Cybersecurity is a Shared Responsibility

There have been far too many "incidents" recently that demonstrate the Internet is not as secure as it needs to be. Just in the past few weeks, we've seen countless headlines about online security breaches. From the alleged hack of the National Security Agency's "cyberweapons" to the hack of the Democratic National Committee emails, and even recent iPhone security vulnerabilities, these stories reinforce how crucial it is to focus on security.

Internet security is like a long chain and each link needs to be tested and re-tested to ensure its strength. When the chain is broken, bad things happen: a website that holds user credentials (e.g., email addresses and passwords) is compromised because of weak security; user credentials are stolen; and, those stolen credentials are then used to attack other websites to gain access to even more valuable information about the user.

One weak link can break the chain of security and put Internet users at risk. The chain only remains strong if technology companies, governments, and users work together to keep the Internet as safe as it can be.

Technology companies must focus on security.

Technology companies need to develop proactive, pro-user cybersecurity technology solutions.

We must invest in creating a secure platform. That means supporting things like adopting and standardizing secure protocols, building features that improve security, and empowering users with education and better tools for their security.

At Mozilla, we have security features like phishing and malware protection built into Firefox. We started one of the first Bug Bounty programs in 2004 because we want to be informed about any vulnerabilities found in our software so we can fix them quickly. We also support the security of the broader open source ecosystem (not just Mozilla developed products). We launched the Secure Open Source (SOS) Fund as part of the Mozilla Open Source Support program to support security audits and the development of patches for widely used open source technologies.

Still, there is always room for improvement. The recent headlines show that the threat to user safety online is real, and it's increasing. We can all do better, and do more.

Governments must work with technology companies.

Cybersecurity is a shared responsibility and governments need to do their part. Governments need to help by supporting security solutions that no individual company can tackle, instead of advancing policies that just create weak links in the chain.

Encryption, something we rely on to keep people's information secure online everyday, is under attack by governments because of concerns that it inadvertently protects the bad guys. Some governments have proposed actions that weaken encryption, like in the case between Apple and the FBI earlier this year. But encryption is not optional - and creating backdoors for governments, even for investigations, compromises the security of all Internet users.

The Obama Administration just appointed the first Federal Chief Information Security officer as part of the Cybersecurity National Action Plan. I'm looking forward to seeing how this role and other efforts underway can help government and technology companies work better together, especially in the area of security vulnerabilities. Right now, there's not a clear process for how governments disclose security vulnerabilities they discover to affected companies.

While lawful hacking by a government might offer a way to catch the bad guys, stockpiling vulnerabilities for long periods of time can further weaken that security chain. For example, the recent alleged attack and auction of the NSA's "cyberweapons" resulted in the public release of code, files, and "zero day" vulnerabilities that gave companies like Cisco and Fortinet just that- zero days to develop fixes before they were possibly exploited by hackers. There aren't transparent and accountable policies in place that ensure the government is handling vulnerabilities appropriately and disclosing them to affected companies. We need to make this a priority to protect user security online.

Users can take easy and simple steps to strengthen the security chain.

Governments and companies can't do this without you. Users should always update their software to benefit from new security features and fixes, create strong passwords to guard your private information, and use available resources to become educated digital citizens. These steps don't just protect people who care about their own security, they help create a more secure system and go a long way in making it harder to break the chain.

Working together is the only way to protect the security of the Internet for the billions of people online. We're dedicated to this as part of our mission and we will continue our work to advance these issues.