The full article was written by our Co-founder and CTO, Alan Duric and published on cpomagazine.com on June 17, 2021

The upheaval of this past year has revealed how vulnerable global systems are to cybercriminals and bad actors. Cyberattacks have surged, with a reported 400% increase in attacks since the pandemic, and a 278% increase in leaked U.S. government records.

However, cyberattacks didn’t just increase in terms of volume, they also grew in scale, potency and wide impact, particularly in the public sector. We know them on a first-name basis: SolarWinds, Microsoft Exchange and most recently Colonial Pipeline all have shown not just how vulnerable we can be, but how crucial it is to make structural changes to our digital landscape to ensure our future security.

That’s why we welcome the recent Executive Order by President Biden. While the mandates for agencies to undo years of security vulnerabilities in just 60 days is incredibly ambitious, just setting that direction towards leading standards in authentication, encryption and data compliance will yield great benefits as these approaches begin to be increasingly implemented across public and private areas.

A breaking point

Last year, the news of the SolarWinds attack made headlines as the then-largest and most sophisticated U.S. hacks of all time. Not only did it compromise the private sector, it also affected many U.S. government organizations, including critical federal agencies like the U.S. Treasury, Justice and Commerce Departments. Unfortunately the Microsoft Exchange hack earlier this year outdid it, with many experts believing it bested the SolarWinds hack in scale and consequence. With this hack, more than 30,000 U.S. organizations (both government and commercial) had their emails exposed, with the full breadth of damage still unknown.

Most recently of course was the Colonial Pipeline ransomware attack, showing how vulnerable critical elements of U.S. infrastructure are and how disruptive and potentially paralyzing these attacks can be. Based on this recent history, it’s not surprising that the Biden administration released last week’s executive order.

While each of these hacks individually are damaging enough, what’s really concerning is that the frequency of these types of deep-reaching attacks are steadily increasing. If we dive in even further, we can see that there are some underlying weaknesses that may be exposing organizations to unnecessary risk and making these types of breaches more likely – and more dangerous.

Redesigning our infrastructure

Despite the wide range of attacks – supply chain, data storage, ransomware – they all point to some very clear common weaknesses that should not be overlooked from a security standpoint. All organizations, not just the U.S. government, should pursue a new security-first infrastructure to discourage future attacks and minimize any potential impact of a successful breach. This new, alternative architecture utilizes these three elements:

Zero Trust

This security framework has been around for some time, but is just now starting to gain traction in implementation, especially now as it was specifically highlighted in the executive order. Zero trust is a methodology that assumes that all data, devices, apps and users inside or outside of the corporate network are inherently insecure and must be authenticated and verified before being granted access. The key component to zero trust is that it is a holistic strategy, involving both technical protocols such as multi-factor authentication and identity access management, as well as an overarching dynamic and hyper-vigilant mindset that is ingrained into how an organization operates and proactively defends against cyber threats. This approach requires a change in strategy at all levels of the organization because it assumes that any vulnerability – even at an individual employee level – can cause significant damage if exploited.

End-to-end encryption (E2EE)

As cyberattacks continue to grow in volume, end-to-end encryption has become an increasingly important topic. Many platforms have shown security weak points and as a result businesses are seeking E2EE as a basic signifier of security. Unfortunately, a number of popular collaboration and email platforms either have not created concrete plans to employ E2EE, or are now scrambling to add in basic security protocols after years of operating without them. The definition of “end-to-end encryption” has also gotten muddied by the phrase’s heavy usage in marketing materials: In true end-to-end encryption, the data is encrypted on the sender’s system or device and only the recipient is able to decrypt it. Many platforms have even been caught making false claims or utilizing weak forms of E2EE, so it’s critical to not only pick the right E2EE form but also to be fully transparent with which ones you employ. For example, a decentralized solution that uses double-ratchet E2EE allows for every individual call, message, and file to be separately encrypted on every device, with the keys generated from the device rather than from a central server. This protects the information to the smallest possible unit, and creates a system that grows more complex – rather than more valuable – for hackers with every message.

Decentralized data storage and protection

As referenced above, decentralization protects data assets at the edge rather than in a central fortress. This architecture ensures that organizations have control instead of being subjected to any risks that may come from how a vendor decides to store their data. Solutions that protect from the edge have a much better chance of protecting data from bad actors because there is no single large “payload.” The lack of end-to-end encryption (Microsoft, like many other email providers, saves data in cleartext on its servers) and centralized data storage created a dangerous combination in Microsoft’s case. In a lot of ways it takes less resources for vendors to simply place a perimeter defense around their central hub, and for organizations to pass off the responsibility of that protection to their vendors. The major downside of this approach is that if an attacker is able to surpass those perimeter defenses and gain entry to those servers, all the data in that central hub is compromised – this is how you can get the emails of over 30,000 organizations exposed in one fell swoop. By contrast, having the option for on-prem or hybrid arrangements can make a crucial difference in security. If this old infrastructure with centralized data storage and protection and outdated security protocols remains in place, we will almost certainly continue to see the number of these kinds of cyberattacks increase.

The road ahead

There are already some individual tools and platforms like Protonmail utilize this new security infrastructure – and that’s a great start. However, if organizations truly want to future proof and defend against the rising threat of cyber attacks, a much bigger and more fundamental change needs to take place. Similar to how we do not solve climate change with an oil and coal powered energy infrastructure, we will not solve these current security challenges by relying on architectures from the 1970s. It will require a radical rethink and the use of new tools and approaches. That’s why we applaud these steps by the Biden administration to begin to undo years of poor security practices in the public sector. By taking these difficult lessons on zero trust, encryption and data compliance to heart, the U.S.’s digital infrastructure can become safer for everyone involved.

About Wire

Wire is the most secure collaboration platform, transforming the way businesses communicate at the same speed and with the same impact that our founders disrupted telephony with Skype. Headquartered in Berlin with offices in Switzerland and San Francisco, Wire’s award-winning collaboration and communications platform counts over 1,800 government and enterprise customers worldwide, including EY, Fortum, the German government and four other G7 governments. Recognized for its secure collaboration platform as a leader and high performer by G2 Crowd, IDC, Forrester and Gartner, Wire offers messaging, audio/video conferencing, file-sharing, and external collaboration – all protected by the most advanced end-to-end encryption.

Try our internal communications software. Simply create a team and start communicating and collaborating securely in minutes.

Looking for a walkthrough of our enterprise communication solution? Contact us today to learn how Wire fits into your organization.