Cybersecurity is a constant, and, by all accounts growing, challenge. This report, the second in a multiphase study on the future of cybersecurity, reveals perspectives and perceptions from chief information security officers; examines the development of network defense measures — and the countermeasures that attackers create to subvert those measures; and explores the role of software vulnerabilities and inherent weaknesses.

The Defender's Dilemma

Charting a Course Toward Cybersecurity

Martin C. Libicki, Lillian Ablon, Timothy Webb

ResearchPublished Jun 10, 2015

Cybersecurity is a constant, and, by all accounts growing, challenge. Although software products are gradually becoming more secure and novel approaches to cybersecurity are being developed, hackers are becoming more adept, their tools are better, and their markets are flourishing. The rising tide of network intrusions has focused organizations' attention on how to protect themselves better. This report, the second in a multiphase study on the future of cybersecurity, reveals perspectives and perceptions from chief information security officers; examines the development of network defense measures — and the countermeasures that attackers create to subvert those measures; and explores the role of software vulnerabilities and inherent weaknesses. A heuristic model was developed to demonstrate the various cybersecurity levers that organizations can control, as well as exogenous factors that organizations cannot control. Among the report's findings were that cybersecurity experts are at least as focused on preserving their organizations' reputations as protecting actual property. Researchers also found that organizational size and software quality play significant roles in the strategies that defenders may adopt. Finally, those who secure networks will have to pay increasing attention to the role that smart devices might otherwise play in allowing hackers in. Organizations could benefit from better understanding their risk posture from various actors (threats), protection needs (vulnerabilities), and assets (impact). Policy recommendations include better defining the role of government, and exploring information sharing responsibilities.

Key Findings

Common Knowledge Confirmed

  • Security postures are highly specific to company type, size, etc.; and there often aren't good solutions for smaller businesses.
  • Quarantining certain parts of an organization offline can be a useful option.
  • Responding to the desire of employees to bring their own devices and connect them to the network creates growing dilemmas.
  • Chief information security officers (CISOs) feel that attackers have the upper hand, and will continue to have it.

Reasonable Suppositions Validated

  • Customers look to extant tools for solutions even though they do not necessarily know what they need and are certain no magic wand exists.
  • CISOs want information on the motives and methods of specific attackers, but there is no consensus on how such information could be used.
  • Current cyberinsurance offerings are often seen as more hassle than benefit, only useful in specific scenarios, and providing little return.

Surprising Findings

  • A cyberattack's effect on reputation (rather than more direct costs) is the biggest cause of concern for CISOs. The actual intellectual property or data that might be affected matters less than the fact that any intellectual property or data is at risk.
  • In general, loss estimation processes are not particularly comprehensive.
  • The ability to understand and articulate an organization's risk arising from network penetrations in a standard and consistent matter does not exist and will not exist for a long time.

Recommendations

  • Know what needs protecting, and how badly protection is needed. It was striking how frequently reputation was cited by CISOs as a prime cause for cybersecurity spending, as opposed to protecting actual intellectual property. Knowing what machines are on the network, what applications they are running, what privileges have been established, and with what state of security is also crucial. The advent of smart phones, tablets, and so forth compounds the problem.
  • Know where to devote effort to protect the organization. A core choice for companies is how much defense to commit to the perimeter and how much to internal workings.
  • Consider the potential for adversaries to employ countermeasures. As defenses are installed, organizations must realize they are dealing with a thinking adversary and that measures installed to thwart hackers tend to induce countermeasures as hackers probe for ways around or through new defenses.
  • Government efforts aren't high on CISO's lists, but governments should be prepared to play a role. By and large, CISOs we interviewed did not express much interest in government efforts to improve cybersecurity, other than a willingness to cooperate after an attack. Yet it seems likely that government should be able to play a useful role. One option is to build a body of knowledge on how systems fail (a necessary prerequisite to preventing failure), and then share that information. A community that is prepared to share what went wrong and what could be done better next time could produce higher levels of cybersecurity.

Order a Print Copy

Format
Paperback
Page count
162 pages
List Price
$22.50
Buy link
Add to Cart

Topics

Document Details

  • Copyright: RAND Corporation
  • Availability: Available
  • Year: 2015
  • Print Format: Paperback
  • Paperback Pages: 162
  • Paperback Price: $22.50
  • Paperback ISBN/EAN: 978-0-8330-8911-3
  • DOI: https://doi.org/10.7249/RR1024
  • Document Number: RR-1024-JNI

Citation

RAND Style Manual
Libicki, Martin C., Lillian Ablon, and Timothy Webb, The Defender's Dilemma: Charting a Course Toward Cybersecurity, RAND Corporation, RR-1024-JNI, 2015. As of September 17, 2024: https://www.rand.org/pubs/research_reports/RR1024.html
Chicago Manual of Style
Libicki, Martin C., Lillian Ablon, and Timothy Webb, The Defender's Dilemma: Charting a Course Toward Cybersecurity. Santa Monica, CA: RAND Corporation, 2015. https://www.rand.org/pubs/research_reports/RR1024.html. Also available in print form.
BibTeX RIS

Research conducted by

The research was conducted within the Acquisition and Technology Policy Center (ATP) Center of the RAND National Security Research Division (NSRD).

This publication is part of the RAND research report series. Research reports present research findings and objective analysis that address the challenges facing the public and private sectors. All RAND research reports undergo rigorous peer review to ensure high standards for research quality and objectivity.

This document and trademark(s) contained herein are protected by law. This representation of RAND intellectual property is provided for noncommercial use only. Unauthorized posting of this publication online is prohibited; linking directly to this product page is encouraged. Permission is required from RAND to reproduce, or reuse in another form, any of its research documents for commercial purposes. For information on reprint and reuse permissions, please visit www.rand.org/pubs/permissions.

RAND is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors.