Protecting Borders Requires Holistic Intelligence

My first job out of graduate school was as the Program Manager for the Export Control and Related Border Security (EXBS) Program of the U.S. Department of State.  This program’s objective was to prevent the proliferation of Weapons of Mass Destruction (WMD) by empowering countries around the world to create effective export control laws and implementing regulations while at the same time develop or improve their capabilities of monitoring and stopping illicit material crossing international borders.  A key component of this program was intelligence on who was attempting to smuggle these items, how they were attempting this smuggling, and the motivations of these actors.  Without this intelligence, all we would have been doing was responding to events that happened to be noticed at the borders. Intelligence empowered an effective defense against smuggling, in this case, of the most deadly weapons in the world.

This can be a metaphor for cyber security.  Current practices in cyber security are often focused internally.  They look for indicators of compromise, the existence of malware, or the presence of advanced persistent threats.  Very few organizations are looking beyond the border of their own networks. Only a few organizations have even contemplated or are attempting to understand who is on the other side of these threats.  Every cyber event has a human element to it.  Yet very little research has been done on who these actors are and their motivations.  Tactics, tools and procedures (TTP’s) are better understood, but often these are not correlated with the threat actor themselves, but just generalized to the cyber threat ether.

Any effective program meant to stop the proliferation of items must have intelligence on who wants to conduct that proliferation, why they want to do so, and how they intend to do so.  This is true for WMD and it is true in the Cyber domain.   Otherwise, all anyone can do is respond to what they happen to notice.  What kind of defense is that?