A cyberattack occurs every 39 seconds. Is the government finally equipped to fight back?
A version of this article appeared in VMblog. It has been updated and syndicated here.
It seems that no matter how many Cybersecurity Awareness Months roll by, how many elite security professionals are parachuted in, or how much money is lost into a black hole, the issue of big data breaches just gets worse year-on-year. They’re so regular that they barely make the mainstream news these days, short of them being catastrophic. In 2020, more than 36 billion records were exposed in malicious cyberattacks, and we lay in wait to see how many will be harvested in 2021.
Threat actors are constantly scanning for opportunities, and while not every attack is a disaster, they occur on average, every 39 seconds. We’re not even close to winning the fight, and the bad guys have a huge advantage over the defenders of our data.
However, it seems change is in the air, with the Biden administration making cybersecurity an early priority in his term, to the tune of an extra US $10B in funding. This is, without question, a step in the right direction, but will this actually make a dent in cybercrime that is escalating in frequency and sophistication?
Cyber threats will take a (global) village to solve
Effective defense against increasingly potent cyberattacks cannot be the remit of just a handful of countries, and unfortunately, a cohesive strategy has been lacking across the board for a long time. However, with nation-state threats on the rise, many governments are sitting up and taking notice.
The SolarWinds attack affecting the US government was a clear warning of what is possible, and an indicator of the potential devastation if any critical infrastructure was breached. Recently, the FBI issued a warning that a Florida water system was attacked, with the threat actor able to contaminate the water supply remotely. They were stopped before serious damage was realized, but a more advanced attacker could have caused destruction on a massive scale that would put lives at risk.
Slowly, but surely, governments around the world are investing more in cyber defense. The UK made record investments in the cybersecurity sector, and established a new task force. Australia beefed up its cybersecurity strategy (especially for infrastructure), and places like Israel and Denmark are considered best-in-class for their cyber programs. Japan is ranked fifth in cyber defense; a welcome vote of confidence following a 2018 statement from then-Minister for Cybersecurity Yoshitaka Sakurada that he’d never used a computer. A recent announcement from the Singapore government pledged a $50 million investment in AI and cybersecurity research in future communications infrastructure, a forward-thinking move to solidify digital safety and integrity.
A strong, coordinated global cybersecurity response is vital as we rapidly progress into future tech, and every government body should illuminate it as a key focus.
More money doesn’t mean fewer problems
If we take the United States, United Kingdom, and Australia as examples, all of whom increased investment in government-led cybersecurity and expertise in the past couple of years, it may seem as though security is finally a priority, and the “good guys” are getting what they need to win the battle.
It certainly helps, but it’s only part of the bigger picture. That funding can buy super teams of experts (as has happened with Biden’s cash injection), comprehensive bug-bounty programs, and top-notch incident response and mitigation in the event of disastrous breaches, and it’s this approach to cyber defense that ensures we’ll still make minimal progress, no matter how much money is thrown at task forces and threat response.
Every government needs to look beyond reactive security measures, and sink some serious effort (and funding) into a more preventative strategy. If the focus remains on reacting to successful cyberattacks instead of working to prevent them in the first place, no amount of money will drive down growing risk. A genuine, proactive security approach would see budget allocated to infrastructure hardening, and rolling out effective security training and upskilling with the aim of reducing the attack surface as much as possible right from the start.
The cybersecurity skills gap may never close, but there is wasted potential
Highly trained, specialist security personnel are in huge demand all over the world, and it’s unlikely we will ever see a glut of those cyber gurus. However, this is all the more reason for governments and organizations alike to start getting creative, and savvier with the resources at their disposal.
A truly preventative approach to cyber defense starts with every person involved in the software development and infrastructure process being as security-aware as possible for their role. Developers, in particular, need the right security upskilling and right-fit tools for the job, so that secure coding can be intrinsic to their process. This goes a long way in ensuring that common vulnerabilities can be addressed before they ever see the light of day. This alone is a powerful - not to mention cheaper - step that reduces pressure and rework further down the software development lifecycle.
