The Art of War: A cybersecurity take

"Sun Tzu said..."

“With these words begins a timeless study of warfare strategy, The Art of War.” I’m sure Sun Tzu never imagined a battlefield where enemies appear, disappear and regenerate faster than the human eye can blink. Eons away from smartphones, iPads and laptops, his words are “on point” and as relevant to cybersecurity today, as they were to foot soldiers and generals waging wars in antiquity.

The Art of War is about readiness, outsmarting opponents to take control of the battlefield without physically waging war. In the digital world, landscape is the network, seasons are data-transfer patterns, and laying siege is known as a DDOS attack. But new terminology aside, readiness is still the life force of victory.

“All warfare is based on deception. Hence, when we are able to attack, we must seem unable; when using our forces, we must appear inactive; when we are near, we must make the enemy believe we are far away; when far away, we must make him believe we are near.”

Our jobs as CIOs, CISOs, network architects and administrators is to ensure our businesses run over optimally configured, financially practical and secure networks. A network under siege for one second can cost millions of dollars in operating cash. A break in a digital supply and logistics chain can result in complete business failure. Make no mistake, thousands upon thousands of cyber attacks take place every second, each with potentially catastrophic results. If the stakes are this high, then what are we doing to prepare? 

Evaluations, assessments, critical design reviews and network stress tests are all good measures but inadequate by themselves. When was the last time anyone restarted a network from back-up as rehearsal for the real deal? In the relative calm of peace (day-to-day operations) and on paper, it’s easy to have a false sense of security. But hackers’ tactics are evolving with greater speed and complexity, so we have to stay ahead of their learning curve to do our jobs.

Beyond red-, white-, blue- and black-hat evaluations, what other preparations and countermeasures must we use to mitigate the impact of relentless hacking attacks that seek to disrupt both business operations and governments? Part of a winning strategy is knowing not only how to react to attacks today but also anticipating future threats. As we move into 2017, what cybersecurity behaviors, trends and countermeasures should we plan for so we can make every effort to stay in control of our “terrain?”