After 15 years the goal should be to make cybersecurity much less exciting

For that last 15 years there has been one inexorable fact about cybersecurity that remains a constant. The size and scope of the attack surface that needs to be defended keeps expanding. Fifteen years ago, the issue was securing PCs accessing servers on a network. Today there are now millions of mobile computing devices accessing sensitive data using a variety of wired and wireless networks that all need to be secured. To make matters even more challenging, servers are now running both on-premises and in public clouds. The applications running in those environments are also becoming more complex thanks to the rise of microservices based on containers that will soon span hybrid cloud computing environments. Add in pending wave of Internet of Things (IoT) devices, and it is abundantly clear managing cybersecurity is not for the faint of heart.

Given that ever-expanding landscape it should come as no surprise there is also now a chronic shortage of cybersecurity expertise. Each new wave of IT seems to arrive with little to no regard for cybersecurity. It’s only when inevitable cybersecurity issues raise their ugly head does it seem organizations start to consider the implications of attaching new platforms to their networks. Every new platform requires yet another of cybersecurity to be layered across those networks. Cybersecurity experts today are being asked to combat cybersecurity threats 24/7 every day of the year. They do a remarkable job employing every tool available. But they all know the odds are still stacked against them.

There is hope. Advances in machine and deep learning algorithms are making it possible to react to new threats as they emerge in real time using artificial intelligence. Cybersecurity teams will still be needed to craft and dynamically adjust cybersecurity policies as threats continue to evolve. But the ability to apply those policies will be almost instantaneous thanks to increased automation. The bad news is that cybercriminals are starting to appreciate the potential of machine and deep learning algorithms as well. It’s now a race to see who can leverage those algorithms to thwart the other.

In the meantime, cybersecurity will continue to much like any other job involving a strong focus on defense: extended periods of boredom punctuated by exhilarating moments of sheer terror. The truth is most cybersecurity professionals to one degree or another are adrenaline junkies. There’s nothing quite as much fun the hunt to determine where an active breach is occurring. There may be malware everywhere. But it’s only when that malware is active that things become really intense.

Despite the thrill of the hunt, however, the long-term goal should be to make cybersecurity boring. Some cybersecurity professionals might lament this should it ever happen. But the truth is there’s just too much at stake. Billions of dollars in damage is being inflicted every year. Cybercriminals working for organized crime rings that may be working on behalf one nation-state or another have become a plague on our digital society. It may be hard to envision today how that disease can be eradicated. But then again people once said much the same thing about everything from smallpox to cholera. A disease may never be completely eradicated. But we have proven time and again that as a society we know how to contain them.