We Can Do This

As America approaches its 250th birthday and I approach my 500th podcast episode, I’ve been doing a lot of thinking. I’m hoping you’ll humor me for a bit as I wax philosophical. Don’t worry, I won’t get political (we have too much of that already). And yes, this will still be about cybersecurity and privacy – and not only applicable to America. Here goes.

We’re All Connected

One of the concepts that resonated most with me from Carissa Véliz’s book, Privacy is Power, is that we are all in this together. Your privacy overlaps my privacy. Your data – documents, photos, social media posts, even your genetic code – contains information about other people, too. If your data is leaked, stolen, or abused, it can have negative consequences for your friends and family.

The same is true for security. If one of the devices on your home network is infected with malware, it could attack the devices of your guests when they connect to your WiFi. The infected device can also be manipulated remotely by bad guys to attack public servers and infrastructure, probably without you ever even knowing it’s happening.

Like it or not, we’re all connected. It’s not just about you. If your data or devices are compromised, they can impact the rest of us – potentially affecting people who are much more vulnerable and have a lot more to lose than you do.

The Time Is Now. Really.

I do my best to avoid hyperbole. I don’t cry wolf unless I believe that I see a wolf. But there are good reasons why we need to get our digital houses in order sooner rather than later. I’ve been doing this for 10 years now and I’m here to tell you, things are fundamentally different today, for at least two reasons.

First, our critical infrastructure is being actively probed and, in some cases, compromised. Hostile nation-state actors like China, Russia, North Korea and Iran have already gained persistent access to portions of our critical infrastructure. This Congressional testimony from early 2024 by the heads of CISA, FBI, and NSA was astonishing and didn’t get nearly enough attention. (You might also listen to my interviews on this topic.)

Second, artificial intelligence – in particular, the latest versions of chatbots like ChatGPT, Claude and Gemini – has significantly shortened the time between discovering vulnerabilities and weaponizing them. The time it takes for bad guys to identify weaknesses and compromise systems has gone from months or weeks to days or even hours. Our legacy systems, like those often found in critical infrastructure, are going to be prime targets.

So you’re probably asking yourself: what can I, a regular person, do about any of that? Turns out, it’s not nothing. And many of the highest-impact things you can do are also among the simplest.

A Useful Digital Idiot

While the average person can’t directly defend our water facilities, electrical grid, banking systems, or food supply, we do still have an important role to play to protect each other and our critical infrastructure. Bad guys don’t like to attack directly from their own infrastructure. It not only opens them to counterattack, it makes it easier to block the attack in the first place. It also removes any chance at plausible deniability.

Instead, bad guys like to conscript our consumer devices to do their dirty work and hide their tracks. This is done by either directing them to participate in attacks (a botnet) or using them as stepping stones to disguise the true origin of an attack (known as proxying). Nation-state attackers don’t need to compromise every router – they need thousands or tens of thousands. Every vulnerable device removed from that candidate pool makes these attacks a little harder.

Let me put a fine point on this. Your router, TV, webcam or smart fridge may be, at this very minute, actively harming someone else. And the digital trail for this attack will lead right to your doorstep (well, your router, anyway).

Less Vulnerable, More Resilient

So, what can you do about any of this? I’m going to propose you focus on two things: reduce your vulnerability and increase your resilience. The first may sound obvious. In the security biz, we call this ‘reducing your attack surface’. Improve the security of the devices where you can, and remove the devices that can’t be made secure.

But if we’re thinking about our collective security, then we also need to be more resilient in the face of attack. If the attack is broad, the more of us who can recover or just get by on our own, the more we free up the professional incident responders. And perhaps we can even be there for our neighbors in need, too.

I couldn’t help but think about old wartime campaigns like planting Victory Gardens, collecting scrap material, and even turning off lights and closing blinds at night. Even the “loose lips sink ships” slogan can be applied to protecting data. It was seen as a patriotic way for average citizens to do their part, helping everyone with small personal commitments and sacrifices.

In the coming months, I’m going to publish a series of articles on how to be a good digital neighbor – and a good digital citizen. I’m going to focus on the simplest, most effective ways to reduce your likelihood of attack while making you better able to handle one if it occurs. But while these tips will definitely help you, the overarching purpose of these articles will be to improve our collective security and privacy.

We’re all in this together, folks. I don’t mean to paint this explicitly in terms of warfare – it’s (hopefully) just a metaphor. But security and privacy aren’t just me things – they’re we things. Working together, we can make things better for all of us. My hope is to inspire you to get your own digital house in order, then help your family, friends, and neighbors do the same.