As the U.S. faces China’s unprecedented military buildup, conflicts involving our partners in two theaters, and resurgent terror threats, it is clear that the world today is more dangerous than most Americans have experienced in their lifetimes.

Yet, as the U.S. Department of Defense pursues modernization programs to retain our competitive edge, we cannot afford to forget about vulnerabilities to the systems that the American people use every day. The cyber domain could make the difference between victory and defeat.

As the top Republican on the Senate Environment and Public Works Committee and a member of the Senate Appropriations Subcommittees on Defense and Homeland Security, I have a multifaceted view of the threats we face.

There is undoubtedly a DoD interest in the cyber security of our critical infrastructure — the expertise and readiness of our service members and their equipment can be undermined in the blink of an eye if their installations lose access to power or water while attempting to deploy.

Earlier this year, the Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Federal Bureau of Investigation (FBI) issued a joint advisorythat Chinese state sponsored cyber actors are pre-positioning themselves on U.S. networks to conduct destructive cyber attacks against our critical infrastructure in the event of a global crisis or conflict. According to their report, the Chinese state-sponsored group Volt Typhoon had persistent access to some U.S. critical infrastructure for up to five years.

RELATED

Further, an adversary attack against U.S. critical infrastructure during a conflict could affect the lives of everyday Americans severely enough to sway public opinion in opposition to U.S. military operations. These national security challenges under DoD’s purview are challenged by the fact that the majority of our nation’s critical infrastructure is owned and operated by the private sector.

It is evident to me from my leadership roles on the committees responsible for authorizing public works programs and funding homeland security initiatives that today’s national security issues demand increased synchronization with the state, local, and industry partners that administer our day-to-day functions.

I recently attended the groundbreaking ceremony for a new National Center of Excellence for Cyber Security in Critical Infrastructure, which will be housed in my home state of West Virginia at Marshall University.

This NCOE will break down the walls between the DoD, the Department of Homeland Security, academia, and industry to facilitate cooperation in identifying and tackling the cyber threats we face. As a partnership with United States Cyber Command’s Joint Force Headquarters-Department of Defense Information Network, as well as the National Guard, it also emphasizes a joint, operational perspective to the cyber problem set. Most importantly, it will serve as a hub for the curriculum and training of the U.S. cyber workforce necessary to defend our infrastructure—both in and out of uniform.

Cyber protection is not only a U.S. interagency, public-private challenge, but an allied problem set. I’m proud that West Virginia is also leading the way in bolstering the cyber security of our allies and partners as the host for the U.S. team in NATO’s Locked Shields Exercise.

Locked Shields is the world’s largest and most complex live-fire cyber exercise, featuring 40 countries and 3,000 participants throughout NATO member states. In Morgantown, West Virginia, nearly 200 United States, Norwegian, and Montenegrin players worked as a team in the simulated cyber defense of a NATO ally under attack—an all-too-realistic scenario that we must prepare for.

The United States remains a global superpower—one that can devote resources to military modernization programs while also improving interagency and public-private coordination right here at home to protect our most critical systems.

Our next fight won’t just take place in the air, on land, and at sea. Instead, it will take place in the space and cyber domains where boundaries are blurred and partnerships are key.

If done right, the NCOE will be a model for future national security challenges that extend beyond DoD jurisdiction in areas like the private sector, academia, and state and local. On the battlefields of today and tomorrow, even the most advanced militaries will be challenged by cyber threats. Breaking down the barriers now will help us win.

U.S. Senator Shelley Moore Capito (R-W.Va.) is a member of the Senate Defense Appropriations Subcommittee and serves as the Ranking Member of the Senate Environment and Public Works Committee. Capito also serves as the vice chairman of the Senate Republican Conference, the fifth ranking Republican in the U.S. Senate.

The current global landscape presents a heightened level of danger for the United States, with China's military expansion, conflicts involving partners in multiple regions, and resurgent terror threats. The U.S. Department of Defense is focusing on modernization programs to maintain a competitive edge, but it is crucial not to overlook vulnerabilities in everyday systems used by Americans, particularly in the cyber domain.

As a member of the Senate Environment and Public Works Committee and the Senate Appropriations Subcommittees on Defense and Homeland Security, I have a comprehensive understanding of the threats facing our nation. The cybersecurity of critical infrastructure is of utmost importance, as any disruption could severely impact military operations and endanger the lives of Americans.

Recent advisories from cybersecurity agencies have highlighted the threat of Chinese state-sponsored cyber actors targeting U.S. networks for potential destructive attacks. The majority of critical infrastructure in the U.S. is owned and operated by the private sector, making collaboration with industry partners essential for national security.

To address these challenges, a new National Center of Excellence for Cyber Security in Critical Infrastructure is being established at Marshall University in West Virginia. This center will facilitate cooperation between government agencies, academia, and industry to tackle cyber threats effectively and train a skilled cyber workforce.

