“My security depends on your security, and your security depends on mine.”

It’s known as the “collaboration principle” within the Computer Security Incident Response Team (CSIRT) community, and I thought about it a lot during the pandemic, especially as debates raged over mask wearing. 

It was one of the first things I learned at Japan Computer Emergency Response Team Coordination Center (JPCERT/CC), and I immediately fell in love with the concept. While the practice of cybersecurity shifted toward cyber “conflict” and “warfare” frameworks that focused on attribution and response, I was inspired to pursue the identification of broader cybersecurity risk factors that could do harm to others and develop mitigation strategies. In fact, my enduring passion for this approach is the basis for my Master’s Thesis and my decision to found the CyberGreen Institute. 

It wasn’t until the pandemic, however, that I really began to consider the parallels with public health. Wearing a cloth or basic surgical mask offered limited protection to individuals during the COVID-19 pandemic, but it was very effective at preventing your ability to spread it to others, especially for a disease that was often spread by asymptomatic individuals. The same applies to cybersecurity. Improving our own cyber hygiene will benefit each of us a little, but if we all commit to better cyber hygiene it will have a massive effect for everyone by limiting the potential impact of future attacks.

It’s a concept cybersecurity practitioners have always innately understood, but we never had an effective model for exploring these relationships or the data to test theories, improve models and design more effective mitigation strategies. 

My silver lining to the pandemic lockdown was getting to know “Threat Modeling” author and genius, Adam Shostack, and his amazing vision of Cyber Public Health. Together, we saw an opportunity to mine the history, theory, and practice of the modern sciences of public health and epidemiology for inspiration and best practices that could be applied to cybersecurity. 

We started by purchasing the textbook “Introduction to Public Health” written by Mary Jane Schneider and examined each chapter for ways we could apply the public health discipline and approach to cyber issues. (Actually, Adam did the hard work, I cheated and studied from his report). This investigation led us to the unexpected conclusion that we not only need a science of Cyber Public Health, but that CyberGreen needs to evolve to help make it a reality. 

We brought on Adam as our lead collaborating scientist and got to work on developing some of the foundational work. We started the experimental mapping of “health vital data” to “cyber vital data” and began developing an Internet Infrastructure Public Health scoring system. The work has been promising, but also challenging as we quickly realized we can’t do it alone. We need to build a movement around the science of Cyber Public Health. 

That is at the core of CyberGreen’s new mission and vision that we are unveiling today along with a brand new website.  Our new mission is “to establish a science of Cyber Public Health dedicated to making the internet safer and more resilient for all.” 

It’s founded in our belief that to meet the evolving cyber risks of tomorrow, we need a science of Cyber Public Health and the institutions to leverage it. Science starts with data, so our top priority is gathering a more comprehensive set of data and standardizing it for researchers. A society-level view of risks will revolutionize every aspect of cybersecurity including reducing systemic risks, addressing existing inequities, and making the internet more secure and resilient for all.

Going forward, CyberGreen will be dedicated to mobilizing a global community of experts, business leaders, and policymakers to revolutionize cybersecurity by establishing and advancing the science of Cyber Public Health. 

I am so excited about the adventures ahead, and I hope you will join us in our mission to make the internet safer and more resilient for all.