Government cybersecurity paradigms that focus heavily on securing critical infrastructure should shift and expand to consider a much wider array of connected users and devices, types of actors, and types of risk.

From compromises of some of the world’s largest corporations, to critical vulnerabilities in widely used open source software, to exponential growth in the number of connected devices and users, the need to proactively design policies and practices to secure users and Internet infrastructure has never been greater. Yet, cybersecurity public policy conversations too often are siloed and grounded in a few old ideas that don’t encompass the totality of the threat landscape. As a result, the state of cybersecurity policy today does not have a compelling answer for global-scale vulnerabilities like Heartbleed or nation-state attacks on public and private sector actors.

The concern for cybersecurity from all stakeholders has only been growing, but cybersecurity policy remains a broad and contested field lacking clarity on the best paths forward. To help cut through the rhetoric and identify consensus on areas of cybersecurity policy that should be prioritized for further attention and investment, Mozilla brought together more than thirty leading cybersecurity experts from a wide variety of backgrounds: academia, civil liberties, government and military, security, and technology.

Amid a plethora of definitions of cybersecurity, often leading to different policy and practical interventions, our participants converged on the essential technical core: the confidentiality, integrity, and availability of information. Traditional government cybersecurity paradigms that focus heavily on securing critical infrastructure should shift and expand to consider a much wider array of connected users and devices, types of actors, and types of risk. Framing this definition properly also matters: our participants noted that elements of human rights (especially privacy) and economics belong at the core of a balanced and comprehensive view of cybersecurity.