For most of the years since World War II, American security policy has followed a familiar pattern. A threat would emerge, officials would meet and write a policy, secure the funding, and deploy countermeasures. Years later, these would be reviewed.
This worked when threats changed slowly. In today’s world, with the technological advancements that exist, security standards of yesterday are simply not enough. Inadequate standards can leave government agencies, defense contractors, the sensitive information they hold, and ultimately the entire nation vulnerable in ways never anticipated before.
This is not a problem just for the intelligence sector. When security standards fail, it seeps into critical national services and can cause serious harm. In May 2024, the Environmental Protection Agency reported that more than 70 percent of the community water systems it had inspected since September 2023 were not fully complying with federal risk-assessment and emergency-planning requirements.
Inspectors also identified cybersecurity weaknesses at some systems, including unchanged default passwords and shared staff logins. I have worked in the security industry for nearly 45 years, and I can confidently say that I have never seen a shift this fast in the industry. Artificial intelligence, open-source intelligence, 5G (and 6G in development), drones, encryption, and quantum computing are all reshaping the greater picture, and not a single one stands still.
Some work that once required substantial resources can now be done from a keyboard. The problem is that our security standards are not keeping up with the industry’s evolution. Many of them have been built to deal with old adversaries, understanding how they work and the tools they use.
And too often, success is defined as checking every box of these outdated standards and not being harder to attack. We can see the problem clearly upon closer inspection of secure facilities today. These are still often designed to protect against physical threats, like someone breaking in.
Extract — continue reading at the source.
