The IT sector, cybersecurity included, loves a good analogy some of them are accurate while others are less so. Comparing cybersecurity to martial arts to some may feel a tad dramatic or missing the point entirely. For a moment, humour me and listen to to way I feel martial arts and cybersecurity have more in common than the public is aware of.
Warfare Changes
At an individual level, any form of martial art has the protection of the individual as its core philosophy. How it achieves its goals of protecting the user has changed drastically over the years. Further, if a martial art is to remain relevant its needs to adapt to meet new threats.
Feudal Japan can be seen as an example of this. The Samurai for all their skill and prowess struggled to combat the threat posed by who they saw as peasants going against the powers that be. How did armed and armoured warriors trained from an early age struggle against farmers and tradesmen?
Those “peasants” developed a completely new form of martial art that focused on using the tools they had to take on armed individuals. Agricultural tools were used and modified to arm those who stood up against the Samurai. That new martial art became known as ninjutsu.
That is only half of the story. To take on experienced warriors used to open warfare on open battlefields, new tactics needed to be developed. The farmers and tradesmen adopted what we would term today as guerrilla tactics. The founders of ninjutsu realized early on that they could not face the Samurai on an open battlefield where bows, cavalry, and primitive firearms could decimate them. Hit and run tactics to harass and keep the enemy on the wrong foot was the decision that amounted to a tactical masterstroke.
Feudal Japan vs Digital Reality
With the combination of using the tools available and adapting tactics to combat a highly skilled enemy are lessons that can be learned from feudal Japan. These lessons are still apt in our digital age.
Like the Samurai much of the cybersecurity sector still adopts a very traditional mindset when combating cyber threats. This attitude has meant business leaders still think traditional prevention methods apply to modern threats.
A quick glance at the news headlines proves this not to be the case. Fortune 500 companies becoming ransomware victims, nation-state hackers impacting important facets of elections and democracy, state-sponsored groups have proven their ability to steal intellectual property. Clinging to traditional tactics and technologies is simply not working.
Rather, the mindset of the founders of ninjutsu needs to be adopted. Existing tools need to be repurposed with better tactics to counter the threat posed by the myriad of cyber threats. In our opinion tactics have become too passive. We build cybersecurity infrastructures like castles waiting to be attacked and hoping the walls hold.
Attackers are cunning and are not one for tackling walls head-on. That’s why tactics need to assume constant breach and in turn support active hunting of threats, adversarial pursuit, and active defense strategies. The malicious adversary can no longer be the alpha predator, that should be the spot in the cyber threat chain reserved for us – The Defenders