Cyber protection is not just a domestic challenge but also a global issue. West Virginia is taking a leading role in enhancing cybersecurity for allies and partners through participation in NATO's Locked Shields Exercise, the world's largest live-fire cyber exercise involving multiple countries.

As we navigate the evolving landscape of national security threats, it is crucial to strengthen interagency and public-private coordination to safeguard critical systems. By breaking down barriers and fostering partnerships, we can better prepare for future challenges in the cyber domain and ensure the security of our nation and its allies.

Geoffrey Mattson is the CEO of Xage Security.

Companies have realized that good (or better yet, delightful) user experience (UX) is a powerful differentiator that can help to attract and retain users. As a result, users have grown to appreciate and expect this level of usability from all technologies they use.

It was only a matter of time before people would start asking themselves why the technologies they use at work—especially cybersecurity solutions—aren't keeping up.

Why Usability Is A Security Issue

The cybersecurity industry has been regrettably slow to focus on usability. Our technology is often regarded as “expert.” Read between the lines and you realize that means complex and difficult to use.

Part of this concern can be attributed to the extremely well-documented talent shortage in our industry. On the customer side, this means there are not enough employees to manage the complex technologies that they’ve purchased to keep them safe from cyberattacks. On the technology vendor side, this means there’s a low chance that your solution will be used to its full potential—which can lead to churn, or worse, breach on your watch.

Security gaps start to appear when people start going off-book. The complexity and disconnected nature of security practices end up causing friction for everyday employees just trying to get their jobs done.

When it comes to choosing between complying with company policy or, for example, spending more time with their kids, most people will choose the latter. Everyday users—including administrators and end users—will seek the path of least resistance. In many cases, this will include out-of-policy workarounds that jeopardize enterprise security.

For instance, an employee of an oil company might realize they can purchase an internet hotspot to remotely access a pipeline in the heart of Texas rather than make the lengthy journey in person. While there’s no doubt this would be more convenient for the employee, it will open up their system to potential risks by exposing the site to the internet in an insecure manner.

Conversely, if it were easy to remotely access this site securely, the user wouldn’t need to get creative. They would simply follow the path that was presented to them and remain within policy.

It’s time to start acknowledging that usability is a security issue and that poor user experience makes enterprises more vulnerable to attack.

Understanding The Tech Stack Toolbox

According to Verizon, 68% of all breaches include the human element, with people being involved via error, phishing or social engineering. Training people not to click on phishing links isn’t enough to address the human challenge. We have to make it easy for them to follow best practices, like using secure passwords and multi-factor authentication (MFA). Vendors have a responsibility to do better, and companies should seek out security solutions that prioritize usability.

Consolidating cybersecurity tools can also streamline security operations and reduce complexity for administrators. This approach can also lead to significant cost and time savings for organizations and simplify the implementation and demonstration of compliance with regulatory requirements, providing a single interface for users across operational technology (OT), information technology (IT) and cloud environments.

While selecting tools, organizations should do a “taste test” of the solutions they are considering. Which solution brings users the most delight? Which is the easiest to use? Involving end users in the selection process, testing different tools and adopting the one they prefer is critical for the adoption of those tools.

This approach doesn’t just gain buy-in; it boosts user satisfaction and ensures they feel vested in the tool's success. In turn, all of this enhances the organization’s security posture.

Administrators And User Experience

Usability isn’t just about end users, either. Administrators and operators are the keystone to the success of any tool. Yet, these users are overwhelmed with complex, noisy and often partially deployed technologies.

Your average cybersecurity practice is littered with fragmented and disjointed solutions. While defense-in-depth can be important strategic decisions, there’s a fine line between redundancy and needless complexity, especially when the tooling introduces high risk and high costs simply because it’s outdated. Reducing the workload enables administrators to focus on managing a single, robust solution, increasing efficiency and productivity by minimizing time spent troubleshooting and maintaining disparate systems.

Ease of deployment is also a crucial factor for the success of any security solution. "Shelfware" is an industry term describing tools so complex to deploy that teams prefer accepting sunk costs rather than investing more time and energy in rolling them out. Rapid rollout, ideally within days or weeks, is essential. Streamlining these processes is key to ensuring the implementation of security solutions and avoiding wasted investments.

Modern solutions should ease the burden of change by allowing organizations to keep existing infrastructure with minimal policy adjustments and no need for additional hiring. The ability to extend the lifespan of legacy systems that are still functional is crucial for enterprises that cannot afford to replace assets performing critical functions just because they pose a security risk.

Advancing Usability: Navigating The Future

While it may appear daunting to readjust a cybersecurity program, the imperative for change outweighs the inertia of maintaining the status quo. The risk of breach looms for those who resist change, making the effort to adapt far less painful in comparison.

Prioritizing usability across the entire spectrum of the cybersecurity tech stack, from administrative tasks to end-user activities, strengthens the overall practice and is the way forward to a more secure future.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?

