The Art of Cybersecurity
When I was young, my mother used to paint postcards by hand. She took a dull paintbrush, seeped it in dark ink, somewhere between indigo and raisin black, and dragged it across the white canvas. Occasionally she would direct the paintbrush this way and that, like a music conductor, to create the most peculiar angles. What an exciting process this all was for a five-year-old! My eyes were fixated on her left wrist, with the anticipation for the finished product building up in my small chest. My mother was an artist. And for as long as I can remember, I had wanted to become an artist too.
Years passed, and apparently it was time to grow up. I was in ninth grade when my schoolteacher in Japan handed me a piece of paper that had two words written on it — humanities and science. I had to choose one path of study, humanities or science, and formally abandon the other. I understood very well that my family members mostly worked in humanities fields, admired the sciences, and were guiding me in that direction. Science. So I said my farewells to my pastels, charcoal pencils, small filthy erasers, and banged up sketchbooks. Goodbye.
…Or not. While I had committed my high school years to science, my mind subconsciously continued to seek art within the STEM departments. All I wanted was a blank canvas and a space to create. And that was how I stumbled into the computer science department.
On one sunny afternoon six months after declaring my major, I received an exciting email regarding my summer which prompted me to rigorously surf through the internet about cybersecurity. Although my knowledge on the topic was very limited, I managed to grasp some of the basics.
Say you’re sending a photo of your cat to a friend. Once you hit the send button, the image gets divided up into small packets containing all the bits and pieces, then transferred through a network over to your friend’s phone. The process is actually very similar to how Amazon delivers your packages over a network of roads. And just like actual roads, networks also have countless vulnerabilities.
Traffic is one problem. A network overflowing with packets can cause congestion, which can slow the packets from reaching their destination, as well as risking them from getting lost or discarded during the trip.
But the problem that has been attracting the most attention in recent years has been privacy. How secure is your information while it’s being sent from point A to B? You probably won’t mind if a hacker gains unauthorized access to a photo of your cute cat. But your phone sends and receives information all day long. No matter how “secure” the system is, it is only a matter of time until hackers find a way to outsmart the security algorithm and lay their hands on what could potentially be some of your most sensitive information.
…Well, that doesn’t sound too good. With this basic knowledge in mind, I hopped on a plane to Miami, Florida, to gain further insight on cybersecurity as a research assistant for the National Science Foundation.
Despite severe fatigue arising from hectic last-minute packing and flight anxiety, I miraculously survived the half-day trip without a single snooze. Instead, I stared out the window as I usually do on flights and reminisced about the days when I was merely a couple years old, taken aback by the beautiful skies just as I was in that moment. Funny how I’ve changed, although I haven’t. I used to carry around a bulky sketchbook. Colored pencils. The pages textured, unrefined, but still smooth and kind. A flight attendant walked by, and a smile escaped my lips. I fixed my gaze back to the window. Yes, and my grandmother. Her eyes would gleam, and she would tell me I’d become an artist one day.
It’s been a whole year since I’ve touched a paintbrush. Two years since the last time I’ve been to an art exhibition. Although the reason I was pulled into computer science was because of its resemblance to art, years of STEM education had conditioned my mind to react negatively towards subjects belonging to the humanities. When I started to have second thoughts, I had to stop and scold myself. Art is a selfish interest and a waste of time.
However, one of the many valuable things I learned as a summer research assistant was that art is neither selfish nor a waste of time. Assume a road with cars flowing constantly from point A to point B. The problem is this: how would we prevent a malicious attacker at point B from backtracking the flow of cars and getting to point A? This problem relates to a common security issue in wireless sensor networks, and there are decades of research posing possible solutions.
This is a cybersecurity problem. But at the same time, it is not. Once the technical terms are replaced with objects people are more familiar with — like roads and cars — the question starts to sound more like a riddle. Now, take a moment to go back to the problem. How would you go about solving it?
For clarity, let’s call point A (original location) a source, and point B (destination) a sink. A novel solution was proposed in 2004 by several computer scientists at Rutgers University who decided to direct the information from the source to a random location first before sending it over to the sink. The idea was that this would divert the attacker’s attention from the source, and that the attacker would be stuck wandering from one random location to another. Perhaps this protocol resembles your childhood, when your parents asked you to complete a million chores before granting you the freedom to go out and play. Never-ending diversions — that was the point of this proposed routing scheme.
From a theoretical standpoint, this is a reasonable approach. Creating an algorithm to perform this task should be rather straightforward. Although concise algorithms are often encouraged in computer science, there are always exceptions. In cybersecurity, conciseness and predictability are equally important in maintaining adequate transmission speed from source to sink, while also providing strengthened levels of privacy.
While the research team at Rutgers University had done a marvelous job with conciseness, their approach was rather predictable. Attackers could easily predict the security algorithm and program their system in such a way that they could bypass these traps. And unsurprisingly, several research teams have already published papers with attacker models that could outsmart this proposed system.
“Then how do we come up with an unpredictable solution?” With slight hesitation, I turned to my PhD student research partner who looked just as puzzled as I was. “That is for you to decide. Come up with a unique solution, then propose it to me by next week. I have a meeting now.” His forehead drenched in sweat, he slipped his laptop into his bag and rushed out the door.
I was baffled. Here we had an intelligent PhD student, who had all the technical knowledge relating to computers, relying on me to be his idea generator. He sat with me a couple days later and told me that coming up with ideas for a solution was the hardest part of his research process.
The sun bled burgundy, and a bright trail of vermilion orange followed. The clouds had swirled up like Van Gogh’s Starry Night. We both looked up at the sky, not at each other, as he continued to talk. At some point my mind wandered off, and I started to imagine how many advisors and colleagues must have told this man to think outside the box. I wondered how many of the PhD students in our research lab appreciated the creative process. I wondered what their intentions were in the field of computer science, if it wasn’t the act of creating something from nothing. Art and humanities are not just desired but needed here. Just imagine how productive research could be if researchers could rely on their own creative insights rather than tossing that part of their job to a liberal arts undergraduate.
The sun had left us, and the sky was somewhere between indigo and raisin black. “Could you have something for me by Friday?” He pulled out a towel and swept it across his wet forehead. I looked into his weary, bloodshot eyes. I felt a rush of emotion, and I nodded. “Good. See you then.” He slid his laptop into his bag, and swiftly walked away.
