Fighting Back Without Hacking Back: Why “Risk Management” Isn’t Enough In The Era of Cyber War

Fighting Back Without Hacking Back: Why “Risk Management” Isn’t Enough In The Era of Cyber War

Speakers: Tom Millar (CISA)

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=yQAz5v_EZtc

Overview

In an era marked by a profound shift in the cyber threat landscape, Tom Millar of the Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with Adam Shostack, delivered a compelling talk at FIRSTCON challenging the efficacy of traditional risk management frameworks. Titled "Fighting Back Without Hacking Back: Why 'Risk Management' Isn’t Enough In The Era of Cyber War," the presentation argued that the world has undergone a "phase change" where cyberattacks are no longer merely about espionage or data theft but have evolved into direct threats capable of disrupting critical systems and impacting societal functions.

Millar highlighted that this new reality, which he broadly terms "cyber war" without delving into its precise definition, demands a fundamental reassessment of how organizations, and indeed nations, approach cybersecurity. The core premise is that long-established methods of identifying, assessing, and mitigating risks, often centered on an enterprise's internal operations and profitability, are woefully inadequate against adversaries intent on causing widespread damage. The talk underscored the urgent need for a pivot towards resilience and proactive defensive strategies that acknowledge the inevitability of breaches and focus on sustaining operations in a hostile environment.

The significance of this discussion cannot be overstated. As nation-state actors and sophisticated criminal groups like Sandworm and Volt Typhoon demonstrate capabilities to disrupt critical infrastructure, public health systems, and supply chains, the stakes have escalated dramatically. Millar’s presentation serves as a clarion call for cybersecurity professionals and decision-makers to transcend the limitations of conventional risk management and adopt a more strategic, society-aware, and siege-oriented mindset to protect foundational services and the very way of life.

Background

▶ Watch: Introduction: Why risk management fails in cyber war (1:30)

The premise of Millar’s talk rests on the assertion that the cyber threat landscape has undergone a fundamental "phase change," rendering traditional risk management frameworks (RMFs) obsolete. Historically, cybersecurity concerns revolved around the CIA triad—Confidentiality, Integrity, and Availability—primarily within the confines of an organization's IT systems. As IT became embedded across all business functions, RMFs expanded to encompass risks to the enterprise. However, the current reality sees IT pervasive across entire sectors and society, elevating cyber risks to a national security concern.

Several factors contribute to this escalated threat environment. First, the sheer volume of CVEs (Common Vulnerabilities and Exposures) discovered annually continues to climb, a trend exacerbated by the advent of AI-enabled vulnerability discovery. As Adam Shostack terms it, this is a "second derivative" problem, meaning the rate of increase in vulnerabilities is itself increasing, creating an overwhelming challenge for defenders. Attackers, unlike defenders, are not bound by coordinated vulnerability disclosure (CVD) processes, compatibility requirements, or planned patching cycles; they merely need to find and exploit a single weakness. Their ability to scale attacks with compute resources far outstrips the defender's capacity to scale defenses, which often involves committees and slow, deliberative processes (as noted by Casey John Ellis).

Second, software supply chain attacks have moved mainstream, demonstrating their profound impact. The talk referenced the Sunburst attack, a sophisticated intrusion that compromised numerous government agencies and private companies via a trusted software update, as a prime example of how adversaries can exploit the very mechanisms designed to improve systems. Such attacks, Millar emphasized, go far beyond simple info-stealing or crypto-mining operations, posing existential threats to organizational integrity and national security.

Third, the motivations and capabilities of adversaries have shifted. Beyond traditional espionage or financial gain, nation-state actors and sophisticated criminal syndicates are now actively engaging in disruptive and destructive attacks. Examples cited include Sandworm (known for attacks on Ukrainian power grids), Volt Typhoon (implicated in targeting critical U.S. infrastructure), and ransomware groups disrupting public health systems. These incidents highlight a deliberate intent to break systems, persist for future disruption, and cause tangible harm to society, not just data breaches. This emerging threat paradigm, which Millar refers to as "cyber war," demands a defensive posture that moves beyond enterprise-centric risk calculations and considers the broader societal and national security implications, or the "national security delta."

Key Findings

▶ Watch: Risk frameworks haven't kept pace with societal-level threats (10:00)

The central finding of the talk is that the prevailing paradigm of risk management, particularly within enterprise IT, is fundamentally inadequate for the current and evolving cyber threat landscape. Millar articulated that a "phase change" has occurred, shifting the focus of cyberattacks from data compromise to direct, systemic disruption capable of impacting critical infrastructure and the very fabric of society. This necessitates a radical departure from traditional approaches.

