When we were kids, some of us liked to play cops and robbers. The former had to capture the latter, who obviously did everything to escape them. Cybersecurity makes us play that game again; except that the playground has expanded to the infinite limits of cyberspace, and the game, while captivating, is no longer as fun.
This logic of cops and thieves is that of the spiral in which any movement takes place, once it is the result of the confrontation between those holding order and the criminals: the technological and methodological progress of some advances others, and vice versa. The more the protection systems are elaborate and effective, the more the means of circumventing them or of making them yield become sophisticated.
Because of their malevolent creativity, thieves are always one step (or one step) ahead. However, the position of strength is occupied sometimes by the police, sometimes by the thieves, in an alternation punctuated by the innovation of technologies and methods. By the strength they put into fighting each other, the adversaries thus reinforce each other mutually, where their hope is to triumph by overthrowing the enemy. The more we strengthen cybersecurity, the more we interest sharp hackers attracted by the challenge of penetrating a citadel deemed impregnable, for example.
This game with rules and limits is reminiscent of the phenomenon of doping in high-level sports: doping products are always one step ahead of the protocols supposed to identify them and the regulations responsible for banning them.
The long time
Thus, hacking is made of cycles. He finds new loopholes that take time to find solutions that close the loopholes. Some techniques thus become obsolete when the levels of protection are sufficient.
But, beyond obsolescence, old-fashionedness also lies in wait for the means employed by hackers. Hacking is also subject to fashion effects. As if crime had its aesthetics, certain technologies are used for attacks rather than others: viruses, DDOS, ransomware… then temporarily abandoned in favor of others.
Cybersecurity is therefore a relatively long term for companies. It is no longer a one-off threat that weighs on them or a risk through which we could pass with a little luck, but a permanent pressure with which we must now reckon on a daily basis.
A long-distance race
We can no longer consider the fight against cyberattacks as “punch” operations where we would oppose a specific response to a single attack. This design is not enough. Or rather, it is no longer enough. In reality, all departments of a company, without exception, must be involved in the fight against cybercrime. The cyber awareness of the whole company is the first condition for the success of any cyber security policy. A CEO who has invested large sums and thinks he has done the necessary in terms of cybersecurity, but who has neglected the key step of cyber awareness, is sitting on sand and his efforts have been in vain.
Exactly as with good health management, checks must be regular, the risk assessment permanent, and the treatments to be applied decided with a competent practitioner. In the same way that it is necessary to repeat the analyzes to see the evolutions (diabetes, cholesterol…), it is advisable to proceed permanently and in real time to the estimation of the cyber risk. Cyber-rating technologies enable this governance of corporate health.
And, because the latter evolve, they develop, these technologies must be able to follow these changes, to accompany it by evolving too. Yesterday’s needs are not necessarily those of tomorrow. Not to mention the cyber risk which, like a virus, mutates, regularly offers new variants, discovers new flaws to exploit, and thus pushes cybersecurity players to constantly evolve.
Even if you always have to react quickly to attacks, cybersecurity today is more like a long-distance race where you have to know how to properly manage priorities, place energy where you need it at the right time, keep your breath, and not exhaust yourself in useless sprints.
Companies must therefore reconfigure or adapt their vision of cybersecurity to be in phase with this permanence of risk and the long term of the cyber threat. Without this adaptation, cyberattacks could be fatal.
So, ready for a little check-up?