A cyberattack occurs every 39 seconds. Is the government finally equipped to fight back?
A version of this article appeared in VMblog. It has been updated and syndicated here.
It seems that no matter how many Cybersecurity Awareness Months roll by, how many elite security professionals are parachuted in, or how much money is lost into a black hole, the issue of big data breaches just gets worse year-on-year. They’re so regular that they barely make the mainstream news these days, short of them being catastrophic. In 2020, more than 36 billion records were exposed in malicious cyberattacks, and we lay in wait to see how many will be harvested in 2021.
Threat actors are constantly scanning for opportunities, and while not every attack is a disaster, they occur on average, every 39 seconds. We’re not even close to winning the fight, and the bad guys have a huge advantage over the defenders of our data.
However, it seems change is in the air, with the Biden administration making cybersecurity an early priority in his term, to the tune of an extra US $10B in funding. This is, without question, a step in the right direction, but will this actually make a dent in cybercrime that is escalating in frequency and sophistication?
Cyber threats will take a (global) village to solve
Effective defense against increasingly potent cyberattacks cannot be the remit of just a handful of countries, and unfortunately, a cohesive strategy has been lacking across the board for a long time. However, with nation-state threats on the rise, many governments are sitting up and taking notice.
The SolarWinds attack affecting the US government was a clear warning of what is possible, and an indicator of the potential devastation if any critical infrastructure was breached. Recently, the FBI issued a warning that a Florida water system was attacked, with the threat actor able to contaminate the water supply remotely. They were stopped before serious damage was realized, but a more advanced attacker could have caused destruction on a massive scale that would put lives at risk.
Slowly, but surely, governments around the world are investing more in cyber defense. The UK made record investments in the cybersecurity sector, and established a new task force. Australia beefed up its cybersecurity strategy (especially for infrastructure), and places like Israel and Denmark are considered best-in-class for their cyber programs. Japan is ranked fifth in cyber defense; a welcome vote of confidence following a 2018 statement from then-Minister for Cybersecurity Yoshitaka Sakurada that he’d never used a computer. A recent announcement from the Singapore government pledged a $50 million investment in AI and cybersecurity research in future communications infrastructure, a forward-thinking move to solidify digital safety and integrity.
A strong, coordinated global cybersecurity response is vital as we rapidly progress into future tech, and every government body should illuminate it as a key focus.
More money doesn’t mean fewer problems
If we take the United States, United Kingdom, and Australia as examples, all of whom increased investment in government-led cybersecurity and expertise in the past couple of years, it may seem as though security is finally a priority, and the “good guys” are getting what they need to win the battle.
It certainly helps, but it’s only part of the bigger picture. That funding can buy super teams of experts (as has happened with Biden’s cash injection), comprehensive bug-bounty programs, and top-notch incident response and mitigation in the event of disastrous breaches, and it’s this approach to cyber defense that ensures we’ll still make minimal progress, no matter how much money is thrown at task forces and threat response.
Every government needs to look beyond reactive security measures, and sink some serious effort (and funding) into a more preventative strategy. If the focus remains on reacting to successful cyberattacks instead of working to prevent them in the first place, no amount of money will drive down growing risk. A genuine, proactive security approach would see budget allocated to infrastructure hardening, and rolling out effective security training and upskilling with the aim of reducing the attack surface as much as possible right from the start.
The cybersecurity skills gap may never close, but there is wasted potential
Highly trained, specialist security personnel are in huge demand all over the world, and it’s unlikely we will ever see a glut of those cyber gurus. However, this is all the more reason for governments and organizations alike to start getting creative, and savvier with the resources at their disposal.
A truly preventative approach to cyber defense starts with every person involved in the software development and infrastructure process being as security-aware as possible for their role. Developers, in particular, need the right security upskilling and right-fit tools for the job, so that secure coding can be intrinsic to their process. This goes a long way in ensuring that common vulnerabilities can be addressed before they ever see the light of day. This alone is a powerful - not to mention cheaper - step that reduces pressure and rework further down the software development lifecycle.
We need to reinforce a human-led approach to cybersecurity best practices, and it’s going to get better results than a heavy reliance on automation, tools, and reaction to problems that have already been embedded and discovered - a strategy that is clearly not working if we look at the number of breaches happening today.
We need to reinforce a human-led approach to cybersecurity best practices, and it’s going to get better results than a heavy reliance on automation, tools, and reaction to problems that have already been embedded and discovered.
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demoMatias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
A version of this article appeared in VMblog. It has been updated and syndicated here.
