Center for Applied Cybersecurity Research

Title: The Next Big Idea for Promoting Even Better and More Successful Innovations

Innovation is critical to improving society and is key within the cyber domain. The rapid growth of the internet has meant that tools for operating in cyberspace have constantly evolved. It has often been said, however, that the only innovation taking place in cyber warfare is in offensive operations. So where is the innovation for the defense? In order to defend the core of cyberspace against threats, is there sufficient defensive innovation? And if such innovation is truly happening, why does it seem as though attackers are always several steps ahead? To address these concerns, we examine four types of innovation. Sustaining and incremental innovations tend to generate improvements within existing systems but usually originate as reactive responses to market needs. Breakthrough and disruptive innovations target new markets and can proactively shape our environment in drastic ways. By understanding that clear distinctions exist within "innovation," we are then able to contest cyberattacks with those methods the adversaries employ. Rather than lament how cyber defense is failing, we are able to, instead, advance defensive innovations that will succeed. In this paper, we discover that nearly all offensive cyber tools, to include most computer viruses, worms, and other malware, fall into the disruptive realm-the type of innovations that are relatively cheap to produce, quicker to implement, and inherently more flexible because they utilize existing assets. Conversely, we find defensive cyber capabilities, such as intrusion prevention systems and micro-virtualization, are typically breakthrough innovations that are expensive, technologically more complex, and require extensive research. We believe that to systematically defend the core of cyberspace, every type of innovation is needed to ensure an acceptable level of cyber security. In particular, by refusing to concede disruptive innovation to cyber threats and pursuing this type of innovation for the defense, we can prevail against cyberattacks.

Bios

Lieutenant Colonel Ernest Y. Wong is a Military Intelligence Officer in the U.S. Army who is serving as the Chief of Staff at the Army Cyber Institute and an Assistant Professor with the Department of Systems Engineering at West Point. He graduated from the United States Military Academy with a B.S. in economics, and he holds a M.S. in management science and engineering from Stanford University, a M.A. in education from Stanford University, and a Master of Military Science from the Mubarak al-Abdullah Joint Command and Staff College in Kuwait. He had the opportunity to work as a NASA Summer Faculty Fellow and has served in overseas deployments to Iraq, Kuwait, and the Republic of Korea. His research interests include disruptive innovations, cyber resiliency, and the application of systems engineering tools for solving wicked problems.

2nd Lieutenant Ryan F. Gagnon is a Signal Corps officer serving the New York Army National Guard. He is a graduate of Rensselaer Polytechnic Institute where he received his Bachelor of Science in Computer and Systems Engineering. 2LT Gagnon has contributed to the efforts of the Army Cyber Institute as a research volunteer and was a coauthor for the article “Why Government Organizations Don’t Care: Perverse Incentives and an Analysis of the OPM Hack” published in the Heinz Journal at Carnegie Mellon University. His interests include cyber defense policy and military involvement within the cyber domain.