Cybersecurity for everyone

The current generation of firewalls and intrusion detection systems were designed for a world where cyber attacks were executed by humans using known techniques. That world is changing rapidly. AI is enabling attackers to design novel attack vectors faster than human defenders can respond. The solution is Firewalls 2.0: AI-powered network protection systems that learn and adapt in real time. What Firewalls 2.0 does differently: • Instead of checking traffic against a database of known attack signatures, it builds a behavioral model of what "normal" network traffic looks like for a specific organization, and flags any deviation • It can detect novel attack types that have never been seen before, because it's looking for anomalous behavior rather than specific signatures • It shares threat intelligence in real time with other organizations running the same system, so an attack on one becomes a warning for everyone • It can automatically isolate compromised systems before human responders even receive an alert Implementation: This technology exists today, developed by companies like Darktrace, Vectra AI, and others. The barrier is adoption and standardization. Policy interventions: • Mandate Firewalls 2.0-class protection for all government systems (some agencies already require this) • Create a national cybersecurity standard that private sector critical infrastructure (power grids, water systems, hospitals, banks) must meet • Fund deployment assistance for smaller governments and organizations that cannot afford these systems independently • Create an international threat-sharing network, automated, real-time, with strong privacy protections

Cyber attacks are transnational by nature. An attack on a US power grid might originate from servers in 12 countries. Effective defense requires international cooperation at a level that does not currently exist. What needs to happen: • A binding international treaty on cybercrime, with real enforcement mechanisms, the current Budapest Convention is voluntary and lacks enforcement teeth • International standards for critical infrastructure protection (power grids, water systems, financial systems, hospitals), so that a nation with weak protections cannot be used as a vector to attack its partners • An international cyber incident response team, analogous to the IAEA's nuclear incident response team, that can be deployed quickly to any nation experiencing a major attack • Norms against attacking civilian infrastructure, analogous to Geneva Convention protections for hospitals and civilians in conventional warfare Attribution reform: One of the biggest challenges in cybersecurity is attribution, figuring out who conducted an attack. Current attribution takes months and is often disputed. Better technical standards and international cooperation on forensics would dramatically improve attribution speed and accuracy, making deterrence more effective. The US-China dimension: US-China cyber tensions are one of the most significant geopolitical flashpoints. A bilateral cyber-truce agreement, focusing on critical infrastructure specifically, would reduce the risk of accidental escalation and free resources for both nations to focus on economic and technological competition rather than destructive cyber operations.

The most dangerous cyber threat is not ransomware hitting companies, it is attacks on critical infrastructure: power grids, water treatment facilities, hospitals, financial systems, and nuclear facilities. The consequences of a successful attack on these systems would be catastrophic. A successful attack on the US power grid in winter could kill thousands from cold exposure within days. An attack on water treatment could cause mass illness. An attack on hospital systems during a health crisis could be devastating. What makes critical infrastructure uniquely vulnerable: • Many systems run on decades-old software with known vulnerabilities, because replacing them is expensive and disruptive • Operational technology (OT) systems, the computers that actually control physical equipment, were often designed without cybersecurity in mind • The "air gap" between OT and IT systems that used to provide protection has been bridged in many facilities for efficiency reasons Policy solutions: • Mandate security audits and updates for all critical infrastructure operators, with government funding for compliance • Create a dedicated critical infrastructure cybersecurity agency (the US's CISA is a step in this direction but needs more resources and authority) • Require "secure by design" standards for all OT equipment sold in the US and allied nations • Establish a rapid response capability specifically for critical infrastructure attacks • Invest in redundancy, backup systems that activate automatically if primary systems are compromised 🔬 Research is still underway on the most cost-effective ways to secure legacy industrial control systems (ICS/SCADA). If you have expertise in this area, please contribute in the submissions section below.

AI is already being used by attackers to automate and scale cyber attacks. The defense side needs to match this capability. AI applications in cybersecurity defense: • Automated vulnerability scanning: AI can continuously scan an organization's systems for vulnerabilities faster than any human team, and automatically flag or patch them • Phishing detection: AI can identify sophisticated phishing emails that fool humans, by analyzing linguistic patterns and metadata • Identity verification: AI-powered behavioral biometrics (how you type, how you move your mouse, how you hold your phone) can detect account takeovers in real time, even when attackers have correct passwords • Incident response automation: AI can automatically contain and isolate compromised systems, buying time for human responders and limiting damage The risk: AI tools are also available to attackers. They can generate convincing phishing emails, create novel malware, and find vulnerabilities faster. This creates an arms race dynamic that favors whoever can deploy AI most effectively. International governance of offensive AI cyber capabilities: Just as there are norms against certain conventional weapons, there should be international agreements against using AI for attacks on civilian infrastructure. This is an area where diplomatic work is urgently needed and relatively few actors are focused.