Multiple factors are driving the need for higher-level strategic approaches to cyber security, as states and communities adapt to ubiquitous technological advancements, globalized platforms, and digital economies that are affecting nearly every aspect of our lives, our communities, and the global interactions among states and economies, which have become increasingly complex and intertwined.

 

New and additional players are involved in cyber security, such as cyber lawyers, cyber insurance providers, regulators, and law- and policy-makers, at multiple levels of government. IT and security disciplines themselves are maturing and professionalizing, and are adapting to automation and technological advances, one such example is the introduction of AI into fraud and forensic investigation. Additionally, new security and cyber security disciplines are emerging, such as security convergence, and cyber security economics. The proliferation of unique interests, influences, and objectives among cyber security professionals and disciplines may result in different, and even conflicting, directions being taken in cyber security. This conflict may be reduced or managed through cross-discipline awareness and engagement, and a more strategic approach that transcends individual disciplines and actors.

 

One example of such conflict is that the security community in general is trending toward greater regulation, and specificity in standards and certifications, while the business community is trending toward a demand for less regulation and specificity, to stimulate innovation, reduce barriers to sector entry, and to foster competition that drives innovation. Another example is that law enforcement and intelligence communities may resist encryption as an enabler of threats, while the cyber insurance sector may encourage encryption as a reasonable measure that businesses may take to protect data and reduce liability risk. Additionally, social media platforms, largely privately owned, are facing increasing pressure in the public interest to monitor and attribute content to limit social harms, which may in turn risk limiting anonymity and freedom of speech, which are also in the public interest, and have traditionally been public sector responsibilities.