Millar identified several critical shortcomings of conventional risk management:

1. Enterprise-Centric Focus: Traditional RMFs are designed to protect an organization's assets and business continuity, often overlooking the broader national security delta—the gap between what even the most well-resourced enterprises protect and what a nation-state adversary might target for strategic disruption.
2. Slowness and Deliberation: The deliberative nature of risk assessment, which involves calculating likelihoods and impacts, is too slow for adversaries who scale with compute and exploit vulnerabilities at an unprecedented pace. The emphasis on gathering "all information" before action can become a liability.
3. Inability to Account for Cascades: Enterprise risk management rarely fully accounts for the complex, cascading effects of failures across interconnected supply chains, utilities (water, power), and telecommunication providers. A breach in one sector can rapidly destabilize others.
4. Acceptance as an Excuse Not to Act: The concept of "risk acceptance" often becomes a justification for inaction, particularly when mitigation costs are high, effectively externalizing the social cost of potential failures.
5. Over-reliance on Prevention: A disproportionate focus on preventing breaches has left organizations vulnerable when sophisticated adversaries inevitably bypass initial defenses. Millar stressed that a committed adversary will always find a way in.

The talk concludes that a new mindset, termed a "siege mindset," is imperative. This mindset acknowledges the inevitability of breaches and prioritizes resilience—the ability to sustain operations and recover from attacks—alongside prevention. Key to this shift is not just enhancing security investments but strategically reallocating resources to focus on secure by design principles, robust operational log analysis for rapid detection, and fostering partnerships with government entities to leverage shared intelligence and resources. The ultimate goal is to dramatically increase the cost of sophisticated cyberattacks for adversaries, potentially forcing them back to less scalable and more detectable methods, such as insider threats, effectively pushing them back to a "Bronze Age" of cyber warfare.

Technical Deep Dive

▶ Watch: Adopt a 'siege mindset' to increase attacker costs (14:00)

The technical deep dive into Millar's arguments reveals a fundamental challenge to the foundational principles of modern cybersecurity. The evolution from the CIA triad—Confidentiality, Integrity, and Availability—as the primary concerns for IT systems, to the current state where cyberattacks threaten entire sectors and societal functions, is a critical shift. Initially, risk management frameworks (RMFs) were tailored for IT systems, then expanded to encompass business risks as IT became ubiquitous. However, Millar contends that we have failed to keep pace as IT now underpins critical infrastructure like water, power, transportation, and telecommunications, making cyber risks a matter of national security.

Millar elaborated on the limitations of traditional RMFs, emphasizing that they are inherently designed for an enterprise-level scope, which is insufficient to address the "national security delta." This delta represents the difference between the sophisticated defenses of even the most well-resourced organizations (e.g., hyperscalers, financial institutions) and the capabilities of nation-state adversaries whose intent may be to cause deliberate, widespread disruption in the event of a kinetic conflict. These adversaries are not merely seeking to exfiltrate data or disrupt services temporarily; they aim to "brick boxes on purpose" and cause lasting damage to systems vital for a nation's functioning.

A significant technical disparity highlighted is the asymmetry between attackers and defenders. Attackers scale with compute power, rapidly discovering and exploiting vulnerabilities. The proliferation of CVEs, driven partly by AI-enabled vulnerability discovery, means the rate of new vulnerabilities is accelerating—a "second derivative" problem. Defenders, conversely, are burdened by coordinated vulnerability disclosure (CVD), the need for backward compatibility, and the complexities of patching across vast, heterogeneous environments. This inherent imbalance contributes to the "siege" mentality Millar advocates, where breach is an assumed outcome rather than a preventable one.

The discussion extended to the profound impact of software supply chain attacks, exemplified by the Sunburst incident. These attacks exploit the trust inherent in the software development and distribution ecosystem, allowing adversaries to embed malicious code into widely used applications. This bypasses traditional perimeter defenses and directly compromises the integrity of systems at a fundamental level, demonstrating a sophisticated attack vector that conventional risk assessments often struggle to fully model or mitigate due to their narrow, enterprise-focused scope.

Millar contrasted traditional RMFs with alternative risk models from other domains to illustrate more effective approaches to systemic hazards:

• FDA (Food and Drug Administration): Focuses on setting acceptable levels of unavoidable hazards (e.g., insect parts in peanut butter) while ensuring overall safety—a pragmatic approach to inherent risks.
• CDC (Centers for Disease Control and Prevention): Emphasizes eliminating hazards for occupational safety, prioritizing the complete removal of threats when lives are at stake. This reflects a proactive, hazard-centric view rather than merely managing probabilities.
• FEMA (Federal Emergency Management Agency): Through its National Flood Insurance Program, FEMA not only offsets flood costs but also regulates development in flood-prone areas. This demonstrates a model where risk mitigation involves systemic changes and responsible stewardship of resources, preventing future harms rather than just insuring against them.

These examples underscore the argument that cybersecurity needs to adopt a more comprehensive, hazard-elimination, and resilience-focused approach, moving beyond a purely probabilistic, enterprise-centric view of risk. The "siege mindset" entails not just understanding the immediate risks to an organization but also recognizing its interconnectedness with broader critical infrastructure and preparing for cascading failures when core services like telecoms or power grids are compromised. This demands a deeper technical understanding of interdependencies and the development of robust fallback mechanisms and manual operations plans.

Demo / Proof of Concept

▶ Watch: Strategic argument: Start with the truth, assume breach (22:00)

This particular talk was a high-level strategic and conceptual presentation, focusing on a paradigm shift in cybersecurity thinking rather than demonstrating specific tools, exploits, or defensive techniques. As such, there was no live demo or proof of concept presented during the session.

