Lessons from the Car and Aviation Industries

In industries like automotive and aviation, transparency is key to maintaining trust and ensuring safety. Historical performance data is readily available, allowing consumers to make informed decisions based on past performance. Cybersecurity, however, remains shrouded in secrecy, even as it plays a critical role in protecting sensitive data and maintaining digital trust. This lack of transparency is a significant issue that needs addressing, and the CyberTransparency Forum provides a valuable framework to guide cybersecurity vendors toward greater openness.

CyberTransparency Forum: A Framework for Openness

The CyberTransparency Forum advocates for the release of historical cybersecurity performance data, pushing vendors to be more transparent about their efficacy. This initiative emphasizes that transparency not only builds trust but also enables consumers and businesses to make informed decisions. By following the CyberTransparency Forum’s guidelines, cybersecurity vendors can demonstrate their commitment to openness and accountability.

The Government’s Role in Mandating Transparency

Governments have introduced guidelines requiring public companies to disclose breaches, highlighting the importance of transparency in maintaining trust and accountability. For example, in the United States, the Securities and Exchange Commission (SEC) requires publicly traded companies to report cybersecurity incidents that could have a material impact on investors. Similarly, the European Union’s General Data Protection Regulation (GDPR) mandates that organizations report data breaches within 72 hours of discovery if they pose a risk to individuals’ rights and freedoms. However, the very companies responsible for protecting these public entities often remain secretive about their own performance. This discrepancy is troubling, as it places the onus on victims to disclose breaches while allowing cybersecurity vendors to operate without the same level of scrutiny. This imbalance must be addressed to ensure a fair and transparent cybersecurity landscape.

Historical Data as a Predictor of Future Performance

Predicting the future efficacy of cybersecurity products is challenging. The best way to gauge their reliability is by examining past performance. Historical data provides valuable insights into how well a product has performed under real-world conditions, enabling consumers and businesses to make informed decisions. Transparency in historical data allows users to be the judge, fostering a more informed and discerning market.

The Marketing-Driven Nature of Cybersecurity

Currently, cybersecurity products are often sold through aggressive marketing rather than solid scientific data or performance metrics. Unlike other industries, cybersecurity lacks standardized measures to evaluate product efficacy, making it difficult for consumers to determine which solutions are truly effective. This marketing-driven approach contrasts sharply with industries like manufacturing, where even a simple $5 padlock must comply with rigorous standards to ensure quality and reliability.

The Call for Transparency

The lack of standards, guidelines, and transparency in cybersecurity is a significant barrier to building trust. To overcome this, all cybersecurity vendors must release their historical performance data. Transparency is essential to establish credibility and trustworthiness. If vendors are unwilling to share their past performance with users and customers, it raises a fundamental question: why should customers trust them?

Conclusion

Transparency in cybersecurity is not just a good practice; it is essential for building trust and ensuring effective protection. By following the CyberTransparency Forum’s framework, the industry can move toward greater openness. Governments should continue to push for transparency, ensuring that all entities, including cybersecurity vendors, are held to the same standards. Only through transparency can we create a safer and more trustworthy digital world.

For more information, visit the CyberTransparency Forum at https://cybertransparencyforum.org/.

References

1. Securities and Exchange Commission. ‘Commission Statement and Guidance on Public Company Cybersecurity Disclosures.’ Accessed June 30, 2024. https://www.sec.gov/rules/interp/2018/33-10459.pdf.

2. European Commission. ‘2018 reform of EU data protection rules.’ Accessed June 30, 2024. https://ec.europa.eu/commission/sites/beta-political/files/data-protection-factsheet-changes_en.pdf.

3. Melih Abdulhayoglu. ‘Why Cyber Insurance Companies Must Champion Zero Trust: Act Now or Pay Later.’ Melih.com. Accessed June 30, 2024. https://melih.com/why-cyber-insurance-companies-must-champion-zero-trust-act-now-or-pay-later/.