Geoffrey Mattson, the CEO of Xage Security, discusses the importance of usability in cybersecurity solutions. Companies are realizing that providing a delightful user experience is crucial for attracting and retaining users. However, the cybersecurity industry has been slow to focus on usability, often creating complex and difficult-to-use technologies.

The lack of usability in cybersecurity solutions can lead to security gaps as users seek out-of-policy workarounds to make their jobs easier. This can expose enterprises to potential risks and vulnerabilities. It is essential to prioritize usability in security solutions to enhance overall security posture.

Verizon reports that 68% of all breaches involve the human element, highlighting the importance of making security practices easy for users to follow. Consolidating cybersecurity tools can streamline operations, reduce complexity, and save time and costs for organizations.

Administrators and operators also play a crucial role in the success of security tools. Simplifying deployment processes and reducing complexity can increase efficiency and productivity. Modern solutions should allow organizations to keep existing infrastructure while minimizing policy adjustments and additional hiring.

Prioritizing usability across the cybersecurity tech stack, from administrative tasks to end-user activities, is key to navigating the future of cybersecurity. Adapting to prioritize usability can strengthen overall security practices and lead to a more secure future.

Geoffrey Mattson is the CEO of Xage Security.

Companies have realized that good (or better yet, delightful) user experience (UX) is a powerful differentiator that can help to attract and retain users. As a result, users have grown to appreciate and expect this level of usability from all technologies they use.

It was only a matter of time before people would start asking themselves why the technologies they use at work—especially cybersecurity solutions—aren't keeping up.

Why Usability Is A Security Issue

The cybersecurity industry has been regrettably slow to focus on usability. Our technology is often regarded as “expert.” Read between the lines and you realize that means complex and difficult to use.

Part of this concern can be attributed to the extremely well-documented talent shortage in our industry. On the customer side, this means there are not enough employees to manage the complex technologies that they’ve purchased to keep them safe from cyberattacks. On the technology vendor side, this means there’s a low chance that your solution will be used to its full potential—which can lead to churn, or worse, breach on your watch.

Security gaps start to appear when people start going off-book. The complexity and disconnected nature of security practices end up causing friction for everyday employees just trying to get their jobs done.

When it comes to choosing between complying with company policy or, for example, spending more time with their kids, most people will choose the latter. Everyday users—including administrators and end users—will seek the path of least resistance. In many cases, this will include out-of-policy workarounds that jeopardize enterprise security.

For instance, an employee of an oil company might realize they can purchase an internet hotspot to remotely access a pipeline in the heart of Texas rather than make the lengthy journey in person. While there’s no doubt this would be more convenient for the employee, it will open up their system to potential risks by exposing the site to the internet in an insecure manner.

Conversely, if it were easy to remotely access this site securely, the user wouldn’t need to get creative. They would simply follow the path that was presented to them and remain within policy.

It’s time to start acknowledging that usability is a security issue and that poor user experience makes enterprises more vulnerable to attack.

Understanding The Tech Stack Toolbox

According to Verizon, 68% of all breaches include the human element, with people being involved via error, phishing or social engineering. Training people not to click on phishing links isn’t enough to address the human challenge. We have to make it easy for them to follow best practices, like using secure passwords and multi-factor authentication (MFA). Vendors have a responsibility to do better, and companies should seek out security solutions that prioritize usability.

Consolidating cybersecurity tools can also streamline security operations and reduce complexity for administrators. This approach can also lead to significant cost and time savings for organizations and simplify the implementation and demonstration of compliance with regulatory requirements, providing a single interface for users across operational technology (OT), information technology (IT) and cloud environments.

While selecting tools, organizations should do a “taste test” of the solutions they are considering. Which solution brings users the most delight? Which is the easiest to use? Involving end users in the selection process, testing different tools and adopting the one they prefer is critical for the adoption of those tools.

This approach doesn’t just gain buy-in; it boosts user satisfaction and ensures they feel vested in the tool's success. In turn, all of this enhances the organization’s security posture.

Administrators And User Experience

Usability isn’t just about end users, either. Administrators and operators are the keystone to the success of any tool. Yet, these users are overwhelmed with complex, noisy and often partially deployed technologies.

Your average cybersecurity practice is littered with fragmented and disjointed solutions. While defense-in-depth can be important strategic decisions, there’s a fine line between redundancy and needless complexity, especially when the tooling introduces high risk and high costs simply because it’s outdated. Reducing the workload enables administrators to focus on managing a single, robust solution, increasing efficiency and productivity by minimizing time spent troubleshooting and maintaining disparate systems.

Ease of deployment is also a crucial factor for the success of any security solution. "Shelfware" is an industry term describing tools so complex to deploy that teams prefer accepting sunk costs rather than investing more time and energy in rolling them out. Rapid rollout, ideally within days or weeks, is essential. Streamlining these processes is key to ensuring the implementation of security solutions and avoiding wasted investments.