It seems that no matter how many Cybersecurity Awareness Months roll by, how many elite security professionals are parachuted in, or how much money is lost into a black hole, the issue of big data breaches just gets worse year-on-year. They’re so regular that they barely make the mainstream news these days, short of them being catastrophic. In 2020, more than 36 billion records were exposed in malicious cyberattacks, and we lay in wait to see how many will be harvested in 2021.
Threat actors are constantly scanning for opportunities, and while not every attack is a disaster, they occur on average, every 39 seconds. We’re not even close to winning the fight, and the bad guys have a huge advantage over the defenders of our data.
However, it seems change is in the air, with the Biden administration making cybersecurity an early priority in his term, to the tune of an extra US $10B in funding. This is, without question, a step in the right direction, but will this actually make a dent in cybercrime that is escalating in frequency and sophistication?
Cyber threats will take a (global) village to solve
Effective defense against increasingly potent cyberattacks cannot be the remit of just a handful of countries, and unfortunately, a cohesive strategy has been lacking across the board for a long time. However, with nation-state threats on the rise, many governments are sitting up and taking notice.
The SolarWinds attack affecting the US government was a clear warning of what is possible, and an indicator of the potential devastation if any critical infrastructure was breached. Recently, the FBI issued a warning that a Florida water system was attacked, with the threat actor able to contaminate the water supply remotely. They were stopped before serious damage was realized, but a more advanced attacker could have caused destruction on a massive scale that would put lives at risk.
Slowly, but surely, governments around the world are investing more in cyber defense. The UK made record investments in the cybersecurity sector, and established a new task force. Australia beefed up its cybersecurity strategy (especially for infrastructure), and places like Israel and Denmark are considered best-in-class for their cyber programs. Japan is ranked fifth in cyber defense; a welcome vote of confidence following a 2018 statement from then-Minister for Cybersecurity Yoshitaka Sakurada that he’d never used a computer. A recent announcement from the Singapore government pledged a $50 million investment in AI and cybersecurity research in future communications infrastructure, a forward-thinking move to solidify digital safety and integrity.
A strong, coordinated global cybersecurity response is vital as we rapidly progress into future tech, and every government body should illuminate it as a key focus.
More money doesn’t mean fewer problems
If we take the United States, United Kingdom, and Australia as examples, all of whom increased investment in government-led cybersecurity and expertise in the past couple of years, it may seem as though security is finally a priority, and the “good guys” are getting what they need to win the battle.
It certainly helps, but it’s only part of the bigger picture. That funding can buy super teams of experts (as has happened with Biden’s cash injection), comprehensive bug-bounty programs, and top-notch incident response and mitigation in the event of disastrous breaches, and it’s this approach to cyber defense that ensures we’ll still make minimal progress, no matter how much money is thrown at task forces and threat response.
Every government needs to look beyond reactive security measures, and sink some serious effort (and funding) into a more preventative strategy. If the focus remains on reacting to successful cyberattacks instead of working to prevent them in the first place, no amount of money will drive down growing risk. A genuine, proactive security approach would see budget allocated to infrastructure hardening, and rolling out effective security training and upskilling with the aim of reducing the attack surface as much as possible right from the start.
The cybersecurity skills gap may never close, but there is wasted potential
Highly trained, specialist security personnel are in huge demand all over the world, and it’s unlikely we will ever see a glut of those cyber gurus. However, this is all the more reason for governments and organizations alike to start getting creative, and savvier with the resources at their disposal.
A truly preventative approach to cyber defense starts with every person involved in the software development and infrastructure process being as security-aware as possible for their role. Developers, in particular, need the right security upskilling and right-fit tools for the job, so that secure coding can be intrinsic to their process. This goes a long way in ensuring that common vulnerabilities can be addressed before they ever see the light of day. This alone is a powerful - not to mention cheaper - step that reduces pressure and rework further down the software development lifecycle.
We need to reinforce a human-led approach to cybersecurity best practices, and it’s going to get better results than a heavy reliance on automation, tools, and reaction to problems that have already been embedded and discovered - a strategy that is clearly not working if we look at the number of breaches happening today.
A version of this article appeared in VMblog. It has been updated and syndicated here.
It seems that no matter how many Cybersecurity Awareness Months roll by, how many elite security professionals are parachuted in, or how much money is lost into a black hole, the issue of big data breaches just gets worse year-on-year. They’re so regular that they barely make the mainstream news these days, short of them being catastrophic. In 2020, more than 36 billion records were exposed in malicious cyberattacks, and we lay in wait to see how many will be harvested in 2021.