We need to reinforce a human-led approach to cybersecurity best practices, and it’s going to get better results than a heavy reliance on automation, tools, and reaction to problems that have already been embedded and discovered - a strategy that is clearly not working if we look at the number of breaches happening today.
We need to reinforce a human-led approach to cybersecurity best practices, and it’s going to get better results than a heavy reliance on automation, tools, and reaction to problems that have already been embedded and discovered.
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demo
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
A version of this article appeared in VMblog. It has been updated and syndicated here.
It seems that no matter how many Cybersecurity Awareness Months roll by, how many elite security professionals are parachuted in, or how much money is lost into a black hole, the issue of big data breaches just gets worse year-on-year. They’re so regular that they barely make the mainstream news these days, short of them being catastrophic. In 2020, more than 36 billion records were exposed in malicious cyberattacks, and we lay in wait to see how many will be harvested in 2021.
Threat actors are constantly scanning for opportunities, and while not every attack is a disaster, they occur on average, every 39 seconds. We’re not even close to winning the fight, and the bad guys have a huge advantage over the defenders of our data.
However, it seems change is in the air, with the Biden administration making cybersecurity an early priority in his term, to the tune of an extra US $10B in funding. This is, without question, a step in the right direction, but will this actually make a dent in cybercrime that is escalating in frequency and sophistication?
Cyber threats will take a (global) village to solve
Effective defense against increasingly potent cyberattacks cannot be the remit of just a handful of countries, and unfortunately, a cohesive strategy has been lacking across the board for a long time. However, with nation-state threats on the rise, many governments are sitting up and taking notice.
The SolarWinds attack affecting the US government was a clear warning of what is possible, and an indicator of the potential devastation if any critical infrastructure was breached. Recently, the FBI issued a warning that a Florida water system was attacked, with the threat actor able to contaminate the water supply remotely. They were stopped before serious damage was realized, but a more advanced attacker could have caused destruction on a massive scale that would put lives at risk.
Slowly, but surely, governments around the world are investing more in cyber defense. The UK made record investments in the cybersecurity sector, and established a new task force. Australia beefed up its cybersecurity strategy (especially for infrastructure), and places like Israel and Denmark are considered best-in-class for their cyber programs. Japan is ranked fifth in cyber defense; a welcome vote of confidence following a 2018 statement from then-Minister for Cybersecurity Yoshitaka Sakurada that he’d never used a computer. A recent announcement from the Singapore government pledged a $50 million investment in AI and cybersecurity research in future communications infrastructure, a forward-thinking move to solidify digital safety and integrity.
A strong, coordinated global cybersecurity response is vital as we rapidly progress into future tech, and every government body should illuminate it as a key focus.
More money doesn’t mean fewer problems
If we take the United States, United Kingdom, and Australia as examples, all of whom increased investment in government-led cybersecurity and expertise in the past couple of years, it may seem as though security is finally a priority, and the “good guys” are getting what they need to win the battle.
It certainly helps, but it’s only part of the bigger picture. That funding can buy super teams of experts (as has happened with Biden’s cash injection), comprehensive bug-bounty programs, and top-notch incident response and mitigation in the event of disastrous breaches, and it’s this approach to cyber defense that ensures we’ll still make minimal progress, no matter how much money is thrown at task forces and threat response.
Every government needs to look beyond reactive security measures, and sink some serious effort (and funding) into a more preventative strategy. If the focus remains on reacting to successful cyberattacks instead of working to prevent them in the first place, no amount of money will drive down growing risk. A genuine, proactive security approach would see budget allocated to infrastructure hardening, and rolling out effective security training and upskilling with the aim of reducing the attack surface as much as possible right from the start.
The cybersecurity skills gap may never close, but there is wasted potential
Highly trained, specialist security personnel are in huge demand all over the world, and it’s unlikely we will ever see a glut of those cyber gurus. However, this is all the more reason for governments and organizations alike to start getting creative, and savvier with the resources at their disposal.
