This month we learned that a US maritime base had to be taken offline for more than 30 hours because of a ransomware attack that interrupted cameras, doors, and critical monitoring systems. It’s not the first such attack, and it’s most definitely not the last.
Following it will be the usual drumbeat: a call for more cyber hygiene. Cyber hygiene was last decade’s elixir for protecting against all cyber incidents, from Ring camera hacks to ransomware. It appeared in congressional testimonies, policy documents, and countless websites—16 million when I last searched.
But, judging from the continuing news of breaches and calls for more of it, it appears we never have enough of it. Or do we?
The answer to this question is actually hard to find. The reason being that no website tells you how much cyber hygiene you need, or whether you have enough.
Most begin by comparing cyber hygiene to personal hygiene—the cyber equivalent of washing your hands—to dole out some "always do this" advice—such as always use long, complex passwords (with uppercase and non-alphabetic characters) to ensure cyber safety. Herein lies the problem, and the reason why we haven't achieved cyber hygiene yet.
The fact is that cyber hygiene is nothing like personal hygiene. Over the centuries, our bodies have evolved outer and inner defenses, from hair and skin to white blood cells. This is why we can fend off all manner of germs, despite the fact that everyone from healthcare professionals to food service workers inadequately wash their hands.
In contrast, the components of computers are dumb circuits, many with flaws and without protections. In 2018, we learnt of defects in every computer chip manufactured in the last two decades and there are many more vulnerabilities in the external sensory organs of computers (keyboard, camera, microphone), and in applications and operating systems.
Any of these can be compromised using malware deployed in spear phishing emails, and all it takes is a single inadvertent click on the email to cripple an entire corporation. Cyber hygiene doesn't afford us the same room for error that personal hygiene does.
It gets worse: while there is little bad that can come from hand-washing, blindly following a cyber hygiene best practice can be harmful to your cyber health. For instance, many users are told to look for SSL icons (the green padlock) on their browsers next to a website's name to assess its veracity, but aren't told that many phishing websites - two out of three is a recent survey - also possess these icons.
Many such purported best practices are poorly developed, often without considering their real-world use environments. Such was the case with the 2004 NIST guideline advocating complex passwords, which was based on how easy it was for computers to crack them rather than how people remembered passwords. Users, constantly bombarded with password change requests, began reusing passwords and became accustomed to getting password change requests—something that hackers mimicked in spearphishing attacks.
The NIST guidelines were reversed in 2017, but by then countless compromises were likely caused by it. We cannot afford another decade of such missteps.
To begin, we have to stop espousing broad cyber hygiene best practice suggestions without testing their need and efficacy in real user environments.
Second, we need to move away from asking people to just do things that keep them safe to explaining why. Be it two-factor authentication or the application of software patches, every best practice has its limits and can be a conduit for compromise, and users must be informed of these.
Third, we need to reorient our fundamental view of cyber hygiene. One area that can serve as a model is Operational Security (OPSEC), a methodology developed by the US military during the Vietnam War to protect critical information from getting into the hands of the adversary. OPSEC helps users assess which information is critical based on what it could reveal, and then instructs users on ways to protect it.
Some of these principles are readily applicable in areas such as election security, where the US military is already training state and local officials. We can apply the same process for our cyber safety, moving away from following broad cyber hygiene guidelines to focused practices designed to protect critical personal information.
Finally, we must stop doling out cyber hygiene advice without measuring who needs it or how much of it they need. Recent user research has developed a Cyber Hygiene Inventory, a 20-question survey that measures different facets of user cyber hygiene and provides users with a 0–100 cyber hygiene score. The score can be used as a baseline to assess how much cyber hygiene users across an organization or even a region need and track how well they have progressed towards acquiring it.
If the last presidential elections taught us anything, it is that cyber security is intrinsically linked to the functioning of our democracy. In 2020, let's resolve to stop asking for more cyber hygiene and start working towards everyone finally having it.