UnDisruptable27 Newsletter: Is Secure-By-Design too late for Lifeline Functions? What can be done, for whom, by when?

Dear Fellow Protectors,

Is it too late for secure-by-design? That provocative question was at the heart of Josh’s presentation at the RSAC Conference this year. In a mock debate with Lauren Zabierek, one of the former leads for the Secure-by-Design program at CISA, Josh took the position that projects like U27 and its embrace of  INL’s Cyber-Informed Engineering approach may be the only realistic ways to shore up lifeline sectors in the immediate future—especially for the majority Have Nots.

At U27, we believe that society is too dependent on undependable technology. One way to address this challenge is to make technology more dependable. That’s a key goal of the Secure-by-Design movement, which aims to ensure security considerations are baked into products, not bolted on after the fact.

However, there are two core problems with Secure-by-Design in the lifeline sector context. The first is capacity. When you’re what Josh calls “Target Rich, but Cyber Poor” and you are operating at or below the “Security Poverty Line,” as our friend Wendy Nather says, rolling out the safest available technology and fixes may be out of reach. Not only are the changes often more than owners and operators can shoulder, the service providers they depend upon may not be willing or able to assist without changes to existing contracts.

The other challenge is “legacy” and technical debt. It would be one thing if a one-time infusion of resources could help migrate utilities or hospitals from their current systems to more secure-by-design ones. But, in most cases, the systems today aren’t current. When it comes to operational technology, they may be decades old—and replacement is much more complicated than just buying a new software license.

Where we are out of time for more dependable technologies, our approach starts with adding in resilience first, relying more heavily on consequence reduction and on off-network engineering solutions, reducing elective connectivity, and practicing manual operations in the event of unexpected downtime. Where such solutions can be applied, like pressure sensor arrestors for a water system, they’re almost always quicker and cheaper than a complete tech stack refresh. As conflicts continue to rage around the world, one thing we don’t have is the luxury of time. U27 is ready to meet the moment today.

Of course, the twist in Josh’s presentation was that you really need both. Maybe the best time to have done secure-by-design was 16 years ago, when Josh published the Rugged Software Manifesto (or even 40+ years ago during the Therac-25 losses of life). The next-best time for Secure-by-Demand… is today.

Thank you to those of you who joined us at RSAC for the first version of this debate and the framework! To continue the conversation, we’ve invited Lauren & CISA to build upon it this June in DC! Thought-provoking conversations are our stock-in-trade at the Critical Effect conference, which is just eight weeks away! Register now to join us in Washington, DC, June 17-18 and hear from protectors and policymakers about how to supercharge our efforts to keep our communities safe. And, as ever, join us on the U27 Slack channel or nominate a community to join the pilot!