Marine Maj. Gen. David Furness and Ron Bushar, senior vice president of Mandiant.
WASHINGTON: “If I ask for a show of hands, who thinks we’re winning in cyberspace these days? I don’t think the answer is yes, for many folks. Right?”
That was Ron Bushar, senior vice president and CTO of Mandiant, speaking to an audience at this week’s Sea Air Space conference. And he wasn’t wrong — in a room full of military professionals, there wasn’t a lot of pushback to his query.
“The unfortunate truth,” Bushar continued, “is both the pace, the frequency, the intensity, and the impact of cyber attacks have only increased over the past several years.”
These attacks are “rapidly outpacing our ability to innovate, defend against cyber tools and weapons and vulnerabilities that are the same problem, right? As we accelerate technology, innovation, and software development, we can’t keep up with the human mistakes that get put into code everywhere we see it.”
The answer, Bushar said, is NOT more defense, what he called higher and higher cyber walls.
“We’re on the defense,” he said. “I don’t think we’ve hit a real deterrence level in this space yet. And that’s going to be key to thinking through our strategy over the next few years.”
Cyber incident chart SeaAirSpace 2021 Credit: Mandiant
Pursuing a primarily diplomatic strategy that “doesn’t have any real deterrence mechanisms built into it beyond kind of naming and shaming” is unlikely to be effective over the long haul, he told the audience on Monday afternoon.
Instead, the US and its allies “have to think about attribution as a strategic imperative, not just as a nice-to-have,” he said. He acknowledged many would “argue that it’s impossible to get good attribution in this space,” but, to provide deterrence “we have to get better at it.”
That led Bushar to a place many observers think the US federal government should have reached several years ago: “We have to get away from this model of, let’s go higher with cyber walls, right? Let’s deter our adversaries or prevent our adversaries from getting into our environments.”
Of course, when you get to the nitty-gritty of just how to deter an enemy or competitor or thief from using cyber tools to attack your systems or hold them hostage everything suddenly gets much more complicated. If the US counterattacks, then the country or group that struck will know more about American capabilities and may escalate. But Bushar made clear the castle wall defense really isn’t working.
