What do cybersecurity and the Great Wall of China have in common?

Understanding the similarity is the key to understanding the magnitude of the problem

The Great Wall of China is a colossal project undertaken by the ancient Chinese. It was estimated that the combined total length of the Great Wall over the entire history of Chinese civilisation was about 21,000 km.

Despite its extreme cost in terms of resources, finance and human lives, the Great Wall was breached many times by the Mongol army led by Genghis Khan. During the Ming dynasty (1368-1644), the Great Wall held out most of the time. But it was finally breached in the end by the Manchus because its gates were opened for them to enter China.

The problem that the Great Wall tried to solve was a particularly difficult one to solve. The problem favours the attackers far more than the defenders. You see, for the Great Wall to work, it has to be strongly defended everywhere and every time throughout the entire length of the fortification. Since it was such a long wall (tens of thousands of kilometres), it required a massive number of soldiers and a gargantuan amount of maintenance work to ensure its strength. During the Ming dynasty, the Chinese had to deploy 1 million soldiers to guard the Great Wall. That was a colossal army during the Middle Ages.

The barbarians, on the hand, did not have this problem. They can choose when and where to attack the Great Wall. They can take their time to find the weakest spot on the Great Wall and concentrate their forces there. Should that weak spot be breached, they can then pour their forces across that area and attack the rest of China. That was what the Mongols did in 1550 when Altan Khan breached the lightly defended section of the Great Wall at Gubeikou, rode to Beijing and pillaged its suburbs.

The problem faced by cybersecurity

Cybersecurity has a similar problem to the Great Wall of China. The nature of the problem favours the attackers disproportionately much more than the defenders. Worse still, the ancient Chinese had an advantage that today’s cybersecurity defenders do not have. At least the ancient Chinese had a clearly defined wall to defend. In cybersecurity, the front line is everywhere and ill-defined.

In cybersecurity, the attacker only needs to find a vulnerability to get in. The defender, on the other hand, needs to defend against all vulnerabilities. Also, vulnerabilities can range anywhere from code in the hardware to the human being behind the screen. Methods for breaching vulnerabilities range from esoteric side-channel attacks to plain old-fashioned scams (social engineering). Not only that, the detection of successful attacks is a problem in cybersecurity- you may be breached and yet do not know about it. At least the ancient Chinese knew when the Great Wall was breached as it cannot be kept a secret.

Why the situation cannot get better?

Society has a serious problem with cybersecurity which can only get worse unless something changes.

As we all know, there is a severe shortage of cybersecurity professionals. The defenders of the Great Wall of China needed to dwarf the number of attackers to be effective. The Ming dynasty had to deploy a colossal army of 1 million to do that job. But in cybersecurity, we are nowhere near the relative number of professionals required to defend against attackers.

Are we anywhere near increasing the number of cybersecurity professionals?

As I wrote in Why 'dead bodies' of cybersecurity victims will pile up faster?, we are shooting ourselves in the foot:

• Defective hiring practices are worse than ineffective. They are exacerbating the skills shortage crisis.

• Lots of bright, passionate, and high-potential people around the world are desperately trying to break into cybersecurity, but are being blocked from entering, thanks to defective hiring practices. In military terms, it is akin to the defenders blocking their own reinforcements! There are signs that national resources are starting to mobilise to train up the defenders. But if the defenders are blocked from joining the reinforcements, what is the point?

• As I wrote in In cybersecurity, we are fighting like the Japanese and losing, we are burning up our existing cybersecurity professionals, forcing more and more of them to exit the industry when we need them the most.

• The defenders who are blocked from reinforcing the ranks of the defenders are increasingly tempted to join the attackers’ side.

If change does not happen, we will be concocting a recipe for disaster against societal resilience.