How should we approach the development of cyber-policy and -infrastructure given the “short arm” of predictive knowledge?

The short arm of predictive knowledge refers to the difficult challenge of anticipating what the future holds. In certain circumstances, situations evolve in a steady and predictable way. There is a wealth of data to draw from and make predictions. In these scenarios, predictive capabilities are robust and effective. Due to the constantly evolving and dynamic nature of the cybersecurity environment, predictive knowledge is often less reliable. While analysts have many tools and techniques to help make accurate predictions about what will happen in a given environment, this task is incredibly difficult when it comes to cybersecurity. The technology involved is complex and rapidly updating, the ways to exploit it are just as complex and transforming.

This reality provokes a few important suggestions for the way we address cyber-policy and -infrastructure. The first is that the framework we build pursuant to consistently good outcomes must be adaptable. If the primary difficulty is that the threats and challenges are constantly evolving, then the solutions to them must also evolve. This means rigid approaches aren’t viable. In order to maintain this adaptability, cybersecurity experts and institutions must stress the importance of monitoring and analyzing information to address threats as they happen. This means that if a new, unpredicted threat emerges, it will be spotted quickly. The monitoring and analysis must also be done at a systemic level to track trends in the industry and better spot macro level changes in the cybersecurity threat environment. Additionally, having domestic and international collaborations in place will allow the sharing of this information should new trends be spotted.

Finally, policy makers must work closely with industry leaders to maintain an intimate view of the CS environment. A dedicated group of political leaders should be tasked with developing this understanding and have regular meetings to review the latest trends, updates and important information. This will allow quick and effective legislative measures should unpredicted events occur that require such action.