Invisible Security: Protecting Users with No Time to Spare

Abstract

For over 50 years, the cybersecurity community has sought to protect vulnerable systems and users from victimization. Despite ongoing and valiant work at adoption and usability, some users cannot or will not avail themselves of necessary cybersecurity measures such as patching. Average, non-expert users-particularly those in small businesses-cannot afford to devote time to cybersecurity. Instead of accepting the risk of no security, alternatives are possible which achieve both security outcomes and conservation of time. We explore the paradigm of invisible security focused on creating cyber defenses that occur automatically without end user intervention. Invisible security is the next evolutionary step to aid users, now that automation is robust and effective in supporting it. Even though some example implementations, such as automatic updates, have existed for years, dedicated focus on this emerging paradigm is required to develop, measure, and deploy new capabilities. We present examples consistent with this approach in existence today, including automatic software updates and protective DNS. We draw insight and comparisons to other domains, including automobile safety. Then we describe how invisible defenses may aid potential beneficiaries in health care, the defense industrial base, and the general public. Finally, we present benefits and limitations of the approach and propose areas of future research and innovation.