Modern solutions should ease the burden of change by allowing organizations to keep existing infrastructure with minimal policy adjustments and no need for additional hiring. The ability to extend the lifespan of legacy systems that are still functional is crucial for enterprises that cannot afford to replace assets performing critical functions just because they pose a security risk.

Advancing Usability: Navigating The Future

While it may appear daunting to readjust a cybersecurity program, the imperative for change outweighs the inertia of maintaining the status quo. The risk of breach looms for those who resist change, making the effort to adapt far less painful in comparison.

Prioritizing usability across the entire spectrum of the cybersecurity tech stack, from administrative tasks to end-user activities, strengthens the overall practice and is the way forward to a more secure future.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?

Geoffrey Mattson, the CEO of Xage Security, discusses the importance of usability in cybersecurity solutions. Companies are realizing that providing a delightful user experience can set them apart and attract and retain users. However, the cybersecurity industry has been slow to focus on usability, often creating complex and difficult-to-use technologies.

The talent shortage in the cybersecurity industry exacerbates this issue, leading to underutilized solutions and potential security breaches. Poor user experience can lead employees to seek out-of-policy workarounds, compromising enterprise security.

Verizon reports that 68% of breaches involve human error, highlighting the need for user-friendly security solutions. Consolidating cybersecurity tools can streamline operations and reduce complexity for administrators, leading to cost and time savings.

Usability is not just important for end users but also for administrators who are overwhelmed with complex technologies. Simplifying deployment processes and allowing organizations to keep existing infrastructure can increase efficiency and productivity.

Adapting to prioritize usability across the cybersecurity tech stack is crucial for a more secure future. It is essential to involve end users in the selection process of security solutions to ensure adoption and satisfaction. Prioritizing usability can strengthen overall cybersecurity practices and mitigate the risk of breaches.

Geoffrey Mattson is the CEO of Xage Security.

Companies have realized that good (or better yet, delightful) user experience (UX) is a powerful differentiator that can help to attract and retain users. As a result, users have grown to appreciate and expect this level of usability from all technologies they use.

It was only a matter of time before people would start asking themselves why the technologies they use at work—especially cybersecurity solutions—aren't keeping up.

Why Usability Is A Security Issue

The cybersecurity industry has been regrettably slow to focus on usability. Our technology is often regarded as “expert.” Read between the lines and you realize that means complex and difficult to use.

Part of this concern can be attributed to the extremely well-documented talent shortage in our industry. On the customer side, this means there are not enough employees to manage the complex technologies that they’ve purchased to keep them safe from cyberattacks. On the technology vendor side, this means there’s a low chance that your solution will be used to its full potential—which can lead to churn, or worse, breach on your watch.

Security gaps start to appear when people start going off-book. The complexity and disconnected nature of security practices end up causing friction for everyday employees just trying to get their jobs done.

When it comes to choosing between complying with company policy or, for example, spending more time with their kids, most people will choose the latter. Everyday users—including administrators and end users—will seek the path of least resistance. In many cases, this will include out-of-policy workarounds that jeopardize enterprise security.

For instance, an employee of an oil company might realize they can purchase an internet hotspot to remotely access a pipeline in the heart of Texas rather than make the lengthy journey in person. While there’s no doubt this would be more convenient for the employee, it will open up their system to potential risks by exposing the site to the internet in an insecure manner.

Conversely, if it were easy to remotely access this site securely, the user wouldn’t need to get creative. They would simply follow the path that was presented to them and remain within policy.

It’s time to start acknowledging that usability is a security issue and that poor user experience makes enterprises more vulnerable to attack.

Understanding The Tech Stack Toolbox

According to Verizon, 68% of all breaches include the human element, with people being involved via error, phishing or social engineering. Training people not to click on phishing links isn’t enough to address the human challenge. We have to make it easy for them to follow best practices, like using secure passwords and multi-factor authentication (MFA). Vendors have a responsibility to do better, and companies should seek out security solutions that prioritize usability.

Consolidating cybersecurity tools can also streamline security operations and reduce complexity for administrators. This approach can also lead to significant cost and time savings for organizations and simplify the implementation and demonstration of compliance with regulatory requirements, providing a single interface for users across operational technology (OT), information technology (IT) and cloud environments.

While selecting tools, organizations should do a “taste test” of the solutions they are considering. Which solution brings users the most delight? Which is the easiest to use? Involving end users in the selection process, testing different tools and adopting the one they prefer is critical for the adoption of those tools.

This approach doesn’t just gain buy-in; it boosts user satisfaction and ensures they feel vested in the tool's success. In turn, all of this enhances the organization’s security posture.

Administrators And User Experience

Usability isn’t just about end users, either. Administrators and operators are the keystone to the success of any tool. Yet, these users are overwhelmed with complex, noisy and often partially deployed technologies.

