Open to cyber attack
Written by Zach Beecher Photography by Markus Spiske
Any disruption to ‘business as usual’, especially one that increases our reliance on the digital world, has the potential to be exploited by cyber criminals and turned into a threat. Indeed, as the world prepared for lockdown, the National Cyber Security Centre (NCSC) warned about the likelihood of a surge in cyber-attacks. COVID-19 and cyber-criminals have something in common: they function as a distributed network with no central control and this commonality, argues C5’s Zach Beecher, should dictate the approach we take to defeat them.
COVID-19 reveals one inalienable truth: the world is connected like never before. As infection rates ballooned, arriving at the doorstep of each country, like dominoes inevitably cascading onto one another, the opportunity and threat of our ever-increasing speed of connection has never been clearer.
Falling dominoes are triggering tsunamis within the digital world as well, as hackers and criminal-entrepreneurs race to take advantage. Understanding these intersections and drawing relevant as well as timely insights from these patterns are vital to understand how we can fight back and the ways that we can build a more secure future, both in our physical and digital worlds.
COVID-19 presents a real and present danger, but so too do the forces it unleashed, like those who threaten our cybersecurity. In the time since the World Health Organization declared a ‘pandemic’, sparking a massive online migration for work, these digital criminals have been responsible for a 150% increase in attacks on British hospitals systems, an attack on the data infrastructure of the United States Department of Health and Human Services, and a ransomware attack in the U.S. state of Illinois that shutdown a public hospital for three days forcing it to turn away dozens of patients. Many of these seemingly unpredictable attacks, taken at OPEN TO CYBER-ATTACK 22 moments of weakness and causing a cancer of fear capture the elements that another silent, lurking, faceless enemy espouses day-to-day: COVID-19.
In our new age, we call for an evolution of thinking about the intersection of biosecurity and cybersecurity. Biosecurity, in its current form, speaks to the intentional spread of pathogens, protecting the network from people while biosafety speaks of the aim of protecting people from unintentional pathogens. Cybersecurity, too, speaks of protecting the integrity of the humans on our networks from the intentional spread of compromising software and viruses of a different domain. Thus, central to both the spread of pathogens and computer viruses, as well as their impacts and risks, are networks. The reality of the connectedness of our world demands a security perspective that protects against the next pandemic and offers shared principles for a network-centric approach to maximizing containment, tracking spread, and preparing an active defense against future waves – intentional or not.
As Brafman and Beckstrom illustrated, we have much to learn from the starfish and the spider. A comparison between the two organisms offer clues to how future networks may be protected, whether through cybersecurity or biosecurity. Both creatures can be described physically in similar ways and may play like roles in their ecosystem, but how they achieve their ends could not be more different. Spiders are highly orchestrated animals controlled by their central nervous system – a direct command. Starfishes are capable of extraordinary distributed control with all appendages able to act with unique intent and purpose – a distributed network. Using this analogy, viruses and hackers begin to fit into the starfish model: a distributed network of multiple pathogens or actors with similar capabilities and intent, but with no central point.
Even where spider-type organizations once thrived, there is a renewed understanding of the value of the network. Human conflict offers further indicators on the importance of a network-centric approach in both our cyber and biological worlds. Whether looking to the Zapatista’s ‘social netwar’ of a highly networked, loosely coordinated movement or the brutal democratization of terror by Al-Qaeda in Iraq, we met failure fighting these organizations as spiders. We first fought with a perception of order borne from a paradoxical reality where innumerable interactions of networks, agents, or nonlinear inputs drive individual nodes to adapt and learn from one another. As we met strategic failure despite tactical successes, we realized that we must fight with the full extent of what we seek to protect: our human network. We must fight as a starfish.
Tapping into a groundswell of popular resentment, Al-Qaeda in Iraq (AQI), led by Abu Musab al-Zarqawi emerged from the contours of pre-existing groups as a ‘network of networks’ – an organization with no center. At no point did this become clearer than when Al-Zarqawi was eliminated and just one year later significant insurgent activities were up 100%. As we have seen with both cybersecurity and biosecurity, identifying threats and eliminating them cannot and will not be a cure-all. Instead, we must follow General Stanley McChrystal’s wisdom when he succinctly summarized:
“It takes a network to defeat a network.”
Examining how our military defeated this distributed foe gives us an indication of how to structure our fight against thethreats to both our cybersecurity and biosecurity, and how advancements in both, will enable us to lay a more active defense for crises of the future.
First, we need to shatter hourglasses of communication, leaders need to be able to talk directly to one another, to enable realtime trend-analysis, pattern recognition, and coordinated actions to be taken across functional areas that strike at a network across its elements, rather than at singular nodes.
Second, leaders must enable decentralized empowered entrepreneurial solutions. With teams capable of crosstalk in near real time, prioritizing a shared common operating picture of their priorities, notable differences in what they are tracking, and cross-talking about potential shared solutions, whether it is public health officials or CISOs, may be the difference between a disruption and a disaster. Just as pioneers like General Keith Alexander introduced this to the battlefield and cybersecurity, we, too, must apply this to biosecurity.
C5 is exemplifying this in our Cyber Alliance for Health Care, which leverages the full capability of our portfolio by enabling decentralized execution connected in common purpose with clear lines of communication for our common mission. Ultimately, these features – openness between organizations, entrepreneurial spirit, and an insatiable desire for progress – must and will define how we prepare and ultimately respond to threats against our cybersecurity and biosecurity.
Zach Beecher
Zach Beecher is the Chief Operations Officer of C5 Accelerate, where he sets the strategy and ultimate operationalization of the earliest stage arm of C5 seeking to advance a secure digital future through leading cyber, space, AI, and cloud technologies. Previously, Zach was Director of C5 Philanthropy where he implemented programs using tech for good helping veterans and fighting corruption and human trafficking. Zach served as an officer with the U.S. Army’s 82nd Airborne Division with whom he deployed to Mosul, Iraq. Zach earned master’s degrees from the University of Cambridge and King’s College London as a Rotary Foundation Fellow studying strategy in foreign and domestic policy, as well as a BA from Princeton University in Public Policy focusing on national security.