Written by: Cormac O’Harrow

Since the advent of the pandemic, the explosion in the number of cyber-attacks being perpetrated in the United States has become a signal of just how quickly the classic Homeland Security narrative is changing. The data show that these incidents are on the rise as more states and individuals become capable of carrying them out. The issue is relatively new, yet the question has already become when, not if, critical infrastructures and agencies will be attacked, and how harmful the fallout will likely be. So, how does one protect against these threats, and why isn’t that seemingly necessary infrastructure already in place?

As I argued in my recent piece, Beyond the Wire and Into the Cyberspace, the United States is woefully unprepared for modern cyber conflicts because of our structural lack of adequate grid security. However, the US does not stand alone; much of the western world sits in a similar boat. In national discussions last month on the topic, UK Prime Minister Boris Johnson expressed a similar sentiment, stating, “Cyber power is revolutionizing the way we live our lives and fight our wars, just as air power did 100 years ago. We need to build up our cyber capability so we can grasp the opportunities it presents while ensuring those who seek to use its powers to attack us and our way of life are thwarted at every turn.”

Why hasn’t this shift towards the future of common defense happened yet?

As with any technological advancement, the skills required to perform useful tasks become more stringent as both attack volume and sophistication are rising. To further complicate the situation, more than 40% of IT leaders report that cybersecurity jobs are the most inherently difficult jobs to fill because of lack of talent and talent identification. A state can put as much money towards cyber projects as they want, but it is all for naught if the manpower doesn’t exist.

That being said, the enemies of our state have ramped up their cyber operations to make up for the smaller material militaries they command. Earlier this year, the US was the main target of the SolarWinds attack, which utilized a Network Management System (within SolarWinds programs) in order to monitor critical systems. SolarWinds is a software company that supplies systems across the world with Network Management services. Because so many Federal Agencies and financial institutions use SolarWinds programs to manage their networks, this means attackers gained access to, and could have potentially affected, everything from power grids to the Department of Defense and even Fortune 500 companies. 

This attack, which occurred sometime during March of 2020, was incredibly sophisticated. The attackers—most likely Russian actors—left little trace and waited about two weeks to activate the program they had installed to escape scrutiny. The byproduct of this attack is such that foreign actors may have high levels of access throughout an affected organization’s systems.

Given these challenges and others, the western world should turn its attention towards Israel in order to implement better cybersecurity initiatives. The small Middle Eastern state has done an incredibly good job at guarding against these types of threats.

Since the creation of the Nation-State of Israel, war has never been far from its doorstep. From rapid militarization to the creation of the ‘Iron Dome’ defense system, Israel has always been at the forefront of security. In the mid 1990’s, the state’s leaders saw the evolution of the internet as a future frontier of war and began to plan accordingly. The state already utilized a conscription system, wherein every citizen is required to serve in the military in some capacity upon turning 18. Within this conscription is a type of specialized recruiting, deemed ‘commando recruiting.’ The purpose of this type of recruitment is to identify individuals early on who are likely to possess superior combat or military skills. Using this model, the Israelis began to screen their entire population, particularly children, for the most likely cyber-capable individuals. By testing the entire population, the state was able to quickly relieve the pressures created by a lack of cyber manpower. Just this year, the state authorized the creation of 40 new critical cyber systems for defense and found within their systems more than 6,750 vulnerabilities that were subsequently patched.

The Israel case is atypical– there is little chance that screening the entire US population could, or should, occur. That being said, Israel’s displayed efficiency in this facet of common defense is more than commendable, it’s highly impressive because of the foresight their leaders had in crafting such a system early on. The US Federal Government, as well as our allies, must follow suit in their own way and must begin rigorously attempting to patch the holes that currently exist within our cybersecurity framework. In all likelihood, the path to this level of recruitment, in the United States in particular, can be achieved through more extensive cyber-security training programs, universal primary school mandated coding and computer courses, and much more widespread incentive programs for interested and qualified individuals.