Including Cyber Security from Concept to Release

By Terry L Davis, P.E.

Albert Einstein said the definition of insanity is doing something over and over again and expecting a different result.  This is the state of “Cyber Security” today.

A cyber strategy that reuses the same failed processes and technologies over and over will fail to meet its goals. The cyber adversaries will just build better and faster ways to access our systems. And building better and faster anti-virus and malware detection results in a race that can’t be won.

Cyber security must be an integral part of the system or product architecture and design process! Trying to “bolt-on” security to existing systems or products usually forces a “best that can be done” outcome. Then literally have parts of the attack surfaces that cannot be adequately protected without a complete re-design of the system or product. Including cyber security in the planning, architecture, and design of systems or products, allows a couple key things:

- Control of the attack surfaces presented.

This can include diverse items like points of connectivity, data retrieval design, specific hardware choices, COTS OpenSource or custom software. Items that probably can’t be fully protected if security either a last-step or a bolt-on. Small changes at design time yield huge security payoffs.

- The inclusion of “cyber protection points”.

These are places in the system or product that new cyber protections can be added in the future with minimal system or product impacts to cover threats that were not known at the design time. Over the last couple years, deep hardware and remote attacks have been made against vulnerabilities that were not even dreamed of at design time.

- Cyber security testing.
- This must be included from the earliest alpha testing through final release. This has to be much more than classic IT security penetration tests. Most systems and product are tested to their “specifications and requirements”. Although this is necessary, it is not adequate for cyber security. One of the surest ways to fail any system or product is to place it in “a state it can’t be in”. For example, what will your self-driving car do if somehow it suddenly receives its heading as 361 degrees? That’s an out-of-range value that standard testing would never try because its “illogical and out-of-spec”.

The challenge is in presenting cyber security is to find and offer truly new cyber techs and demonstrate how we can reduce the cyber-attack surface especially if cyber strategy is built-in from the earliest conceptual designs through release.  

Again, better, faster anti-virus/malware-detection won’t cut it.  Likewise, neither will technologies that are too costly or too complex to use.