What is cybersecurity?

Let’s start at what I consider the beginning – what has value? That answer has changed dramatically over the decades; for a time it was gold, then it was manufactured goods, it’s always been art, the value of labor, the common ingenuity of a good idea. Value is, of course, subjective, but also societal: we place value on things because of either their worth to us, or their worth to society. While rarity also plays a factor, value is generally at the intersection of utility and necessity.

So, looking at a few things: gold has value because we have decided it does, societally. It’s a fairly useless metal outside of conductivity; it’s perfect for coinage of course (distinctive, chemically stable, hard to adulterate) and is great for conducting electricity, and also fairly rare… but it has no real value outside of decoration. We agreed societally that it was a thing of value, and so it is. A Bugatti Veron, one of the world’s most expensive, fastest cars, has a certain value that varies – we all agree it’s neat and can argue incessantly about its beauty, but… as an adult, would you buy one, even of you had the means? Not everyone would answer that question as ‘yes’, so we begin to understand that value is unrelated to price.

In today’s age, the thing we place the most value on isn’t tangible – it’s information. Whether that information is the set of plans that allows Intel to build its latest chip, the numbers that identify you specifically and thus offer the keys to your life, the numbers in your bank account, or your shopping preferences – information has now become a valuable commodity to those who understand its use. The important word here is “commodity” – it is now portable, tradeable, available in common formats and usable across a wide number of spaces.

The things that make you .. well.. you, to the outside world – in the US, this is your Driver’s License number, your Social Security number, your medicare ID number, your passport number. In India and most African nations, It’s your NIN (National Identification Number) – these things are now portable, exchangeable, and intended to be something of a public/private secret. In the wrong hands, these numbers can be used to impersonate you, to steal who you are and use that for personal gain. They’re the basis of your interaction with the systems that hold up society, especially in the realms of finance and ownership. To everyone not in your circle of friends, you essentially are these numbers.

That doesn’t even take into account peripheral data – where you go, what you buy, what you like – that is now being tracked, shuffled, and commoditized. Marketers can find out a great deal about who you are simply by coming to understand your habits.

This makes that data have significant value.

Additionally, there are other important bits of data out there – military secrets, corporate secrets, personal secrets, computer code that represents fundamental operating parameters of some of the largest systems humanity has created. Imagine, for example, if a bad actor gains access to the computerized controls that manage the New York Subway, the British Rail System, or your country’s government treasury? Look at the havoc wreaked by Russian hackers on the Ukraine energy grid or the Colonial Pipeline.

Data also doesn’t have to be secret to have value: company operating budgets, general internal contracting documentation, non-secret strategic agreements, even just operating metrics all have value to an organization, and ransomware targeting these can bring a company to its knees.

So, I think it fair to say, we can establish that data has significant value.

When something has value, it must, by extension, be protected. We protect our cars with alarms and locks, our homes with perimeter security, our persons with attention and training. We protect ourselves from financial ruin where we can – we buy insurance to hedge against medical and personal disaster, we build up savings to ensure that we can function in society if bad things happen, we plan for retirement because we wish for security.

Security, then, is protecting things of value from damage, destruction, or theft. That’s why we have security – it’s no secret. We protect things that matter to us.

It then stands to reason that items of extraordinary value should be protected by extraordinary measures – I’m sure you can think of hundreds of examples on your own here. Cybersecurity is that branch of security discipline devoted to protecting data (I personally prefer the term “Infosec” – cybersecurity has odd connotations, and infosec is more accurate in its description), and thus represents the line of defense we place to protect data from malfeasance, destruction, theft, or vandalism.

In this modern age, many of us abrogated our responsibility to protect ourselves because data is difficult to understand, and computers and data systems aren’t something the average person-on-the-street really gets. To most people, the operation of a high-end database or AI-based analytical system might as well be magic – and so it is set in that space of “over there”, and there’s a blind trust that data is being managed well by people that know better. In truth, most organizations and civilian corporations treat your information as another held good, carelessly managing, maintaining, and protecting it. They have created vast stores of valuable information inventory, and haven’t bothered to lock the doors, much less post a guard or two.

This cavalier attitude toward privacy and security has resulted in a world much like the old west in the United States, a place of lawlessness and greed, where thieves are hard to track and what they steal is easily anonymized, transformed, and repurposed. Where security is only considered after the theft occurs, where the ignorance or greed of the owners of data has created a world where personal harm has to occur before people get upset about how their lives are available for sale.

It’s getting better. A focus on cybersecurity, holding the owners of data responsible for its protection, improved regulation, and better understanding among the general public have started to transform the space.

But.. to answer your original question? Cybersecurity is important because, ultimately, it protects the things that make you you, at least in the eyes of governments and financial systems. It protects your privacy, protects your identity, protects your life and your future. It protects your nation’s government and military, preserves the lives of aid workers, keeps secret what should be secret, and ensures the companies you work for can continue to operate. It protects the trade secrets and jobs the engender, protects intellectual property – and even art, personal safety, and financial security. In this world of shared information and interconnected systems, the fundamentals of cybersecurity grant us the ability to trust each other.

Integrity, confidentiality, and availability. This is what cybersecurity is.