Cybersecurity and time (and why brakes matter).

François Lavaste, CEO of Airbus DS Cybersecurity gave a "Thinking Forward" talk about "Cybersecurity and Time." He offered some useful ways of thinking about the role of defense, and about how one might bring some clarity to the vexed question of how security might deliver positive return-on-investment.

What makes the life of an attacker great, Lavaste began, is the lack of "speedy reaction" on their targets' part. That attackers innovate rapidly and that this rate of innovation is increasing are not in dispute, but Lavaste was calling for a different way of buying time. "Some argue that detection and reaction merit more attention than prevention," he said, but "this is only partially true."

The true goal of perimeter security, he argued, is to gain time, and that goal remains important. Deceptive cyber security measures—honeypots, traps, and so on—can become particularly effective when combined with preventive measures.

We've seen great reductions in time-to-execute in the financial sector, and these have been achieved through selective automation. We can see, Lavaste predicted, a similar move to automation in cyber security.

Lavaste noted that cyber security is a critical component of "digitalization," as the move to newer business models where digital transactions hold a central position is called in Europe. Digitalization represents an important shift because it provides new opportunities to generate revenue and create value—it enables enterprises to go fast. We often ask how we can position cybersecurity as a set of tools that add value, and deliver a positive return-on-investment. Lavaste suggested a useful way of thinking about cybersecurity: it's like the brakes on a car, which, when you think about it, "enable you to go fast." Thus in any fast-moving enterprise, cybersecurity will be critical to its ability to reach and maintain a high speed.