Building a resilient nation: A public-private imperative

When it comes to cyberattacks, it’s no longer a question of if, but when. In fact, for many organizations in the U.S., cyberattacks are already a fait accompli, leaving organizations to pick up the pieces of the IT environment following a successful breach. If there’s one thing this has taught us, it’s that threat actors aren’t discriminating between the public or private sector. Each organization has valuable data, which means each is a viable target.

The reality of this new threat landscape has made cyber resilience — or the ability to fight, withstand and recover from a cyberattack — an operational imperative. Moreover, with threat actors targeting both public and private organizations in the U.S., it’s time for cyber resilience to be woven into the very fabric of our nation.

What we’re still getting wrong about cybersecurity

The first step in building a resilient nation is realizing what many organizations, both public and private, are still getting wrong about cybersecurity. For example, we’re still seeing many organizations take a one-size-fits-all approach to cybersecurity by only deploying one cybersecurity solution to protect their entire IT environment.

While a one-size-fits-all approach may make it easier to manage a cybersecurity solution, it actually hurts an organization’s security posture. Once they’ve breached your IT environment, threat actors will have an easier time employing lateral movement to breach other areas of your digital infrastructure — including areas that hold the most sensitive or proprietary information. This is why organizations must leverage their most restrictive cybersecurity resources for their most critical assets.

Many organizations are also misplacing their cybersecurity focus. In other words, when trying to protect their IT environment, IT leaders remain focused on unauthorized or malicious behavior. The truth is their focus should also be on allowed behavior. Both public and private organizations must ask themselves, “What are we willingly letting into our IT environment and, despite potential productivity benefits, how is it affecting our security posture?”

Lastly, we must collectively shift how we think about infiltration as a nation. Once a threat actor infiltrates an environment, that doesn’t mean the proverbial battle is lost. Rather, cyber defenders win when they stop threat actors from achieving their ultimate goal (e.g., accessing sensitive information, ransomware, etc.). This is why a multi-layered cybersecurity approach is important. It forces threat actors to jump through multiple hoops to achieve their goals.

Industry factors affect both the public and private sector

Right now, the public and private sectors are facing many of the same outside forces as they craft their cybersecurity efforts. Case in point: the IT skills shortage shows no sign of letting up. In fact, 77% of organizations have reported that staffing and resource issues are among the greatest challenges impeding resilience. Even further, AI is an in-demand skill for enterprises, and as the adoption continues, this demand isn’t expected to slow down.

Speaking of AI, its proliferation has also provided benefits such as productivity and a decrease in human error. While AI has advantages, it also makes life easier for threat actors. According to the 2024 State of Security report, threat actors are using generative AI to amplify phishing lures, conduct a higher volume of attacks, and even translate their attacks into their target’s native language.

Both public and private organizations are also adjusting to the SEC Cyber Disclosure regulations that were implemented last December. Under this regulation, organizations that experience a cyber incident must report the fallout from the attack in great detail. Critics previously decried the time frame for making the report — four days after the incident — but over the past year, we’ve seen how the regulation is benefiting the wider cybersecurity industry.

If both private and public organizations face these industry pressures, then it’s only right they work together to solve them.

How public and private companies can work together

No standard exists for how public and private companies should partner to promote a cyber-resilient nation. In fact, if we’re honest, there are some understandable concerns. For example, what if a federal agency partners with a public company they later have to prosecute? That could create legal issues.

However, we are already seeing good examples of public-private partnerships that are working on a smaller level. For example, Louisiana State University runs a program in which private companies donate technology and their expertise to train students as they hone their cybersecurity skills. This is an effective way for public institutions and private companies to partner and create a generation ready to contribute to the cybersecurity workforce.

The next step is to take these types of partnerships from a university or grassroots level and elevate them to more prominent companies and organizations. We’ve seen public and private companies work together on a larger scale following the famous Log4Shell vulnerability. During the fallout of the vulnerability, a neutral forum was created that allowed both public and private organizations to exchange relevant information. This forum was not a place to gain a competitive edge, but rather somewhere all stakeholders could go to fix a mutual problem. This type of information-sharing and partnership can be a blueprint for how public and private organizations can collaborate in the future.

Building a resilient nation begins within your organization

The good news is that while we work to figure out the best public and private partnerships, we can take internal steps within our own organizations to promote resilience. Simple measures such as having a password manager, multi-factor authentication, regular software updates, and protecting your backups are ways to build a resilient culture. Luckily many businesses are planning to invest in these areas to establish a strong cyber posture. A report from Splunk found that both the public and private sectors plan to invest in threat intelligence (50%), cybersecurity monitoring (46%), and generative AI security tools (43%) in the coming year. And once we build a resilience framework within our organizations, we’ll be better prepared to implement the public-private partnerships that will build a resilient nation.

Paul Kurtz is chief cybersecurity advisor and field chief technology officer at Splunk.