{"id":16306,"date":"2019-08-01T10:30:21","date_gmt":"2019-08-01T14:30:21","guid":{"rendered":"https:\/\/www.kaspersky.co.in\/blog\/start-immunizing\/16306\/"},"modified":"2019-09-24T19:56:18","modified_gmt":"2019-09-24T14:26:18","slug":"start-immunizing","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.in\/blog\/start-immunizing\/16306\/","title":{"rendered":"Say yes to cyberimmunity and no to fear"},"content":{"rendered":"<p>I\u2019ve been in the cybersecurity industry for more than 15 years. During that time, and together with other infosec veterans, I experienced the rise of the FUD (fear, uncertainty, doubt) hype firsthand. I have to admit, it worked. Neuromarketing science got it right with that one. Fear really did help sell security products. Like any strong medicine, however, FUD had a side effect. Not just one, actually \u2014 it had many.<\/p>\n<p>We as an industry cannot escape FUD because we\u2019re addicted to it. For us, FUD manifests itself in some of our customers demanding proof that what we\u2019re telling them about is not just another potential breach but a real danger. Unfortunately, the best proof that a danger is real comes when something bad happens. And that\u2019s why the media got addicted to FUD as well. The more millions of dollars \u2014 or euros, or whatever other currency \u2014 someone loses, the better the story.<\/p>\n<p>Now, enter the regulators, with their tendency to overreact and to impose strict compliance regulations and fines. That effectively puts security researchers, product developers, marketers, media, and regulators into \u00a0a strategic trap that in game theory is called the prisoner\u2019s dilemma: a situation in which all players must use suboptimal strategies because to do otherwise would cause them to lose. In the case of the infosec industry, using that suboptimal strategy means generating even more FUD.<\/p>\n<p>To break out of this trap, we need to understand one thing: the future cannot be built on the basis of fear.<\/p>\n<p>The future I\u2019m talking about is not distant, it\u2019s already here. Robots are already driving trucks and roaming around Mars. They write music and create new recipes for food. This future is far from perfect from many perspectives, including that of cybersecurity, but we\u2019re here to empower it, not to hinder it.<\/p>\n<p>Eugene Kaspersky recently said that he believes \u201c<a href=\"https:\/\/www.kaspersky.com\/blog\/kaspersky-rebranding\/27174\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">the concept of cybersecurity will soon become obsolete, and cyberimmunity will take its place<\/a>.\u201d That may sound bizarre, but it has a much deeper meaning that is worth explaining. Let me dive a little bit deeper into the concept of <em>cyberimmunity.<\/em><\/p>\n<p><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/36\/2019\/08\/08155601\/start-immunizing-moiseev.jpg\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/36\/2019\/08\/08155601\/start-immunizing-moiseev.jpg\" alt=\"\" width=\"1499\" height=\"937\" class=\"aligncenter size-full wp-image-16468\"><\/a><br>\nCyberimmunity is a great term to explain our vision of the safer future. In real life, an organization\u2019s immune system is never perfect, and viruses or other malignant microbiological objects still find ways to fool it, or even to attack the immune system itself. However, immune systems share a very important trait: They learn and adapt. They can be \u201ceducated\u201d through vaccination about possible dangers. In times of peril, we can assist them with ready-made antibodies.<\/p>\n<p>In cybersecurity, we used to deal mostly with the latter. When our customers\u2019 IT systems succumbed to infection, we had to be ready with solutions. But that\u2019s when the addiction to FUD started, with security vendors providing ready relief to diseases that hurt badly. That \u201csuperpower\u201d feeling proved addictive to infosec vendors. We were like, \u201cYes, it\u2019s time for hardcore antibiotics, because, trust us, the problem is really <em>that<\/em> serious.\u201d But using hardcore antibiotics makes sense only when the infection has already clawed its way in \u2014 and that, we can all agree, is far from an ideal scenario. In our cybersecurity metaphor, it would\u2019ve been better if the immune system could have stopped that infection before it took hold.<\/p>\n<p>Today, IT systems have become very heterogeneous and cannot be viewed outside of the context of humans \u2014 those who operate the devices and those who interact with the devices. The demand for \u201ceducating the immune system\u201d has become so great that we actually are seeing a trend toward prioritizing provision of services \u2014 over even the product, which used to be primary. (The \u201cproduct\u201d nowadays is in many cases a customized solution, something that is adapted to the specifics of the IT system it\u2019s designed to fit in.)<\/p>\n<p>Understanding of this vision didn\u2019t come at once. And just like with vaccination, it\u2019s not a one-shot approach, but, rather, a series of vaccination attempts, all aimed at the same goal: stronger cyberimmunity for a safer future.<\/p>\n<p>First, and foremost, a safer future can be built only on a safe foundation. We believe this is possible when all systems are designed <a href=\"https:\/\/www.kaspersky.com\/blog\/what-is-secure-os\/20312\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">from the start with security in mind<\/a>. Real applications in the telecommunications and automotive industries are already testing our visionary approach. Carmakers being especially keen on safety, our mission statement of \u201cbuilding a safer world\u201d is critical. In the automotive world, security really means safety.