Why Cyber Security is Hard: Cyber Security as a Complex Adaptive System

We face immense challenges in securing the information assets and intellectual property of our public and private organizations. Yet only a few years ago, the cyber war was often derided and declared a mere nuisance to business as usual. Painful experiences, such as the Sony, RSA and recent Swift Banking attacks have helped to dispel this naive stance. The truth of cyber security, however, is both overt and subtle. It is overt in the sense that the arena is driven by a wicked mix of political expression, such as the anonymous social hactivism movement, and economic incentives for criminal gangs, up to state-sponsored industrial espionage. The less obvious facet of cyber security, however, is why it remains a hard problem. Specifically, the mix of technical, policy, and social dimensions have combined to create a coevolving, complex adaptive system. More importantly, once we accept this is the case, it perforce reshapes our entire policy and technical approach to the problem. Ultimately, we cannot solve a complex adaptive system; at best we can merely shape and influence its evolution. First we will overview what we mean by a complex adaptive system (CAS) in the cyber domain, and then review the characteristics of the associated cyber security themes: technical, social, and legal.