A truly preventative approach to cyber defense starts with every person involved in the software development and infrastructure process being as security-aware as possible for their role. Developers, in particular, need the right security upskilling and right-fit tools for the job, so that secure coding can be intrinsic to their process. This goes a long way in ensuring that common vulnerabilities can be addressed before they ever see the light of day. This alone is a powerful - not to mention cheaper - step that reduces pressure and rework further down the software development lifecycle.
We need to reinforce a human-led approach to cybersecurity best practices, and it’s going to get better results than a heavy reliance on automation, tools, and reaction to problems that have already been embedded and discovered - a strategy that is clearly not working if we look at the number of breaches happening today.
A version of this article appeared in VMblog. It has been updated and syndicated here.
It seems that no matter how many Cybersecurity Awareness Months roll by, how many elite security professionals are parachuted in, or how much money is lost into a black hole, the issue of big data breaches just gets worse year-on-year. They’re so regular that they barely make the mainstream news these days, short of them being catastrophic. In 2020, more than 36 billion records were exposed in malicious cyberattacks, and we lay in wait to see how many will be harvested in 2021.
Threat actors are constantly scanning for opportunities, and while not every attack is a disaster, they occur on average, every 39 seconds. We’re not even close to winning the fight, and the bad guys have a huge advantage over the defenders of our data.
However, it seems change is in the air, with the Biden administration making cybersecurity an early priority in his term, to the tune of an extra US $10B in funding. This is, without question, a step in the right direction, but will this actually make a dent in cybercrime that is escalating in frequency and sophistication?
Cyber threats will take a (global) village to solve
Effective defense against increasingly potent cyberattacks cannot be the remit of just a handful of countries, and unfortunately, a cohesive strategy has been lacking across the board for a long time. However, with nation-state threats on the rise, many governments are sitting up and taking notice.
The SolarWinds attack affecting the US government was a clear warning of what is possible, and an indicator of the potential devastation if any critical infrastructure was breached. Recently, the FBI issued a warning that a Florida water system was attacked, with the threat actor able to contaminate the water supply remotely. They were stopped before serious damage was realized, but a more advanced attacker could have caused destruction on a massive scale that would put lives at risk.
Slowly, but surely, governments around the world are investing more in cyber defense. The UK made record investments in the cybersecurity sector, and established a new task force. Australia beefed up its cybersecurity strategy (especially for infrastructure), and places like Israel and Denmark are considered best-in-class for their cyber programs. Japan is ranked fifth in cyber defense; a welcome vote of confidence following a 2018 statement from then-Minister for Cybersecurity Yoshitaka Sakurada that he’d never used a computer. A recent announcement from the Singapore government pledged a $50 million investment in AI and cybersecurity research in future communications infrastructure, a forward-thinking move to solidify digital safety and integrity.
A strong, coordinated global cybersecurity response is vital as we rapidly progress into future tech, and every government body should illuminate it as a key focus.
More money doesn’t mean fewer problems
If we take the United States, United Kingdom, and Australia as examples, all of whom increased investment in government-led cybersecurity and expertise in the past couple of years, it may seem as though security is finally a priority, and the “good guys” are getting what they need to win the battle.
It certainly helps, but it’s only part of the bigger picture. That funding can buy super teams of experts (as has happened with Biden’s cash injection), comprehensive bug-bounty programs, and top-notch incident response and mitigation in the event of disastrous breaches, and it’s this approach to cyber defense that ensures we’ll still make minimal progress, no matter how much money is thrown at task forces and threat response.
Every government needs to look beyond reactive security measures, and sink some serious effort (and funding) into a more preventative strategy. If the focus remains on reacting to successful cyberattacks instead of working to prevent them in the first place, no amount of money will drive down growing risk. A genuine, proactive security approach would see budget allocated to infrastructure hardening, and rolling out effective security training and upskilling with the aim of reducing the attack surface as much as possible right from the start.
The cybersecurity skills gap may never close, but there is wasted potential
Highly trained, specialist security personnel are in huge demand all over the world, and it’s unlikely we will ever see a glut of those cyber gurus. However, this is all the more reason for governments and organizations alike to start getting creative, and savvier with the resources at their disposal.
