Trouble With The Curve

Hackers are getting smarter and more relentless — can security professionals keep pace?

- Cody Clark

When then-presidential candidate Donald J. Trump said during his first debate with Hillary Clinton in September 2016, “The security aspect of cyber is very, very tough. And maybe it’s hardly doable,” he touched on a basic anxiety that many people have about information security. The fear that nothing is really safe, and that we ultimately can’t stop hackers from doing as they please, is perhaps not yet pervasive in world society.

Every time that a previously unknown major breach is uncovered, however, there’s probably a bit more of a shift toward the pessimism and despair of thinking that data protection is “hardly doable.” It’s an understandable impulse. Just in the last three years, the world has weathered a stunning barrage of successful attacks against supposedly untouchable targets.

In June 2015, the United States government’s Office of Personnel Management disclosed the theft of files connected to as many as 18 million individuals. In September and December 2016, Yahoo reported separate breaches affecting as many as 1.5 billion individuals. And just about a month ago as you read these words, credit reporting agency Equifax announced the theft of personally identifying information connected to more than 180 million U.S. and U.K. citizens.

As much as we may be inclined to rail against outdated or inadequate software, however, the breakdowns that enable these incidents are almost always attributable, whether directly or indirectly, to human error. Whether because individuals failed to heed clear warnings and take specific actions, or because too few specialists were given dangerously inadequate support when tasked with defending porous digital perimeters, cyber security failure is almost always a people problem.