Your average cybersecurity practice is littered with fragmented and disjointed solutions. While defense-in-depth can be important strategic decisions, there’s a fine line between redundancy and needless complexity, especially when the tooling introduces high risk and high costs simply because it’s outdated. Reducing the workload enables administrators to focus on managing a single, robust solution, increasing efficiency and productivity by minimizing time spent troubleshooting and maintaining disparate systems.

Ease of deployment is also a crucial factor for the success of any security solution. "Shelfware" is an industry term describing tools so complex to deploy that teams prefer accepting sunk costs rather than investing more time and energy in rolling them out. Rapid rollout, ideally within days or weeks, is essential. Streamlining these processes is key to ensuring the implementation of security solutions and avoiding wasted investments.

Modern solutions should ease the burden of change by allowing organizations to keep existing infrastructure with minimal policy adjustments and no need for additional hiring. The ability to extend the lifespan of legacy systems that are still functional is crucial for enterprises that cannot afford to replace assets performing critical functions just because they pose a security risk.

Advancing Usability: Navigating The Future

While it may appear daunting to readjust a cybersecurity program, the imperative for change outweighs the inertia of maintaining the status quo. The risk of breach looms for those who resist change, making the effort to adapt far less painful in comparison.

Prioritizing usability across the entire spectrum of the cybersecurity tech stack, from administrative tasks to end-user activities, strengthens the overall practice and is the way forward to a more secure future.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?

Geoffrey Mattson, the CEO of Xage Security, discusses the importance of usability in cybersecurity solutions. Companies are realizing that providing a delightful user experience can set them apart and retain users. However, the cybersecurity industry has been slow to focus on usability, often creating complex and difficult-to-use technologies.

The lack of usability in cybersecurity solutions can lead to security gaps as users seek out-of-policy workarounds to make their jobs easier. This can expose enterprises to potential risks and vulnerabilities. It's crucial to understand that usability is a security issue, and poor user experience can make organizations more susceptible to cyberattacks.

Verizon reports that 68% of breaches involve the human element, highlighting the importance of making security practices easy for users to follow. Consolidating cybersecurity tools can streamline operations, reduce complexity, and save time and costs for organizations. Involving end users in the selection process and choosing solutions that prioritize usability can enhance security posture.

Administrators and operators also play a key role in the success of cybersecurity tools. Simplifying deployment processes and reducing complexity can increase efficiency and productivity. Modern solutions should allow organizations to keep existing infrastructure while minimizing policy adjustments and additional hiring.

Prioritizing usability across the cybersecurity tech stack is essential for a more secure future. Adapting to change and focusing on usability from administrative tasks to end-user activities can strengthen overall security practices. It's important for organizations to embrace usability as a security issue and prioritize user experience in cybersecurity solutions.

Geoffrey Mattson is the CEO of Xage Security.

Companies have realized that good (or better yet, delightful) user experience (UX) is a powerful differentiator that can help to attract and retain users. As a result, users have grown to appreciate and expect this level of usability from all technologies they use.

It was only a matter of time before people would start asking themselves why the technologies they use at work—especially cybersecurity solutions—aren't keeping up.

Why Usability Is A Security Issue

The cybersecurity industry has been regrettably slow to focus on usability. Our technology is often regarded as “expert.” Read between the lines and you realize that means complex and difficult to use.

Part of this concern can be attributed to the extremely well-documented talent shortage in our industry. On the customer side, this means there are not enough employees to manage the complex technologies that they’ve purchased to keep them safe from cyberattacks. On the technology vendor side, this means there’s a low chance that your solution will be used to its full potential—which can lead to churn, or worse, breach on your watch.

Security gaps start to appear when people start going off-book. The complexity and disconnected nature of security practices end up causing friction for everyday employees just trying to get their jobs done.

When it comes to choosing between complying with company policy or, for example, spending more time with their kids, most people will choose the latter. Everyday users—including administrators and end users—will seek the path of least resistance. In many cases, this will include out-of-policy workarounds that jeopardize enterprise security.

For instance, an employee of an oil company might realize they can purchase an internet hotspot to remotely access a pipeline in the heart of Texas rather than make the lengthy journey in person. While there’s no doubt this would be more convenient for the employee, it will open up their system to potential risks by exposing the site to the internet in an insecure manner.

Conversely, if it were easy to remotely access this site securely, the user wouldn’t need to get creative. They would simply follow the path that was presented to them and remain within policy.

It’s time to start acknowledging that usability is a security issue and that poor user experience makes enterprises more vulnerable to attack.

Understanding The Tech Stack Toolbox

According to Verizon, 68% of all breaches include the human element, with people being involved via error, phishing or social engineering. Training people not to click on phishing links isn’t enough to address the human challenge. We have to make it easy for them to follow best practices, like using secure passwords and multi-factor authentication (MFA). Vendors have a responsibility to do better, and companies should seek out security solutions that prioritize usability.

