Search

Begin New Search Topic Science and Technology Author James Andrew Lewis

1. The Cybersecurity Workforce Gap

Author:
James Andrew Lewis and William Crumpler
Publication Date:
01-2019
Content Type:
Working Paper
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
As cyber threats continue to grow in sophistication, organizations face a persistent challenge in recruiting skilled cybersecurity professionals capable of protecting their systems against the threat of malicious actors. With cybercriminals now responsible for billions in losses per year and state-sponsored hacking groups posing an ever-greater threat, the need for individuals capable of securing networks against attackers has never been greater. However, education and training institutions in the United States have so far found it difficult to keep pace with the growing need for cyber talent. This paper highlights the gaps that exist in the nation’s current cybersecurity education and training landscape and identifies several examples of successful programs that hold promise as models for addressing the skills gap. It then highlights recommendations for policymakers, educators, and employers. A recent CSIS survey of IT decisionmakers across eight countries found that 82 percent of employers report a shortage of cybersecurity skills, and 71 percent believe this talent gap causes direct and measurable damage to their organizations.1 According to CyberSeek, an initiative funded by the National Initiative for Cybersecurity Education (NICE), the United States faced a shortfall of almost 314,000 cybersecurity professionals as of January 2019.2 To put this in context, the country’s total employed cybersecurity workforce is just 716,000. According to data derived from job postings, the number of unfilled cybersecurity jobs has grown by more than 50 percent since 2015.3 By 2022, the global cybersecurity workforce shortage has been projected to reach upwards of 1.8 million unfilled positions.4 Workforce shortages exist for almost every position within cybersecurity, but the most acute needs are for highly-skilled technical staff. In 2010, the CSIS report A Human Capital Crisis in Cybersecurity found that the United States “not only [has] a shortage of the highly technically skilled people required to operate and support systems already deployed, but also an even more desperate shortage of people who can design secure systems, write safe computer code, and create the ever more sophisticated tools needed to prevent, detect, mitigate and reconstitute from damage due to system failures and malicious acts.”5 At the time, interviews indicated that the United States only had about 1,000 security specialists with skills and abilities to take on these roles, compared to a need for 10,000 to 30,000 personnel. In the nine years since that report, these challenges have persisted. In 2016, CSIS found that IT professionals still considered technical skills like intrusion detection, secure software development, and attack mitigation to be the most difficult to find skills among cybersecurity operators.6 A 2018 survey of California businesses revealed that a lack of required technology skills was one of the greatest challenges facing organizations when hiring cybersecurity candidates.7 These challenges were particularly acute for mission critical job roles, with over a third of organizations reporting a lack of technology skills in candidates for vulnerability assessment analyst positions and half of employers reporting deficiencies for cyber defense infrastructure support candidates. Employers today are in critical need for more cybersecurity professionals, but they do not want more compliance officers or cybersecurity policy planners. What organizations are truly desperate for are graduates who can design secure systems, create new tools for defense, and hunt down hidden vulnerabilities in software and networks.8
Topic:
Security, Science and Technology, Cybersecurity, and Information Technology
Political Geography:
Global Focus

2. China’s Pursuit of Semiconductor Independence

Author:
James Andrew Lewis
Publication Date:
02-2019
Content Type:
Working Paper
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
While China has made immense investments in science and technology, and while these are producing results, it is still dependent on Western technology. This is particularly true for semiconductors. China’s dependence on foreign semiconductors has worried Beijing for decades. China suspects that Western semiconductors contain “backdoors,” intentional vulnerabilities that can be exploited for intelligence and military purposes. In 2016, President Xi Jinping said, “the fact that core technology is controlled by others is our greatest hidden danger.” Vice Premier Ma Kai said at the 2018 National People’s Congress, “We cannot be reliant on foreign chips.”1 China intends to end this dependence, but despite 40 years of investment and espionage, it is unable to make advanced semiconductors. Along the way, there have been embarrassing frauds and expensive failures.
Topic:
Science and Technology, Hegemony, Investment, and Emerging Technology
Political Geography:
China and Asia

3. Emerging Technologies and Managing the Risk of Tech Transfer to China

Author:
James Andrew Lewis
Publication Date:
09-2019
Content Type:
Working Paper
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
There are deep interconnections between the U.S. and Chinese economies, and China has built its technology base on what it has acquired from the West. China’s government and some Chinese companies will use any means, legal or illegal, to acquire technology. The United States’ relationship with China cannot continue unchanged, but given the interconnections, change must be managed carefully. New restrictions are needed, but counterintuitively, these should be shaped by recognizing that being open makes the United States stronger than being closed. The best approach is an incremental and flexible approach to technology transfer centered on the need to avoid harm to the U.S economy. This report outlines the policy tools that the United States can use to mitigate risk while maintaining the openness that is a hallmark of the U.S. economy.
Topic:
Science and Technology, Intellectual Property/Copyright, Conflict, and Emerging Technology
Political Geography:
China, Asia, North America, and United States of America

