What Cyber Lessons Can the Military Teach the Private Sector?

If you run a small ecommerce firm, it might not seem you have much to learn from the US military. In some ways, that's true. It's likely that your budget for cybersecurity is smaller than that of the Defense Department. But, when it comes to effective cybersecurity, that's less important than you might think. Even the most secure systems in the world will eventually be breached; what's important is your approach to that fact.

In this regard, the private sector still has a lot to learn from the military. While many firms have already taken on board some of the technical lessons provided by the DoD – including those related to the way the military uses datacenters – when it comes to the "philosophy" of cybersecurity, we've got a long way to go to catch up.

In this article, we'll take a look at this approach, and explain what the private sector can learn from it.

The Military Mindset

Though the military – and particularly the US military – has an enormous amount of technical resources at its disposal, arguably their biggest asset is their approach to security. This is one based on the assumption that they will be attacked, and that at least some of these attacks will succeed. This is an approach that can be seen as developing directly from the more "traditional" activities of the military: namely, operating in combat zones, where it is equally certain that one will be attacked.

For those outside the DoD, the outcomes of this approach can most easily be seen in the military's response to data breaches. The US military, for instance, has suffered some high-profile breaches recently, but did not overreact to them. Instead of launching a total overhaul of their defenses, they remained tight-lipped about their cybersecurity strategies, and tacitly acknowledged that this kind of attack would succeed from time to time.

Resilience vs. Security

Because of this approach, the way that the military envisions cyberdefense is also strikingly different from the majority of actors in the private sector. Instead of trying to avoid attack altogether, the military focuses on "resilience" – the ability to limit the damage from successful attacks, and to recover quickly afterward.

Resilience is a term that is only infrequently used when it comes to corporate cybersecurity, but it runs through the research and frameworks developed by the military. Perhaps the most detailed explanation of the concept is contained in the 2013 Resilient Military Systems and the Advanced Cyber Threat, which bluntly states that “there is no single silver bullet to solve the threat posed by cyber-attack or [cyber] warfare … the cyber risk elements cannot be reduced to zero. While the problem cannot be eliminated, resilience capabilities can and must be determinedly managed."

The same document gives some details on what this means for the US military, at least at the broadest level. One of the most interesting ideas here – and, again, one that can be seen as a cyber analog of traditional warfare – is the idea of digital "tactical retreats." It appears – reading between the lines – that the military doesn't opt immediately for a traditional step-by-step technical strategy, as many a private IT cybersecurity department might do, say, in the event of a virus-infected computer. Instead, they will just wipe and reboot the machine, having taken steps to ensure that any data it contained has been backed up.

Theory vs. Practice

This idea – of junking a machine that has a virus – might sound a little expensive for the average private sector firm. However, the core principles of the "resilience" model followed by militaries around the world are fairly easy to put into practice, even for small firms. Here's how:

First, recognize that, no matter how good your cybersecurity is, you are going to be hacked at some point. Data breaches are not a sign of failure; over-reacting to them is.
Second, put in place technical measures to ensure the ongoing viability of your systems, even in the event of a successful cyberattack. This should include multiple, distributed backups of all data and systems, but also a modular network design that allows parts of your systems to fail without causing catastrophic damage to your operational capabilities.
Third, try to create a resilient culture in your firm. This includes employing a CISO to take charge and responsibility for your security; simultaneously sharing responsibility for cybersecurity across the C-suite; formalizing your risk management strategies; and making sure that your security team is in-post long enough to build up the necessary expertise.
Finally, take a deep look at your incident response plans. One of the key lessons to be drawn from the military response to successful cyber attacks is that poor responses to successful attacks can sometimes make them worse. US-Cert provides detailed guidance on how to build incident response plans that will safeguard your systems and data while allowing you to retain operational capacity.

The Bottom Line

Ultimately, if civilian government agencies and the private sector cling to security and neglect the importance of resilience in their cyber defense strategy, they will continue to lag the military when it comes to cybersecurity. Despite a reputation for being slow to react to emerging technologies, the military community was highly receptive to learning the hard lesson that security, though necessary, is bound to fail and therefore insufficient.

For private companies, learning a similar lesson means re-focusing on resilience, and not just at a technical level. There is, in short, a need to go beyond redundancy at a hardware level, and to build genuinely resilient systems at a managerial level.