Consolidating cybersecurity tools can also streamline security operations and reduce complexity for administrators. This approach can also lead to significant cost and time savings for organizations and simplify the implementation and demonstration of compliance with regulatory requirements, providing a single interface for users across operational technology (OT), information technology (IT) and cloud environments.

While selecting tools, organizations should do a “taste test” of the solutions they are considering. Which solution brings users the most delight? Which is the easiest to use? Involving end users in the selection process, testing different tools and adopting the one they prefer is critical for the adoption of those tools.

This approach doesn’t just gain buy-in; it boosts user satisfaction and ensures they feel vested in the tool's success. In turn, all of this enhances the organization’s security posture.

Administrators And User Experience

Usability isn’t just about end users, either. Administrators and operators are the keystone to the success of any tool. Yet, these users are overwhelmed with complex, noisy and often partially deployed technologies.

Your average cybersecurity practice is littered with fragmented and disjointed solutions. While defense-in-depth can be important strategic decisions, there’s a fine line between redundancy and needless complexity, especially when the tooling introduces high risk and high costs simply because it’s outdated. Reducing the workload enables administrators to focus on managing a single, robust solution, increasing efficiency and productivity by minimizing time spent troubleshooting and maintaining disparate systems.

Ease of deployment is also a crucial factor for the success of any security solution. "Shelfware" is an industry term describing tools so complex to deploy that teams prefer accepting sunk costs rather than investing more time and energy in rolling them out. Rapid rollout, ideally within days or weeks, is essential. Streamlining these processes is key to ensuring the implementation of security solutions and avoiding wasted investments.

Modern solutions should ease the burden of change by allowing organizations to keep existing infrastructure with minimal policy adjustments and no need for additional hiring. The ability to extend the lifespan of legacy systems that are still functional is crucial for enterprises that cannot afford to replace assets performing critical functions just because they pose a security risk.

Advancing Usability: Navigating The Future

While it may appear daunting to readjust a cybersecurity program, the imperative for change outweighs the inertia of maintaining the status quo. The risk of breach looms for those who resist change, making the effort to adapt far less painful in comparison.

Prioritizing usability across the entire spectrum of the cybersecurity tech stack, from administrative tasks to end-user activities, strengthens the overall practice and is the way forward to a more secure future.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?

Geoffrey Mattson, the CEO of Xage Security, discusses the importance of usability in cybersecurity solutions. Companies are realizing that providing a delightful user experience can set them apart and attract and retain users. However, the cybersecurity industry has been slow to focus on usability, often leading to complex and difficult-to-use technologies.

The lack of usability in cybersecurity solutions can result in security gaps as employees seek out-of-policy workarounds to make their jobs easier. This can leave enterprises vulnerable to cyberattacks. It is crucial to prioritize usability in security solutions to ensure they are used effectively and securely.

Verizon reports that 68% of breaches involve human error, highlighting the importance of making security practices easy for users to follow. Consolidating cybersecurity tools can streamline operations, reduce complexity, and save time and costs for organizations.

Administrators and operators also play a key role in the success of security tools. Simplifying their workload by reducing complexity and ensuring ease of deployment can increase efficiency and productivity. Modern solutions should allow organizations to keep existing infrastructure while enhancing security.

Adapting cybersecurity programs to prioritize usability across the tech stack is essential for a more secure future. By making security solutions easy to use for both administrators and end users, organizations can strengthen their overall security posture.

Ireland’s cyber agency has launched 211 investigations so far this year, compared to 309 for all of last year, it has emerged.

The National Cyber Security Centre (NCSC) said the cyber landscape had been “worsening” in the last number of months, with Russia’s continuing aggression in Ukraine resulting in a “degradation” of cyber security across Europe.

NCSC director Richard Browne said this had been compounded by espionage, with Germany recently attributing cyber attacks to a group associated with Russian military intelligence.

He told the Oireachtas communications committee China was also heavily involved in cyber security threats, with Britain's Electoral Commission recently attributing a breach of its system to a group linked to Chinese authorities and an attack on US critical infrastructure also being blamed on a China-based group.

Mr Browne said the strength of NCSC had grown from 25 to 57 and should hit 75 by the end of the year, much of it due to obligations stemming from the European Union.

He said continuing obligations from the EU, including a new directive this year, and two more directives soon after, may mean NCSC staffing will need to reach 120-130 staff within three years, adding “it could be a lot more”.

He said ransomware — where a gang targets and cripples a company’s IT system and demands payment to release its control — is still the biggest threat, saying the number of estimated incidents rose by 75% globally in 2023.

He said this included a significant number of incidents in the US targeting the health sector. 

He said evidence suggests relatively poor cyber security and a willingness to pay ransoms has created a bit of a “feeding frenzy”.

He said global estimates suggest ransomware payments exceeded €1bn in 2023.

Mr Browne said the NCSC, an executive office inside the Department of Communications, received 5,200 reports last year, with 721 confirmed cyber incidents and 309 investigations.

