military weapons of choice of nations willing to subvert, subjugate and destabilize other nations. Military systems are no less vulnerable, but less is publicly known since the most serious hacks become state secret when they happen.

Meanwhile, security agencies wildly overstate the security of secure apps and devices to push less expert criminals to use them. Not to mention that our democracies appear increasingly held for ransom by the best hackers. 

How did we get here and what can we do about it? For starter, the speed of IT for everyday computing requires complexity that is hopelessly incompatible with ultra-high assurance* IT security and privacy. There is nothing we can do about it, democracies will need to adapt their rules around it, but we are ready to accept that for 99% of our computing. But then again, there is a 1% of sensitive critical functions where citizens, enterprises, and governments have a huge need and demand for IT and AI with ultra-high levels of assurance, even if it requires a great sacrifice in speed, features, and cost.

But then why are these not available even for nearly all the richest and most powerful? Because powerful nations understandably felt the need that every IT system and all times is promptly hackable – in an era of rampant terrorism, unbreakable encryption, and lack of remote lawful access mechanisms. They resorted stockpiling discovered vulnerabilities instead of fixing them, promoting inadequate and flawed standards, and outright inserting backdoors all the way down to CPU and chip fabrication.

Can ultra-high assurance IT be transparently reconciled with lawful access, so that it can be made available to our institutions, enterprises, and citizens without creating a public safety risk? Can we be both Free and Safe in Cyberspace? or do we have to choose? Can we even choose, really, or is it a “both or neither” challenge?

Can a few nations, regions and stakeholders lead by leveraging open innovation and open components to build an entire new ultra-secure computing ecosystem and standard – parallel and not alternative to everyday IT devices – whereby transparency, oversight, accountability, and extreme levels of security-review in relation to complexity, become the secret sauce to ensure both the individual freedom, lawful access and public safety?