4. How 5G Will Shape Innovation and Security

Author:
James Andrew Lewis
Publication Date:
12-2018
Content Type:
Working Paper
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
The fifth generation of mobile network technologies, known as “5G,” promises greater speed, security, and capacity. 5G will underpin the internet economy and provide the backbone for the next generation of digital technologies. So, it is unsurprising that there is intense competition among companies and countries for 5G leadership. 5G will determine the direction the internet will take and where nations will face new risks and vulnerabilities. Who makes 5G technologies will affect security and innovation in an increasingly competitive technological environment. Decisions made today about 5G will affect national security and economic performance for decades to come. This is a competition among companies and groups of companies but also a competition between market-based and state-directed decisionmaking. The United States has relied on the former, China on the latter, and Europe falls somewhere in between. American technology remains essential for 5G mobile telecommunications. American companies have been strong performers in developing 5G technologies, but the United States and its allies face a fundamental challenge from China. The focus of competition is over 5G’s intellectual property, standards, and patents. Huawei, for example, has research programs to develop alternatives to American suppliers, and U.S. trade restrictions have accelerated China’s efforts to develop its own 5G industry. While American companies lead in making essential 5G technologies, there are no longer any U.S. manufacturers of core telecommunications network equipment. Four companies dominate the market for the core network technologies needed for 5G networks. None of these companies are American. 1The choices are between European security partners (Ericsson and Nokia) and China (Huawei and ZTE). Telecom is a strategic industry and having two companies with close ties to a hostile power creates risk for the United States and its allies. A secure supply chain for 5G closes off dangerous areas of risk for national security in terms of espionage and the potential disruption to critical infrastructures. China’s aggressive global campaign of cyber espionage makes it certain that it will exploit the opportunities it gains as a 5G supplier. One way to envision this is to imagine that the person who built your house decides to burgle it. They know the layout, the power system, the access points, may have kept a key, and perhaps even built in a way to gain surreptitious entry. Major telecom “backbone” equipment connects to the manufacturer over a dedicated channel, reporting back on equipment status and receiving updates and software patches as needed, usually without the operator’s knowledge. Equipment could be sold and installed in perfectly secure condition, and a month later, the manufacture could send a software update to create vulnerabilities or disrupt service. The operator and its customers would have no knowledge of this change. The United States can manage 5G risk using two sets of policies. The first is to ensure that American companies can continue to innovate and produce advanced technologies and face fair competition overseas. American and “like-minded” companies routinely outspend their Chinese competitors in 5G R&D and hold 10 times as many 5G patents. Chinese companies still depend on the western companies for the most advanced 5G components. The second is to work with like-minded nations to develop a common approach to 5G security. The United States cannot meet the 5G challenge on its own. When the United States successfully challenged Chinese industrial policy in the past, it has been done in concert with allies. Another task will be to find ways to encourage undecided countries to spend on 5G security. Huawei’s telecom networks cost between 20 to 30 percent less than competing products. Huawei also offers foreign customers generous terms for leasing or loans. It can do this because of its access to government funds. Beijing supports Huawei for both strategic and commercial reasons. Many countries will be tempted by the steep discount. Not buying Huawei means paying a “premium” for security to which economic ministries are likely to object. The United States will need to encourage others to pay this security premium while at the same time preparing for a world where the United States unavoidably connects to Huawei-supplied networks and determine how to securely connect and communicate over telecom networks in countries using Chinese network equipment. The United States does not need to copy China’s government-centric model for 5G, but it does need to invest in research and adopt a comprehensive approach to combatting non-tariff barriers to trade. 5G leadership requires a broader technology competition policy in the United States that builds the engineering and tech workforce and supports both private and public R&D. The United States also needs to ensure that U.S. companies do not face obstacles from antitrust or patent infringement investigations undertaken by other countries to obtain competitive advantage. In the twentieth century, steel, coal, automobiles, aircraft, ships, and the ability to produce things in mass quantity were the sources of national power. The foundations of security and power are different today. The ability to create and use new technologies is the source of economic strength and military security. Technology, and the capacity to create new technologies, are the basis of information age power. 5G as the cornerstone of a new digital environment is the focal point for the new competition, where the United States is well-positioned to lead but neither success nor security are guaranteed without action.
Topic:
Science and Technology, 5G, Emerging Technology, and Telecommunications
Political Geography:
Global Focus

