Innovation, agility and partnership: The recipe for successful cyber deterrence
By Rich Baich, Chief Information Security Officer, Wells Fargo
An act of cyberwarfare can be as much of a threat as other acts of war. But when it comes to cybersecurity, how do we define what constitutes a significant threat to our nation’s safety and security? Is it a distributed denial-of-service (DDoS) attack that attempts to interrupt access to financial institutions? Is it malware unleashed with the purpose to do intentional harm to our power grid or other critical infrastructure? Is it coordinated posts on social networks meant to influence an election or impact how we distinguish truthful information? Once we can define a cyber act of war, we can mobilize to defend ourselves.
Recently, the White House released a National Cyber Strategy that outlines how the government will strengthen the country’s cybersecurity capabilities. It is organized according to the pillars of the National Security Strategy to protect American people, the American way of life, and American interests. The Department of Homeland Security (DHS) also announced the launch of the National Risk Management Center focused on government and private sector collaboration to reduce cyber and other systemic threats to national and economic security. Both are important steps in our nation’s efforts to mitigate the risk generated by cyber threats. But, what type of circumstances call for more specialized skills?
Resilient and persistent threats have alwaysrequired advanced countermeasures to fight them. Innovation, agility, and unconventional methodologies replace the “status quo” and set the course for renewed momentum and triumph.
As a proud Navy veteran, I look at it in military terms. A Special Operations Force (SOF) is organized, trained, and equipped to conduct special operations beyond the capabilities of regularly-trained military personnel. Similarly, to address cyber threats, an organization must organize its defenses by employing specialized resources, policy, technology, talent, training, and appropriate authorities to deliver the intended results while mitigating risks to improve the odds of a successful mission.
Just like with a SOF, this type of cybersecurity force cannot be mass produced or created after an emergency occurs. It must be fully integrated into business processes and employ cyber intelligence to try and predict cyber threats. And, in an interconnected world, it cannot act alone.
As Wells Fargo’s chief information security officer, I recognize how the exchange of information between international groups, government bodies, industry associations, and private businesses leads to better intelligence and, ultimately, a more effective response to cyber threats. This information is a key input to help make critical cybersecurity decisions. It takes dedicated effort and a strong sense of purpose to develop these connections. That work is well underway within the financial industry.
During my two-year term as chairman of the Financial Services Sector Coordinating Council (FSSCC), the council worked to foster better collaboration with government associations and across different critical infrastructure sectors. Together, we worked with the White House and Congress, the intelligence community, the Department of Defense and DHS to further improve the cybersecurity posture of our nation. We furthered discussions with regulators and partnered with the Department of the Treasury to advance private and public sector collaboration. And, we organized and conducted joint exercises across the sectors to – in military terms – train like we fight.
During November, a month designated by DHS as “Critical Infrastructure Security and Resilience Month,” it’s imperative to remember that the threat continues to grow. Now is not the time to let our guard down. We must continue to partner across sectors, focusing on strategic and tactical cyber operations, to become more agile in detection, response and recovery. This is critical to protecting our infrastructure and protecting our nation.
Let us not wait for a significant act of cyberwar to further advance our deterrence efforts.
Rich Baich is chief information security officer for Wells Fargo. He served a two-year term as chairman of the Financial Services Sector Coordinating Council (FSSCC) and is a recent presidential appointee to the National Infrastructure Advisory Committee (NIAC).
Content From