Threat actors are constantly scanning for opportunities, and while not every attack is a disaster, they occur on average, every 39 seconds. We’re not even close to winning the fight, and the bad guys have a huge advantage over the defenders of our data.
However, it seems change is in the air, with the Biden administration making cybersecurity an early priority in his term, to the tune of an extra US $10B in funding. This is, without question, a step in the right direction, but will this actually make a dent in cybercrime that is escalating in frequency and sophistication?
Cyber threats will take a (global) village to solve
Effective defense against increasingly potent cyberattacks cannot be the remit of just a handful of countries, and unfortunately, a cohesive strategy has been lacking across the board for a long time. However, with nation-state threats on the rise, many governments are sitting up and taking notice.
The SolarWinds attack affecting the US government was a clear warning of what is possible, and an indicator of the potential devastation if any critical infrastructure was breached. Recently, the FBI issued a warning that a Florida water system was attacked, with the threat actor able to contaminate the water supply remotely. They were stopped before serious damage was realized, but a more advanced attacker could have caused destruction on a massive scale that would put lives at risk.
Slowly, but surely, governments around the world are investing more in cyber defense. The UK made record investments in the cybersecurity sector, and established a new task force. Australia beefed up its cybersecurity strategy (especially for infrastructure), and places like Israel and Denmark are considered best-in-class for their cyber programs. Japan is ranked fifth in cyber defense; a welcome vote of confidence following a 2018 statement from then-Minister for Cybersecurity Yoshitaka Sakurada that he’d never used a computer. A recent announcement from the Singapore government pledged a $50 million investment in AI and cybersecurity research in future communications infrastructure, a forward-thinking move to solidify digital safety and integrity.
A strong, coordinated global cybersecurity response is vital as we rapidly progress into future tech, and every government body should illuminate it as a key focus.
More money doesn’t mean fewer problems
If we take the United States, United Kingdom, and Australia as examples, all of whom increased investment in government-led cybersecurity and expertise in the past couple of years, it may seem as though security is finally a priority, and the “good guys” are getting what they need to win the battle.
It certainly helps, but it’s only part of the bigger picture. That funding can buy super teams of experts (as has happened with Biden’s cash injection), comprehensive bug-bounty programs, and top-notch incident response and mitigation in the event of disastrous breaches, and it’s this approach to cyber defense that ensures we’ll still make minimal progress, no matter how much money is thrown at task forces and threat response.
Every government needs to look beyond reactive security measures, and sink some serious effort (and funding) into a more preventative strategy. If the focus remains on reacting to successful cyberattacks instead of working to prevent them in the first place, no amount of money will drive down growing risk. A genuine, proactive security approach would see budget allocated to infrastructure hardening, and rolling out effective security training and upskilling with the aim of reducing the attack surface as much as possible right from the start.
The cybersecurity skills gap may never close, but there is wasted potential
Highly trained, specialist security personnel are in huge demand all over the world, and it’s unlikely we will ever see a glut of those cyber gurus. However, this is all the more reason for governments and organizations alike to start getting creative, and savvier with the resources at their disposal.
A truly preventative approach to cyber defense starts with every person involved in the software development and infrastructure process being as security-aware as possible for their role. Developers, in particular, need the right security upskilling and right-fit tools for the job, so that secure coding can be intrinsic to their process. This goes a long way in ensuring that common vulnerabilities can be addressed before they ever see the light of day. This alone is a powerful - not to mention cheaper - step that reduces pressure and rework further down the software development lifecycle.
We need to reinforce a human-led approach to cybersecurity best practices, and it’s going to get better results than a heavy reliance on automation, tools, and reaction to problems that have already been embedded and discovered - a strategy that is clearly not working if we look at the number of breaches happening today.
Click on the link below and download the PDF of this resource.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
View reportBook a demoMatias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
A version of this article appeared in VMblog. It has been updated and syndicated here.
It seems that no matter how many Cybersecurity Awareness Months roll by, how many elite security professionals are parachuted in, or how much money is lost into a black hole, the issue of big data breaches just gets worse year-on-year. They’re so regular that they barely make the mainstream news these days, short of them being catastrophic. In 2020, more than 36 billion records were exposed in malicious cyberattacks, and we lay in wait to see how many will be harvested in 2021.
Threat actors are constantly scanning for opportunities, and while not every attack is a disaster, they occur on average, every 39 seconds. We’re not even close to winning the fight, and the bad guys have a huge advantage over the defenders of our data.
However, it seems change is in the air, with the Biden administration making cybersecurity an early priority in his term, to the tune of an extra US $10B in funding. This is, without question, a step in the right direction, but will this actually make a dent in cybercrime that is escalating in frequency and sophistication?