5. Rethinking Cybersecurity Strategy, Mass Effect, and States

Author:
James Andrew Lewis
Publication Date:
01-2018
Content Type:
Working Paper
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
Despite all the attention, cyberspace is far from secure. Why this is so reflects conceptual weaknesses as much as imperfect technologies. Two questions highlight shortcomings in the discussion of cybersecurity. The first is why, after more than two decades, we have not seen anything like a cyber Pearl Harbor, cyber 9/11, or cyber catastrophe, despite constant warnings. The second is why, despite the increasing quantity of recommendations, there has been so little improvement, even when these recommendations are implemented. These questions share an answer: the concepts underlying cybersecurity are an aggregation of ideas conceived in a different time, based on millennial expectations about governance and international security. Similarly, the internet of the 1990s has become “cyber,” a portmanteau term that encompassed the broad range of global economic, political, and military activities transformed by the revolution created by digital technologies. If our perceptions of the nature of cybersecurity are skewed, so are our defenses. This report examines the accuracy of our perceptions of cybersecurity. It attempts to embed the problem of cyber attack (not crime or espionage) in the context of larger strategic calculations and effects. It argues that policies and perceptions of cybersecurity are determined by factors external to cyberspace, such as political trends affecting relations among states, by thinking on the role of government, and by public attitudes toward risk. We can begin to approach the problem of cybersecurity by defining attack. While public usage calls every malicious action in cyberspace an attack, it is more accurate to define attacks as those actions using cyber techniques or tools for violence or coercion to achieve political effect. This places espionage and crime in a separate discussion (while noting that some states use crime for political ends and rampant espionage creates a deep sense of concern among states). Cyber attack does not threaten crippling surprise or existential risk. This means that the incentives for improvement that might motivate governments and companies are, in fact, much smaller than we assume. Nor is cyber attack random and unpredictable. It reflects national policies for coercion and crime. Grounding policy in a more objective appreciation of risk and intent is a first step toward better security.
Topic:
Science and Technology, Governance, Cybersecurity, and Digital Economy
Political Geography:
Global Focus

6. Cybersecurity and Stability in the Gulf

Author:
James Andrew Lewis
Publication Date:
01-2014
Content Type:
Policy Brief
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
The Gulf has become a flashpoint for cyber conflict. Cyberspace has become an arena for covert struggle, with the United States, Israel and other nations on one side, and Iran and Russia on the other. Iran has far outpaced the GCC states in developing its cyber capabilities, both for monitoring internal dissent and deploying hackers to disrupt or attack foreign targets. Several such attacks over the past two years were likely either directed or permitted by Iranian state authorities. Even if Iran holds back from offensive actions as nuclear talks progress, the growth in Iranian capabilities remains a potential security threat for other Gulf states. The GCC countries have begun to develop their defensive capabilities, but they will need to expand their defenses and collaborate more effectively to deter future threats.
Topic:
Conflict Resolution, Security, Defense Policy, Development, and Science and Technology
Political Geography:
Russia, United States, Iran, Middle East, Israel, and Arabia

7. Liberty, Equality, Connectivity

Author:
James Andrew Lewis
Publication Date:
02-2014
Content Type:
Working Paper
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
Europe and the United States have a collective interest in the promotion of a stable international order based on the rule of law, open and equitable arrangements for trade, and a commitment to democratic government and individual rights. These interests face renewed challenges in a complex global political environment.
Topic:
International Cooperation, Science and Technology, and International Security
Political Geography:
Europe

8. Cyber Threat and Response

Author:
James Andrew Lewis
Publication Date:
03-2014
Content Type:
Working Paper
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
Everyone knows that the Internet has changed how we interact, do business, and share information. The Internet can be an "innovation engine," but the same engine of innovation drives cyber threats to change faster than cyber defenses can react. Cyber threats are complex, dynamic, and network defenses have trouble keeping up with them.
Topic:
Defense Policy, Economics, Science and Technology, and International Security
Political Geography:
Europe

9. Updating U.S. Federal Cybersecurity Policy and Guidance

Author:
Franklin S. Reeder, Daniel Chenok, Karen S. Evans, James Andrew Lewis, and Alan Paller
Publication Date:
10-2012
Content Type:
Working Paper
Institution:
Center for Strategic and International Studies (CSIS)
Abstract:
As the threat to the cyber infrastructure on which the federal government and the nation relies grows, the urgency of investing wisely in protection against, detecting, mitigating, and recovering from cyber events takes on increasing urgency. Our adversaries are well equipped and agile. Our defenses must be equal to the threat, and they are not.
Topic:
Security, Crime, Government, Science and Technology, and Infrastructure
Political Geography:
United States