Securing Cyberspace: Towards an Agenda for Research and Practice

Abstract

IntroductionThe explosive growth of the Internet has radically transformed the way we interact as a society. It underpins all facets of our critical infrastructure, enables global commerce, and affords us unparalleled near-real time access to information. It has also made us information-dependant in both our professional and personal lives. With the advent of the Internet of Things (IoT), we now live in a digital era that has rapidly transitioned society from a state best described by the term "always connected" to a new reality of "everything connected".An unintended consequence of this connectivity is that it has introduced new vulnerabilities, adversarial threats, and challenges to our society. Network boundaries are becoming both blurred and porous. In fact, the overall "attack surface" of modern networks is increasing at an exponential rate. Cisco estimates that 15 billion devices will be connected to the Internet this year, increasing to 50 billion devices by 2020 (Macaulay et al., 2015). Each new device represents a new connection into the network and yet another potentially exploitable entry vector for an adversary. Perhaps most worrisome is that studies have shown that approximately 70% of these devices contain serious vulnerabilities (HP, 2014). Here, the asymmetric nature of cybersecurity comes into focus, namely the work factor for an attacker is the "cost" of finding a new attack vector while the defender bears a cumulative cost of all known attacks. Put more plainly, a defender has to stop all entry vectors into a network whereas an attacker only has to find one way in (Geer, 2015).Although we can argue that the IoT represents a revolution of connectivity, the Industrial Internet of Things (IIoT) -the use of IoT technology in manufacturingrepresents a steady evolution of structured connectivity. Anxious to reduce operational costs and increase industrial automation, the very "system of systems" that composes our critical infrastructure (e.g., the smart In this article, we seek to identify the important challenges preventing security in cyberspace and to identify the key questions that nations should set out to answer to play a leading role in securing cyberspace. An important assertion is that the challenge of securing cyberspace transcends the abilities of any single entity and requires a radical shift in our approach in how: i) research is conducted, ii) cybersecurity researchers are educated, iii) new defendable systems are developed, and iv) effective defensive countermeasures are deployed. Our response draws upon extensive source material and our personal experiences as cybersecurity professionals contributing to the establishment of the VENUS Cybersecurity Corporation, a not-for-profit corporation that aims to make Canada a global leader in cybersecurity. We view the challenge to be global and transdisciplinary in nature and this article to be of relevance world-wide to senior decision makers, policy makers, managers, educators, strategists, futurists, scientists, technologists, and others in...