The damage can be economic—for example, stolen money or intellectual property. But the risk goes beyond that to include stolen classified information, snooping on private conversations, impersonating others, harassing or bullying innocent people anonymously, damaging important data, disrupting the operation of physical machinery controlled by computers, or denying the availability of normally accessible services. Even if the harms are relatively small for any one individual, they can be large overall.

Credit

Credit: iStockphoto/Sitthiphong

We value security in cyberspace, but we value other things as well, and sometimes these values conflict. For instance:

• We want systems to be easy to access, easy to use, and flexible, but such systems tend to be less secure. For example, two-factor authentication (using both a password and a randomly generated, time-sensitive “token”) to connect to your bank account is less convenient but it improves security.
• Simple systems are easier to make secure than complicated ones. But people often want robust experiences online and vendors want to add features and functions that separate them from their competitors. That can increase the likelihood of vulnerabilities.
• Cybersecurity can slow down digital systems. But people tend not to tolerate systems that are slow, expensive, or less capable even if it means they are more secure.
• Businesses want to sell new products, but making sure those products are secure can slow down development and divert a business’s resources.

Research and careful design can often lessen the severity of these and other tradeoffs. But policy makers and the users of digital technologies will continue to have to balance competing values.

Cybersecurity depends on both the providers and the users of digital technologies. Those who offer a product or service online and the hardware and software developed to support those vendors need to apply existing security technologies and approaches effectively while developing and implementing new ones. For example, providers can encourage their site’s visitors to make good choices. If a banking, health care, or other site with sensitive information is left open and unattended in a browser, it can alert or automatically log out the user after a period of inactivity.

Users of computers need to keep their software and systems up to date and observe good cyber-hygiene, such as not clicking on suspicious links.

Governments at the federal and state level could do much more to promote cybersecurity. They can:

• support research
• act as a model for others by protecting their own systems
• work with the private sector to create high security standards
• demand higher levels of security in the software and systems that they purchase
• foster the development of a skilled cybersecurity workforce

Credit

Credit: Shutterstock/Gorodenkoff

Experts in the field of security are constantly probing the many aspects of cybersecurity and developing solutions for current or potential problems. They study systems, defenses, attacks, and adversaries.

While the technical part of cybersecurity is important, the necessary research isn’t limited to computer science, engineering, mathematics, and information technology. It also involves economics, psychology, sociology, political science, international relations, and law. Security science especially needs the contributions of the social, behavioral, and decision sciences, because cybersecurity inevitably involves people and organizations.

Research needs to address both high-end threats to critical systems and low-end threats to everyday computing and communications. Some research will need to have long time horizons to anticipate upcoming problems. A broad research agenda will decrease the time needed to develop countermeasures when new kinds of attacks arise.

Researchers need to learn from technology developers, system administrators, and information specialists. These and other practitioners are on the front lines of cybersecurity and have much to teach researchers about both the problems they face and what can be done to solve those problems.

Credit

Credit: Shutterstock/wutzkohphoto

Information technology services inevitably have vulnerabilities and cybersecurity is a never-ending battle. Even though there isn’t a permanent solution to the cybersecurity problem, everyone can take steps to manage it more effectively.