Cyberspace: a new buffer zone and the rise of the CISO Politicus.

Internet as a free zone

Internet started out as a benign zone. Endpoints were mostly universities, and simply the fact you had access to a console connected to Internet, meant you were an authorised and a trustworthy user. Internet was a free zone, everyone that had access was trusted and shared a common set of values and ideas. The primary task of the network was to provide access and ensure availability and integrity of data. The governance of the protocols that built up Internet was open, loosely organised in ways that may look naive nowadays.

Internet as a commercial zone

Internet changed at the beginning of this century, when companies discovered this technology and started to deploy “e-commerce” services. Quickly, people found out that Internet was not safe. Practically none of the internet protocols (DNS, telnet, gopher, SMTP, etc) used any authentication at all and spoofing was easy. Engineers started to glue authentication and other security layers on top of the internet protocols. Even newer protocols like HTTP did not have proper security. And hence HTTPs, FTPs, DNSSEC and cryptographic solutions were added like SSL. The Internet needed a drastic redesign and enriched protocols. The addition of cryptography, identity and access services and session management solutions (like cookies) meant Internet became a reasonable safe economic zone by translating its core strengths (integrity and availability of data) to confidentiality of data. This enabled companies to do business and allowed for managing liability and trust in commercial value chains.

Internet as a buffer zone

What we see now is that governance of cyberspace is a topic of concern for state nations, as more and more of their economies, infrastructures and law enforcement activities are executed in cyberspace. The ability to govern cyberspace has become a matter of national sovereignty. And even more recent, cyberspace has become a zone of geopolitical consequence.

From CISO Universalis to CISO Politicus

It is important CISO’s realise that they are part of geo-politics. It is no longer enough to acertain identity and integrity of actors. CISO’s need to be aware that the other party can be a weapon in geo-political conflict (even when that party is trustworthy themself). And CISO’s must realise that the objects they are protecting can be used as a weapon too and hence reassess the probability of being a target of choice of adversaries. And as many cyber weapons are inprecise, the risk of collateral damage is also there and higher than before. Above all, CISO’s need to build resiliency to protocol poisoning, as one can no longer rely on the integrity of the protocols of Internet themselves. Cyberspace itself has become a weapon.

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Martijn Dekker, PhD

Martijn Dekker, PhD

Martijn is a top-executive, researcher and CISO of more than 25 years of experience pushing the limits of information security.