Can Trust Itself Be a Cybersecurity Risk?
In the ever-evolving world of cyber threat intelligence, a new study by Cornell University’s Rebecca Slayton explores a paradox at the heart of digital defense: the very standards that enable coordination and efficiency can also open the door to devastating attacks.
Published in Social Studies of Science, Slayton’s paper—co-authored with Lilly Muller of King’s College London—unpacks the dual uncertainties cybersecurity professionals face, using high-profile cases like the 2020 SolarWinds breach as cautionary examples. The research recently earned the Randolph H. Pherson Innovative Paper Award from the International Studies Association.
Understanding the Two Types of Uncertainty in Cyber Threat Intelligence
Slayton and Muller identify two critical forms of uncertainty in cybersecurity:
- Adversarial Uncertainty: The unpredictable behavior of intelligent adversaries—nation-states, criminal groups, or rogue actors.
- Coordinative Uncertainty: The challenge of syncing data collection, interpretation, and action across diverse organizations, cultures, and time zones.
In short, cyber analysts must strike a balance between collaboration and caution—sharing insights across borders while guarding against the possibility that shared systems may be weaponized.
Case in Point: The SolarWinds Supply Chain Attack
In 2020, 18,000 organizations, including cybersecurity firm Mandiant, were compromised after Russian hackers infiltrated SolarWinds’ software update system. The attack demonstrated how trusted update mechanisms, meant to increase efficiency and reduce risk, can become vectors for large-scale breaches.
“A supply-chain hack is one of the most difficult to detect because a trusted relationship has been established,” Slayton said. “Security updates are often installed automatically—there’s little scrutiny.”
This illustrates how standardization, while essential for global cybersecurity operations, can paradoxically amplify exposure.
Cyber Threats Are Political—And Personal
The study also underscores that cyber intelligence doesn’t exist in a vacuum. Geopolitical tensions influence which threats get prioritized—and which may be overlooked.
From the 2016 DNC leaks to repeated Russian attacks on Ukraine’s power grid, Slayton emphasizes that cyber operations often aim to undermine public trust, not just disable systems.
“Function was restored quickly,” she noted about Ukraine’s grid attacks, “but the goal was to signal: ‘We have the goods on you.’”
Why This Research Matters for the Future of Cybersecurity
As cybersecurity becomes more complex and global, the industry must navigate:
- The need to share threat intelligence across borders and organizations.
- The risk of uniform standards being exploited by advanced persistent threats.
- The challenge of making decisions with incomplete or shifting data in a politicized environment.
Slayton hopes her findings will encourage cybersecurity professionals to critically examine their assumptions, rethink trust frameworks, and develop resilient, decentralized systems that limit the damage when—inevitably—something goes wrong.
Key Takeaways for Cybersecurity Stakeholders
- Trust and efficiency can be vulnerabilities when systems are too tightly coordinated.
- Supply-chain attacks exploit standardized processes, making them hard to detect.
- Geopolitical factors shape threat prioritization, increasing the chance of blind spots.
- Uncertainty is inherent and must be managed, not eliminated.
Stay Ahead of the Threat Curve
As adversaries evolve, so must cyber defenders. This research is a call to action for those in the intelligence community to design systems that can adapt under uncertainty, ensuring resilience against both technical threats and strategic miscalculations.
📌 Tip: Explore the full paper, “Coordinating Uncertainty in the Political Economy of Cyber Threat Intelligence”, for deeper insights into balancing collaboration and security in today’s digital landscape.
FingerLakes1.com is the region’s leading all-digital news publication. The company was founded in 1998 and has been keeping residents informed for more than two decades. Have a lead? Send it to [email protected].