A truly preventative approach to cyber defense starts with every person involved in the software development and infrastructure process being as security-aware as possible for their role. Developers, in particular, need the right security upskilling and right-fit tools for the job, so that secure coding can be intrinsic to their process. This goes a long way in ensuring that common vulnerabilities can be addressed before they ever see the light of day. This alone is a powerful - not to mention cheaper - step that reduces pressure and rework further down the software development lifecycle.
We need to reinforce a human-led approach to cybersecurity best practices, and it’s going to get better results than a heavy reliance on automation, tools, and reaction to problems that have already been embedded and discovered - a strategy that is clearly not working if we look at the number of breaches happening today.
Click on the link below and download the PDF of this resource.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
View reportBook a demo
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Matias is a researcher and developer with more than 15 years of hands-on software security experience. He has developed solutions for companies such as Fortify Software and his own company Sensei Security. Over his career, Matias has led multiple application security research projects which have led to commercial products and boasts over 10 patents under his belt. When he is away from his desk, Matias has served as an instructor for advanced application security training courses and regularly speaks at global conferences including RSA Conference, Black Hat, DefCon, BSIMM, OWASP AppSec and BruCon.
Matias holds a Ph.D. in Computer Engineering from Ghent University, where he studied application security through program obfuscation to hide the inner workings of an application.
A version of this article appeared in VMblog. It has been updated and syndicated here.
It seems that no matter how many Cybersecurity Awareness Months roll by, how many elite security professionals are parachuted in, or how much money is lost into a black hole, the issue of big data breaches just gets worse year-on-year. They’re so regular that they barely make the mainstream news these days, short of them being catastrophic. In 2020, more than 36 billion records were exposed in malicious cyberattacks, and we lay in wait to see how many will be harvested in 2021.
Threat actors are constantly scanning for opportunities, and while not every attack is a disaster, they occur on average, every 39 seconds. We’re not even close to winning the fight, and the bad guys have a huge advantage over the defenders of our data.
However, it seems change is in the air, with the Biden administration making cybersecurity an early priority in his term, to the tune of an extra US $10B in funding. This is, without question, a step in the right direction, but will this actually make a dent in cybercrime that is escalating in frequency and sophistication?
Cyber threats will take a (global) village to solve
Effective defense against increasingly potent cyberattacks cannot be the remit of just a handful of countries, and unfortunately, a cohesive strategy has been lacking across the board for a long time. However, with nation-state threats on the rise, many governments are sitting up and taking notice.
The SolarWinds attack affecting the US government was a clear warning of what is possible, and an indicator of the potential devastation if any critical infrastructure was breached. Recently, the FBI issued a warning that a Florida water system was attacked, with the threat actor able to contaminate the water supply remotely. They were stopped before serious damage was realized, but a more advanced attacker could have caused destruction on a massive scale that would put lives at risk.
Slowly, but surely, governments around the world are investing more in cyber defense. The UK made record investments in the cybersecurity sector, and established a new task force. Australia beefed up its cybersecurity strategy (especially for infrastructure), and places like Israel and Denmark are considered best-in-class for their cyber programs. Japan is ranked fifth in cyber defense; a welcome vote of confidence following a 2018 statement from then-Minister for Cybersecurity Yoshitaka Sakurada that he’d never used a computer. A recent announcement from the Singapore government pledged a $50 million investment in AI and cybersecurity research in future communications infrastructure, a forward-thinking move to solidify digital safety and integrity.
A strong, coordinated global cybersecurity response is vital as we rapidly progress into future tech, and every government body should illuminate it as a key focus.
More money doesn’t mean fewer problems
If we take the United States, United Kingdom, and Australia as examples, all of whom increased investment in government-led cybersecurity and expertise in the past couple of years, it may seem as though security is finally a priority, and the “good guys” are getting what they need to win the battle.
It certainly helps, but it’s only part of the bigger picture. That funding can buy super teams of experts (as has happened with Biden’s cash injection), comprehensive bug-bounty programs, and top-notch incident response and mitigation in the event of disastrous breaches, and it’s this approach to cyber defense that ensures we’ll still make minimal progress, no matter how much money is thrown at task forces and threat response.