Cyber threats will take a (global) village to solve
Effective defense against increasingly potent cyberattacks cannot be the remit of just a handful of countries, and unfortunately, a cohesive strategy has been lacking across the board for a long time. However, with nation-state threats on the rise, many governments are sitting up and taking notice.
The SolarWinds attack affecting the US government was a clear warning of what is possible, and an indicator of the potential devastation if any critical infrastructure was breached. Recently, the FBI issued a warning that a Florida water system was attacked, with the threat actor able to contaminate the water supply remotely. They were stopped before serious damage was realized, but a more advanced attacker could have caused destruction on a massive scale that would put lives at risk.
Slowly, but surely, governments around the world are investing more in cyber defense. The UK made record investments in the cybersecurity sector, and established a new task force. Australia beefed up its cybersecurity strategy (especially for infrastructure), and places like Israel and Denmark are considered best-in-class for their cyber programs. Japan is ranked fifth in cyber defense; a welcome vote of confidence following a 2018 statement from then-Minister for Cybersecurity Yoshitaka Sakurada that he’d never used a computer. A recent announcement from the Singapore government pledged a $50 million investment in AI and cybersecurity research in future communications infrastructure, a forward-thinking move to solidify digital safety and integrity.
A strong, coordinated global cybersecurity response is vital as we rapidly progress into future tech, and every government body should illuminate it as a key focus.
More money doesn’t mean fewer problems
If we take the United States, United Kingdom, and Australia as examples, all of whom increased investment in government-led cybersecurity and expertise in the past couple of years, it may seem as though security is finally a priority, and the “good guys” are getting what they need to win the battle.
It certainly helps, but it’s only part of the bigger picture. That funding can buy super teams of experts (as has happened with Biden’s cash injection), comprehensive bug-bounty programs, and top-notch incident response and mitigation in the event of disastrous breaches, and it’s this approach to cyber defense that ensures we’ll still make minimal progress, no matter how much money is thrown at task forces and threat response.
Every government needs to look beyond reactive security measures, and sink some serious effort (and funding) into a more preventative strategy. If the focus remains on reacting to successful cyberattacks instead of working to prevent them in the first place, no amount of money will drive down growing risk. A genuine, proactive security approach would see budget allocated to infrastructure hardening, and rolling out effective security training and upskilling with the aim of reducing the attack surface as much as possible right from the start.
The cybersecurity skills gap may never close, but there is wasted potential
Highly trained, specialist security personnel are in huge demand all over the world, and it’s unlikely we will ever see a glut of those cyber gurus. However, this is all the more reason for governments and organizations alike to start getting creative, and savvier with the resources at their disposal.
A truly preventative approach to cyber defense starts with every person involved in the software development and infrastructure process being as security-aware as possible for their role. Developers, in particular, need the right security upskilling and right-fit tools for the job, so that secure coding can be intrinsic to their process. This goes a long way in ensuring that common vulnerabilities can be addressed before they ever see the light of day. This alone is a powerful - not to mention cheaper - step that reduces pressure and rework further down the software development lifecycle.
We need to reinforce a human-led approach to cybersecurity best practices, and it’s going to get better results than a heavy reliance on automation, tools, and reaction to problems that have already been embedded and discovered - a strategy that is clearly not working if we look at the number of breaches happening today.
Table of contents
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demoDownloadResources to get you started
Resources to get you started
OWASP Top 10 For LLM Applications: What’s New, Changed, and How to Stay Secure
Stay ahead in securing LLM applications with the latest OWASP Top 10 updates. Discover what's new, what’s changed, and how Secure Code Warrior equips you with up-to-date learning resources to mitigate risks in Generative AI.
Trust Score Reveals the Value of Secure-by-Design Upskilling Initiatives
Our research has shown that secure code training works. Trust Score, using an algorithm drawing on more than 20 million learning data points from work by more than 250,000 learners at over 600 organizations, reveals its effectiveness in driving down vulnerabilities and how to make the initiative even more effective.
Reactive Versus Preventive Security: Prevention Is a Better Cure
The idea of bringing preventive security to legacy code and systems at the same time as newer applications can seem daunting, but a Secure-by-Design approach, enforced by upskilling developers, can apply security best practices to those systems. It’s the best chance many organizations have of improving their security postures.
The Benefits of Benchmarking Security Skills for Developers
The growing focus on secure code and Secure-by-Design principles requires developers to be trained in cybersecurity from the start of the SDLC, with tools like Secure Code Warrior’s Trust Score helping measure and improve their progress.