I certainly don't agree with everything in this thread, but it is very thought provoking nonetheless. I tell clients regularly that cyber security IS warfare if APT is in your threat model. We often fight nation state hackers with nearly infinite resources by deploying a CEH. 1/n
This obviously doesn't work. When you step back and look at resources that APT groups have, it's obvious they can comrpomise almost any organization. My favorite example is the China/Bit9 example. Picture being an attacker who can't get into a top tier target. 2/n
Now imagine that you think "Bit 9 is standing in our way, so we'll 'just' go comrpomise them." Um, that's a moonshot. Ask yourself:
1. What kind of organization dedicates resources to moonshots?
2. How many moonshots do we not know about?
3. How valuable was that target?
3/n
1. What kind of organization dedicates resources to moonshots?
2. How many moonshots do we not know about?
3. How valuable was that target?
3/n
Answers:
1. Only orgs with some serious firepower (resourcing) can really afford to spend some of it on a moonshot.
2. It's nearly certain that other moonshots were tried. Some certainly failed, others may have been overcome by events.
3. Wow, that data must be valuable.
4/n
1. Only orgs with some serious firepower (resourcing) can really afford to spend some of it on a moonshot.
2. It's nearly certain that other moonshots were tried. Some certainly failed, others may have been overcome by events.
3. Wow, that data must be valuable.
4/n
Now go ask your CISO when they last had resources to allocate to a moonshot. Odds are good you're going to hear a huge belly laugh. But to the OPs point, cyber security IS warfare - and we're usually fighting it poorly. 5/n
Personally, I find the resourcing example the most effective communication strategy for executives. You're speaking their language instead of talking a bunch of technobabble (what they hear) and "always asking for more money." 6/n
All execs understand how resourcing impacts competing in an open market. What they don't usually understand is that cyber security is a competition - and typically it's one they've undercommitted resources to. 7/7
