The epicenter of cyber is Washington, D.C., and the discourse radiates from the national capital outward. The question is how far from the Beltway it reaches. Does the rest of this nation care about the national security threat that is embedded in future adversarial cyber operations?
One of my major cyber concerns for the next 10 years is how to disseminate the cyber knowledge into small-town America. The vast majority of the utilities, plants and local government facilities are located in small towns and communities. The United States has 3,500 counties, 18,000 state and local police departments, and 50,000 water utilities of various sizes — just to give you an idea of the scale of local government. This disconnect between the federal level and the local communities is nothing unique for cyber. Implementation is a challenge for every public program just because the sheer size of the volume of information and guidance that have to be communicated, disseminated and checked.
Cyber is unique because it allows states to engage in a conflict within another country and engage the target with limited ability for the targeted nation to identify, intercept and prevent the attack. This increases the number of potential targets astronomically and it also affects the society at all levels and locales when every part of our society can be cyber attacked.
I live in a small town with two Waffle Houses, one IHOP and one post office where you are greeted as family, but it also has three major food-processing plants, a rubber factory, a larger energy utility and a sizeable sawmill. Cyber security is naturally a part of the operating procedures for the major corporations, but is not really on most people’s mind. Here lies the challenge: How can we change the mindset so cyber is seen as a local problem and not an issue to be handed off to the federal government?
The critical infrastructure and the manufacturing base of America are located in thousands of these small towns. If the drive for increased cyber security and ability to reach national cyber resilience do not reach these communities, these incentives are pointless exercises.