<\/p>\n<p>As with biological vaccination, we expect the cyberimmunity concept to be met with skepticism. The very first question I\u2019d expect to hear is: \u201cCan we really trust the vaccine <em>and<\/em> its vendor?\u201d Trust in cybersecurity is of paramount importance, and we believe that simply giving our word is not enough. If a cybersecurity firm\u2019s clients want to see software\u2019s security and integrity, they have every right to demand it \u2014 in the form of source code. We make that available, and all clients need is a pair of attentive eyes and a PC to analyze how things work. We do require a PC in <a href=\"https:\/\/www.kaspersky.com\/transparency-center\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">sanitized condition<\/a> for that code viewing, however, to ensure that observers can\u2019t tamper with the code themselves. And just as you may seek consultations from various doctors, having a trusted third party view the code as well makes sense. With IT solutions, that outside viewer could be representatives of a Big Four auditing firm who can explain what those bits and bytes actually mean for your business.<\/p>\n<p>Another important component is the ability of the immune system to withstand attacks against it. Cybersecurity software is still software, and it can have flaws of its own. The best way to learn these flaws is to expose them \u2014 to white-hat hackers, the ones who find flaws and report them back to vendors. The idea of offering a prize for finding a bug in software, first introduced in 1983, was absolutely brilliant, as it greatly reduced the financial incentives for black-hat hackers (who peruse found flaws or sell them to other cybercriminals). However, white hats demand guarantees that the company they investigate won\u2019t turn on them and prosecute them.<\/p>\n<p>Where there\u2019s demand, there\u2019s supply, so recently we\u2019ve seen suggestions for agreements between researchers and companies such that the former can safely try to crack the latter without fear of being accused of any crime, as long as they follow the rules. I believe that <a href=\"https:\/\/www.kaspersky.com\/blog\/bug-bounty-boost-2018\/19842\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">moving in this direction<\/a> is a step toward a safer future \u2014 one with less fear-mongering than the past \u2014 but this journey is going to take some time.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>To build a safer future, we need to stop fearing and start immunizing.<\/p>\n","protected":false},"author":2454,"featured_media":16213,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2036,2609],"tags":[2835,282,848],"class_list":{"0":"post-16306","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-business","8":"category-enterprise","9":"tag-cyberimmunity","10":"tag-cybersecurity","11":"tag-future"},"hreflang":[{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/start-immunizing\/16306\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/start-immunizing\/13811\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/start-immunizing\/18314\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/start-immunizing\/16390\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/start-immunizing\/15086\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/start-immunizing\/19022\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/start-immunizing\/17735\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/start-immunizing\/23302\/"},{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/start-immunizing\/6308\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/start-immunizing\/27813\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/start-immunizing\/12079\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/start-immunizing\/12413\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/start-immunizing\/19917\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/start-immunizing\/24111\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/start-immunizing\/19690\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/start-immunizing\/23119\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/start-immunizing\/23059\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.co.in\/blog\/tag\/cybersecurity\/","name":"Cybersecurity"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.co.in\/blog\/wp-json\/wp\/v2\/posts\/16306","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.co.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.co.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.in\/blog\/wp-json\/wp\/v2\/users\/2454"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.in\/blog\/wp-json\/wp\/v2\/comments?post=16306"}],"version-history":[{"count":5,"href":"https:\/\/www.kaspersky.co.in\/blog\/wp-json\/wp\/v2\/posts\/16306\/revisions"}],"predecessor-version":[{"id":16469,"href":"https:\/\/www.kaspersky.co.in\/blog\/wp-json\/wp\/v2\/posts\/16306\/revisions\/16469"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.in\/blog\/wp-json\/wp\/v2\/media\/16213"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.co.in\/blog\/wp-json\/wp\/v2\/media?parent=16306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.co.in\/blog\/wp-json\/wp\/v2\/categories?post=16306"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.co.in\/blog\/wp-json\/wp\/v2\/tags?post=16306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}