11 “Email the Way It Should Be”: The Role of Application Designers and Software Developers

Defensive lessons derived from past cybersecurity incidents are sometimes criticized for only helping people protect themselves against yesterday's attack methods instead of the innovative, never-before-seen, cutting-edge attacks likely to be leveled at them in the future. This is a valid concern, to some extent—focusing too much on the technical mechanisms used to compromise computer systems in the past could potentially blind a defender to other, newer techniques—but it's often overstated, especially when it comes to less technical lines of defense that revolve around economic, policy, and legal changes. Cybersecurity incidents, and the modes of compromise employed by their perpetrators, evolve less rapidly than this argument implies. None of the security incidents presented in the previous chapters are identical, but many share some common stages and techniques, including phishing, theft of authentication credentials, use of bots, and exfiltration of large compressed files. And in the immediate aftermath of many breaches—almost regardless of how or why they were perpetrated—people routinely fault targeted organizations for failing to implement the same two technical controls: multi-factor authentication and encryption. That same criticism has been leveled at the South Carolina Department of Revenue, the Office of Personnel Management, Sony Pictures, and Ashley Madison—all of whom suffered very different breaches, at the hands of very different intruders motivated by very different goals, across a span of several years. Intruders can and do come up with entirely novel means of compromising the computers they target, but more often they rely on at least some of the same techniques that have worked so well for others before them.