He said there were 211 investigations so far in 2023, which was “substantially up” on the same time last year.

Mr Browne said a major EU directive, called NIS 2, will see a “dramatic increase” in both the number of entities and companies covered in Ireland and the requirements on these entities regarding cyber security.

He said the number of entities will go from over 100 “to at least 3,000”.

He said the directive will create national competent authorities for various sectors — such as telecoms and energy — which the NCSC will provide guidance to and oversight.

The NCSC will keep a direct brief over the government and key entities.

He said the NIS2 will be followed by the EU Cyber Resilience Act and the EU Cyber Solidarity Act.

Mr Browne said while Ireland may be small, it has “twice the number of IP [internet] addresses per head than the UK” because of the number of high-tech companies, and related economic activity, here.

“We have a substantial cyber security real estate and we have collective responsibility to everybody else that our estate isn’t used for attacks on other jurisdictions,” he said. 

It’s a question of our neutrality — we can’t be used as a base of an attack on other jurisdictions.

Mr Browne said the figure of €100m had been put on “some of the costs” caused by the cyber attack on the HSE in 2021.

He said: “The HSE [attack], in many ways, is one of the largest cyber security incidents in history, globally — not just the scale of it, but the implications for individuals and their lives was particularly egregious, and just for criminal gain.”

The National Cyber Security Centre (NCSC) in Ireland has launched 211 investigations so far this year, compared to 309 for all of last year. The NCSC director, Richard Browne, stated that the cyber landscape has been deteriorating in recent months, partly due to Russia's aggression in Ukraine. This has led to a degradation of cyber security across Europe.

Browne also mentioned that Germany has attributed cyber attacks to a group associated with Russian military intelligence, and China has been heavily involved in cyber security threats. The NCSC has increased its staff from 25 to 57 and is expected to reach 75 by the end of the year, with potential growth to 120-130 staff within three years.

Ransomware remains a significant threat, with a 75% increase in estimated incidents globally in 2023. Browne highlighted that ransomware payments exceeded €1 billion in 2023. The NCSC received 5,200 reports last year, with 721 confirmed cyber incidents and 309 investigations. There have been 211 investigations so far in 2023, a substantial increase from the previous year.

A major EU directive, NIS 2, will lead to a dramatic increase in the number of entities and companies covered in Ireland regarding cyber security requirements. The directive will create national competent authorities for various sectors, which the NCSC will provide guidance to and oversight. This will be followed by the EU Cyber Resilience Act and the EU Cyber Solidarity Act.

Browne emphasized Ireland's responsibility to ensure that its substantial cyber security real estate is not used for attacks on other jurisdictions. He mentioned that the cost of the cyber attack on the HSE in 2021 was estimated at €100 million. Browne described the HSE attack as one of the largest cyber security incidents globally, with significant implications for individuals and their lives.

On May 21, the BBC's information security team discovered a data security incident involving the copying of files containing personal information of BBC Pension Scheme members from a cloud-based storage service. The files included names, National Insurance numbers, dates of birth, sex, and home addresses of some members. However, no bank details, financial information, usernames, or passwords were compromised. The incident has been reported to the Information Commissioner's Office and the Pensions Regulator.

Affected members were notified via email on May 29, 2024. If the BBC does not have your email address, they will send a letter in the coming days. Members are advised to be cautious of any unsolicited communications asking for personal information and to avoid responding to suspicious emails or messages.

The BBC is working with specialist teams to understand the incident and has implemented additional security measures. The affected files were copies, so there is no impact on the Scheme's operations. The information is no longer accessible from the original source, and there is no evidence of it being available elsewhere.

Investigations are ongoing to determine the responsible party. While there is no specific action required from affected members, they are encouraged to be vigilant about data and cyber security. Strong passwords and Two Factor Authentication are recommended for online services.

Members affected by the incident are offered 24 months of free access to Experian Identity Plus credit and web monitoring service. General guidance and advice can be found at the National Cyber Security Centre.

Illegitimate use of personal data may involve attempts to impersonate members for account access or creation. If suspicious activity is detected, members should contact the service or organisation directly.

For assistance with signing up for Experian Identity Plus, members can call Experian's helpline at 03444 818182. Existing Experian Identity Plus users can also benefit from the free two-year membership offer by following the instructions in their notification letter.

In litigation, specificity is crucial. "Beyond a reasonable doubt" is the standard of proof in criminal cases, and prosecutors have to convince the jury that the evidence leaves no reasonable doubt about the defendant's guilt. In civil cases, the standard is "preponderance of the evidence," meaning the plaintiff must show that a fact is more likely than not true.

For regulators overseeing enterprise cybersecurity practices, the standard of proof is "reasonable cybersecurity," or taking measures to protect data based on what a reasonably prudent person would do in similar circumstances. At the recent RSA Conference, the Center for Internet Security (CIS) released a detailed white paper on reasonable cybersecurity and how the concept intersects with privacy laws.