Defensive Implications

▶ Watch: Reallocate security budget from prevention to resilience (24:00)

The defensive implications stemming from Millar's talk are profound, advocating for a fundamental shift in cybersecurity strategy from a prevention-centric model to one that prioritizes resilience and assumes breach. Organizations must adopt a "siege mindset," acknowledging that sophisticated adversaries will inevitably penetrate defenses. The goal then becomes not merely to prevent entry, but to "end the siege" by rapidly detecting, containing, and recovering from intrusions, minimizing their impact.

Key defensive strategies include:

1. Reduce Attacker Return on Investment (ROI): The ultimate aim should be to increase the cost of performing sophisticated cyberattacks to such an extent that adversaries are forced back to less efficient, "Bronze Age" methods, such as relying on insider threats. This involves making advanced persistent threats (APTs) prohibitively expensive and difficult to execute successfully.
2. Partner with Governments: Millar stressed the critical importance of collaborating with national and allied government entities, such as CISA. Governments possess unique intelligence, resources, and threat visibility that private organizations do not, making them invaluable partners in understanding and countering nation-state threats.
3. Up Operational Log Analysis Tempo: Given the inevitability of breaches, enhanced operational log analysis is crucial for early detection. Organizations must invest in capabilities to continuously monitor logs, identify anomalies, and rapidly respond to indicators of compromise (IOCs), rather than solely relying on perimeter defenses.
4. Secure by Design: This principle mandates that security be baked into the development lifecycle from the outset, rather than being an afterthought. Organizations should not only implement secure by design internally but also demand it from their vendors, procuring software and hardware that are inherently more secure and resilient, ideally avoiding reliance on outdated systems.
5. Deliberate Investment in Resilience: A significant shift in budget and focus is required from solely prevention-focused measures to building resilience. This means developing robust disaster recovery plans that account for widespread, cascading failures across critical infrastructure (water, power, telecoms, logistics). Organizations must be able to sustain operations, even at a reduced capacity, for extended periods without external assistance, and understand their dependencies on potentially compromised suppliers.
6. Assume Breach: This mindset dictates that security planning should start with the premise that an adversary is already inside the network or will get in. This informs strategies for segmentation, least privilege, incident response, and continuity of operations, extending beyond an organization's own crown jewels to include the critical systems of its supply chain partners.
7. Decisive Action over Deliberation: In a rapidly evolving threat landscape, the traditional deliberative approach to risk management, which often delays action while gathering exhaustive information, is detrimental. Organizations must be prepared to make decisions and act as soon as "enough information" is available, prioritizing speed and agility.
8. Reallocate Security Budgets: Instead of simply demanding more budget, Millar suggested reallocating existing security funds. This means potentially investing less in perimeter prevention technologies that a determined adversary will bypass anyway, and instead channeling those resources into resilience, secure by design initiatives, and advanced operational log analysis capabilities.

These implications collectively call for a strategic reorientation, moving from a reactive, enterprise-specific defense to a proactive, ecosystem-aware, and highly resilient posture capable of withstanding state-sponsored and sophisticated cyber threats.

Key Takeaways

• The Era of Cyber War: The cyber threat landscape has undergone a "phase change" where adversaries, including nation-states like Sandworm and Volt Typhoon, are actively seeking to disrupt critical systems and societal functions, not just steal data or engage in espionage.
• Traditional Risk Management is Insufficient: Enterprise-focused risk management frameworks (RMFs) are too slow, too narrow, and fail to account for cascading failures across interconnected critical infrastructure or the broader national security delta of cyberattacks.
• Assume Breach and Prioritize Resilience: Organizations must abandon the notion of perfect prevention and operate with an "assume breach" mindset, making resilience—the ability to sustain operations and recover from attacks—the primary cybersecurity objective.
• Adopt a "Siege Mindset": Prepare for sustained attacks by focusing on strategies to increase the cost for attackers (reducing their ROI) and ensuring continuity of operations even when critical systems or supply chains are compromised.
• Embrace Secure by Design and Enhanced Detection: Demand secure by design principles from vendors and invest heavily in operational log analysis to detect and respond to intrusions rapidly, rather than solely relying on perimeter defenses.
• Strategic Partnerships and Resource Allocation: Partner with government entities for threat intelligence and resources, and strategically reallocate security budgets from prevention-heavy measures to initiatives that build resilience and intrinsic security.

About the Speaker(s)

Tom Millar is a representative from CISA, the Cybersecurity and Infrastructure Security Agency of the United States. His work focuses on the strategic implications of cybersecurity and infrastructure protection, particularly in the context of evolving threats and national security. He draws on experience from institutions like the National Defense University, contributing to high-level discussions on cyber warfare and defense.

The talk was co-developed with Adam Shostack, a recognized expert in threat modeling. Shostack is associated with Shostack and Associates, and previously worked at Microsoft. He is known for authoring several books on threat modeling and maintaining a blog, making him a prominent voice in the cybersecurity community, particularly regarding proactive security design and risk assessment. Although a co-developer, Adam Shostack was unable to present at the conference.