Every government needs to look beyond reactive security measures, and sink some serious effort (and funding) into a more preventative strategy. If the focus remains on reacting to successful cyberattacks instead of working to prevent them in the first place, no amount of money will drive down growing risk. A genuine, proactive security approach would see budget allocated to infrastructure hardening, and rolling out effective security training and upskilling with the aim of reducing the attack surface as much as possible right from the start.
The cybersecurity skills gap may never close, but there is wasted potential
Highly trained, specialist security personnel are in huge demand all over the world, and it’s unlikely we will ever see a glut of those cyber gurus. However, this is all the more reason for governments and organizations alike to start getting creative, and savvier with the resources at their disposal.
A truly preventative approach to cyber defense starts with every person involved in the software development and infrastructure process being as security-aware as possible for their role. Developers, in particular, need the right security upskilling and right-fit tools for the job, so that secure coding can be intrinsic to their process. This goes a long way in ensuring that common vulnerabilities can be addressed before they ever see the light of day. This alone is a powerful - not to mention cheaper - step that reduces pressure and rework further down the software development lifecycle.
We need to reinforce a human-led approach to cybersecurity best practices, and it’s going to get better results than a heavy reliance on automation, tools, and reaction to problems that have already been embedded and discovered - a strategy that is clearly not working if we look at the number of breaches happening today.
Table of contents
Matias Madou, Ph.D. is a security expert, researcher, and CTO and co-founder of Secure Code Warrior. Matias obtained his Ph.D. in Application Security from Ghent University, focusing on static analysis solutions. He later joined Fortify in the US, where he realized that it was insufficient to solely detect code problems without aiding developers in writing secure code. This inspired him to develop products that assist developers, alleviate the burden of security, and exceed customers' expectations. When he is not at his desk as part of Team Awesome, he enjoys being on stage presenting at conferences including RSA Conference, BlackHat and DefCon.
Secure Code Warrior is here for your organization to help you secure code across the entire software development lifecycle and create a culture in which cybersecurity is top of mind. Whether you’re an AppSec Manager, Developer, CISO, or anyone involved in security, we can help your organization reduce risks associated with insecure code.
Book a demoDownloadResources to get you started
Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise
The Secure-by-Design movement is the future of secure software development. Learn about the key elements companies need to keep in mind when they think about a Secure-by-Design initiative.
DigitalOcean Decreases Security Debt with Secure Code Warrior
DigitalOcean's use of Secure Code Warrior training has significantly reduced security debt, allowing teams to focus more on innovation and productivity. The improved security has strengthened their product quality and competitive edge. Looking ahead, the SCW Trust Score will help them further enhance security practices and continue driving innovation.
Resources to get you started
The Benefits of Benchmarking Security Skills for Developers
The growing focus on secure code and Secure-by-Design principles requires developers to be trained in cybersecurity from the start of the SDLC, with tools like Secure Code Warrior’s Trust Score helping measure and improve their progress.
Driving Meaningful Success for Enterprise Secure-by-Design Initiatives
Our latest research paper, Benchmarking Security Skills: Streamlining Secure-by-Design in the Enterprise is the result of deep analysis of real Secure-by-Design initiatives at the enterprise level, and deriving best practice approaches based on data-driven findings.
Deep Dive: Navigating the Critical CUPS Vulnerability in GNU-Linux Systems
Discover the latest security challenges facing Linux users as we explore recent high-severity vulnerabilities in the Common UNIX Printing System (CUPS). Learn how these issues may lead to potential Remote Code Execution (RCE) and what you can do to protect your systems.
Coders Conquer Security: Share & Learn - Cross-Site Scripting (XSS)
Cross-site scripting (XSS) uses the trust of browsers and ignorance of users to steal data, take over accounts, and deface websites; it's a vulnerability that can get very ugly, very quickly. Let's take a look at how XSS works, what damage can be done, and how to prevent it.