"Reasonable cybersecurity" is intentionally ambiguous and depends heavily on context. A cyber insurance carrier will often use a a questionnaire asking whether various security controls are in place, and underwriters might or might not approve a policy. But if a breach occurs later, the insurer might dispute the claim, as in 2022 where Travelers Insurance won a lawsuit against International Control Services over misrepresented security controls.

Some standards, like the Payment Card Industry Data Security Standard (PCI DSS), are prescriptive, while others, like the European Union's General Data Protection Regulation (GDPR), offer more flexibility. The GDPR states that an organization must make a "good faith effort to give people the means to control how their data is used and who has access to it. To accomplish this, you must transparently and openly provide them with the information they need to understand how their data is collected and used."

According to the Cornell Law School website, the legal definition of "reasonable" means, in part, "just, rational, appropriate, ordinary, or usual in the circumstances." In reality, reasonable can mean almost anything corporate management wants it to mean.

Quantifying Cyber-Risk

The board and executive management define what makes sense from a cyber capability perspective for their organizations, says Charlie Lewis, partner at McKinsey. Quantifying cyber-risk goes a long way toward determining what is and is not reasonable, he says, noting that Federal Reserve Vice Chair for Supervision Michael Barr underscored the need to improve this nascent technology in remarks to the Conference on Measuring Cyber Risk in the Financial Services Sector in January.

"Better data on cyber threats and vulnerabilities will enable us to identify and assess threats to banks and the financial system," Barr said. "In addition, improved data on interconnectedness between financial institutions and service providers will help identify and measure the impact of an incident on the broader financial system."

Along with the term "reasonable," another word that Lewis says boards need to focus on is "materiality." He notes the Securities and Exchange Commission's (SEC) recent rule changes help in defining materiality for disclosure purposes, adding that other regulatory requirements also identify specific required security. Knowing these required controls and how they are used in a corporate environment help develop a reasonable cybersecurity defense.

Enabling Security Controls

Curtis Dukes, executive vice president and general manager at CIS, agrees that balancing materiality with reasonableness is essential. In a recent 10-K filing with the SEC, a company said its forensics investigation of a breach found there was no material impact to earnings or operations. While this statement met the regulatory requirement, it was stated before the full impact of the breach could be determined. The initial results of a forensics investigation could be incomplete or simply wrong.

Meeting the standard for reasonableness is "highly subjective," Dukes says. "It's typically up to a judge or to a jury to decide [and] assess fault in some type of litigation for that."

To eliminate much of the confusion, he says, security frameworks such as the NIST Cybersecurity Framework (CSF), CIS's own Critical Security Controls (CIS Controls), and others provide enterprises with the controls they need to meet the reasonableness legal requirement, along with providing the necessary controls for meeting regulatory requirements. Organizations that implement the frameworks also generally meet cyber insurance requirements.

Reasonable cybersecurity is a strong defense against artificial intelligence attacks as well, Duke adds.

"If you have a good data, governance program prior principles in place, and you're protecting data, using a set of cybersecurity best practices in the form of controls and underlying safeguard, then you're largely mitigating the threat of artificial intelligence," he says.

In the legal realm, specificity plays a crucial role, especially in litigation. Criminal cases require proof "beyond a reasonable doubt," where prosecutors must convince the jury that there is no doubt about the defendant's guilt. In civil cases, the standard is "preponderance of the evidence," meaning the plaintiff must show that a fact is more likely than not true.

For regulators overseeing enterprise cybersecurity practices, the standard of proof is "reasonable cybersecurity." This involves taking measures to protect data based on what a reasonably prudent person would do in similar circumstances. Recently, at the RSA Conference, the Center for Internet Security (CIS) released a detailed white paper on reasonable cybersecurity and its intersection with privacy laws.

The concept of "reasonable cybersecurity" is intentionally ambiguous and context-dependent. Cyber insurance carriers often use questionnaires to assess security controls before approving policies. However, disputes may arise if a breach occurs and the insurer questions the validity of the security controls.

Various standards, such as the Payment Card Industry Data Security Standard (PCI DSS) and the European Union's General Data Protection Regulation (GDPR), offer different levels of prescription and flexibility in cybersecurity requirements.

Quantifying cyber-risk is essential for determining what is reasonable in terms of cybersecurity. Better data on cyber threats and vulnerabilities can help identify and assess threats to organizations and the financial system.

Balancing materiality with reasonableness is crucial in developing a strong cybersecurity defense. Security frameworks like the NIST Cybersecurity Framework and CIS Controls provide enterprises with the necessary controls to meet legal and regulatory requirements, as well as cyber insurance requirements.

Reasonable cybersecurity also serves as a defense against artificial intelligence attacks by implementing data governance programs and cybersecurity best practices. By using controls and safeguards, organizations can mitigate the threat of artificial intelligence attacks.