Why We Need to Invest in Internet Security

CSO — You’re businesspeople, right? Good. Then let’s talk about a business guru, innovation and profit margins for a moment.

Clayton Christensen is the business guru. He’s a Harvard prof and well-regarded author. His name is one that might hold some influence over your CEO.

The Internet is the innovation. Or at any rate, it’s the fertile ground from which innovations are growing like kudzu. Technology innovations, process innovations, lots of new stuff.

Now one of the things Christensen has said about innovations is this: The disruptive ones initially lower your margins. That’s right. A transformative new idea that changes markets, processes and workflows doesn’t usually pay off instantly for the innovator. It requires some investment in order to grow into what it will become.

Read Senior Editor Scott Berinato’s article on antiforensics, "How Online Criminals Make Themselves Tough to Find, Near Impossible to Nab," and you’ll see innovation at work. But you may not like the results. Investigators and researchers alike say hackers are forging new and more easily used technologies at a breakneck pace, effectively covering their digital tracks as they carry out whatever scam they please. As we’ve noted in other recent cover articles, Web application security is in a similar state—the good guys are working hard, but widespread adoption of their work is far, far behind the pace at which bad guys are implementing their own creative ideas. And social networking sites like MySpace are scrambling to catch up to miscreants playing in these new sandboxes.

I’ve never been a fan of the CSO-to-Board whine “We can’t quantify security but you aren’t spending enough money.” That’s why we incessantly write about metrics, return on investment and so forth. And yet when I consider the disruptive nature of the Internet, I have to conclude that CEOs are picking precisely the wrong moment in history to cheap out on cyber­security in the name of margins. Consciously or not, CEOs have ignored the inherent risks of the platform in favor of what looked like easy money. Now, as Berinato’s story points out, and as news stories every day confirm, those risks are boomeranging back at all of us.

So on April 26 of this year, when a group of cybersecurity experts testified before Congress and said that the United States’ critical infrastructure is vulnerable to a potential “strategically crippling cyber­attack,” my knee-jerk response was “Well, duh.” (See excerpts from the testimony of Aaron Turner of Idaho National Labs in front of the House Homeland Security Committee here.) There’s little you do online that’s safe. Everything attached to the Internet is vulnerable. All those enticing profits and efficiencies from Internet commerce are daily being erased by identity theft, phishing, spam and badware in general. And the margins won’t return until we get into a deeper investment mode and stabilize this platform.

Let me quote Christensen, from a 2004 Gartner interview: “The evidence really is strong that when a corporation needs that new business to get very big, very fast, they won’t allow it to take that time on the runway—the time to make sure it’s headed in the right direction. They just force it to take off very quickly and almost always, it fails.”

Precisely what we’re doing with the Internet. This is a time of disruptive innovation and some investment in security groundwork is sorely needed. CEOs, let me give it to you straight: You aren’t spending enough money.

E-mail Derek Slater, at dslater@cxo.com.