Over the past few weeks, the U.S. government has leaked the fact that it has run cyberattacks against Russia’s electricity network and Iran’s air-defense system. These attacks are part of a 21st-century cycle of hit-and-response in the cyber realm that threatens to escalate, spurring attacks that could threaten America’s own poorly defended power grid and military systems.
Hearing stories like this, most Americans who think about cyberwar and cybersecurity will probably think the news is bleak. They may even conclude that, somewhat like resistance to the robotic Borg villains on “Star Trek,” defense is futile in cyberspace. But it isn’t.
Over the past 10 years, there has been encouraging news from the cyber realm: Many U.S. corporations have learned how to defend themselves from cyber criminals and even hackers deployed by hostile countries. The most quoted line at cybersecurity conferences has long been that there are only two kinds of companies: those that were hacked and knew it and those that were hacked and didn’t know. But now, there is a third type of company: the “cyber-resilient” firm that suffers little or no damage when malicious hackers penetrate…
