Shiu-Kai Chin
The Biden-Harris administration recently unveiled a new aimed at protecting America鈥檚 digital infrastructure. It comes as high-profile attacks continue to target both government agencies and private companies.
is a professor of electrical engineering and computer science at 黑料不打烊. He is affiliated with the university鈥檚 Institute for Security Policy and Law and is an expert in computer security.
Here, Chin helps break down the new strategy and looks at the roles government and corporations will play in securing critical infrastructure.
Just how big of a problem is cybersecurity, and why is it important to tackle it at the federal level?
Safety and security in cyberspace is a global wicked problem.聽 That is, a problem that cannot be solved once and for all because of the myriad of stakeholders with differing views of what is adequate safety and security. Each stakeholder views the problem differently. The root causes evolve and are interconnected.聽 This is very similar to other wicked problems such as climate change.
The federal government plays an important role in convening stakeholders nationally and internationally to gain consensus and international agreements on standards and acceptable behavior and minimum safety levels.聽 Think about air travel and commerce. Think about arms control.
Safety and security in cyberspace is a global wicked problem. That is, a problem that cannot be solved once and for all because of the myriad of stakeholders with differing views of what is adequate safety and security.
Shiu-Kai Chin
What do you see as some of the key components of the administration鈥檚 strategy?
Important elements of the strategy include coordinating regulations, procurement, economic incentives, and R&D with the specific goal of making cyber-systems and cyberspace safe and secure as a realm of operations for people, business, and governments. For example, tech companies such as software and semiconductor manufacturers often focus on minimizing 鈥渢ime to dollars.鈥� This type of thinking rewards companies who rush products to market with new and exciting features without worrying about cybersecurity. This effectively transfers risk to users while setting up de-facto standards for new products without much thought to security. 鈥淟eveling the field鈥� means finding ways to reward companies and innovators who think about security from the start so that products with cybersecurity built-in from the start (much like safety is built-into to all our electrical appliances with UL certification) become the norm not the exception.
Do you feel the current strategy will have a measurable impact on future cyberattacks?
Yes, but it will take time.聽 We didn鈥檛 arrive in this place a minute ago.聽 Our problems started when, for understandable reasons, personal computers and the chips that powered them had all the security we used to have on mainframes stripped out of them (personal means only the owner has access, right?) and we networked PCs with the Internet. This invalidated an important design assumption in the development of PCs.
The emphasis on 鈥渮ero trust,鈥� i.e., all access and actions must be authenticated and authorized by enforcing appropriate policies, has 鈥渟ecurity by design鈥� as a goal, as opposed to 鈥渂olt-on security鈥� after a product is built with inherent security flaws that cannot be fixed. There are a lot of so-called legacy systems with poor security in operation.聽 Things will get better to the extent that these systems are phased out of critical infrastructure and replaced by systems where security is part of the conceptual design of the system from the start.
What are some of the biggest challenges you foresee with implementing the strategy?
The emphasis on R&D leading to better authentication (identifying the source of requests and integrity of information) is good start to the problem of attribution in cyber attacks.
The harder issue is the balance of privacy and attribution.聽 This is inherently an authorization or policy problem where the appropriate 鈥済ood enough鈥� policy is a trade-off among stakeholders.聽 This where many difficult conversations will occur.聽 Do we want a total surveillance state or the wild west?聽 That鈥檚 a false dichotomy. We want something in-between where the trade-offs are made based on mission or situation.聽 Protecting access to a biolab with pathogens that can trigger the next pandemic probably won鈥檛 value privacy as much as a public library giving internet access to people who cannot afford their own computers.
What else can/should be done to prevent attacks and mitigate damage to critical infrastructure?
Engineering exists to support society. Our profession exists in large part to provide critical infrastructure that is safe, secure, and operates with integrity and equity in mind.聽 Our profession excels when we realize that 鈥済ood enough鈥� safety, security, integrity, and equity have no universally agreed-upon definitions for all cases, applications, and missions.聽 It involves precisely and accurately identifying unacceptable losses to stakeholders for each mission and/or purpose. Once that is done, so-called 鈥渁dult conversations鈥� can happen where 鈥済ood enough鈥� is defined through trade-offs.聽 Engineers, planners, folks in leadership know that it鈥檚 impossible to maximize all parameters simultaneously, e.g., you cannot simultaneously get the biggest, heaviest car with largest engine, while simultaneously maximizing fuel efficiency.
An adult conversation the US Government will have to have is the use of COTS 鈥� commercial off the shelf 鈥� products in mission critical systems and critical infrastructure.聽 COTS products are built for the commercial market, often for home users (e.g., PCs).聽 They are designed for benign operating environments, not military ones. Using COTS is like a SEAL team going to Best Buy and picking up someone from the Geek squad to deploy with them on a mission.聽 The question is for any critical infrastructure system is should we prioritize cost over safety and security?
