Cybernetics and Cybersecurity

We have known the principles of cybersecurity for more than 70 years. The architecture of computing systems has not changed in this time span. We continue to produce what is essentially the same hardware and software. Personally, I don't care to debate whether the frequency of cybersecurity related failures have increased in relationship to the proliferation of technology. I do care to discuss why these failures continue.

I see two questions ahead of us: (a) why is a mature field like cybersecurity consistently failing and (b) will computing systems architecture change in the (near) future such that cybersecurity models will fail even more often.

Cybernetics

I think the answers to these questions may be found in a different field of study altogether. For one example, cybernetics is the study of communication and control systems. The relevance to cybersecurity may be embedded within our notion of systems. We can investigate further through the science of systems thinking which leads to systems of systems and so forth.

Additionally, cybernetics gives us the concept of cyberspace. I suggest this concept makes more sense when we interpret cyberspace as a general boundary within which cybernetic systems exist. Certainly this includes cybersecurity but encompasses more at the same time. In fact, the basis of my argument is that we ought to consider not specific constructions (such as a computer or a network) but cybernetic systems layered within cybernetic systems, layered within cybernetic systems and so on all inside the notion of cyberspace. Keep this in mind while we explore another idea.

Cybersecurity

With cybernetics explained, we should explore the idea of cybersecurity. I mean, someone, somewhere is reading this and asking, what is cybersecurity. The field hasn't done itself any service by changing names frequently, overspecializing and spawning new titles, and exchanging names without changing concepts. Information security, information assurance, data security, cyber, cybersecurity, and so forth. I suggest we take cybersecurity broadly and let the term include all of the above as well as any other concepts related to the security of cybernetic systems (in all related layers) as well as cyberspace itself.

Moreover, cybersecurity traditionally has applied itself to specific constructions. That is, we have firewalls and intrusion detection for computer networks. We have antivirus for personal computers. We have static and dynamic tools to analyze source code and binaries. The list goes on and will grow in the future as more of the same cybernetic construction substrate (hardware and software) expands further. I contend the failures will go on too.

Relations

Put simply, I think cybersecurity is consistently failing because the relation between security and cyber is misaligned. The relation between concepts such as availability, confidentiality, or integrity and instantiated constructions within cyberspace is wrong. Remember when I asked you to keep the layered notion in mind? The correct relation is to align cybersecurity concepts with systems and systems of systems as part of the first principles meta to all of the models.

More specifically, these relations can be combined into four models: system to system, system to data, data to system, system to user, user to system, user to user, data to user, and user to data. Likewise, I suggest even if we experience a paradigm shift in computing architecture (e.g., quantum ), cybersecurity will not fair better unless the relations are realigned. Do you agree?