The 9/11 lesson cybersecurity has yet to learn

The 9/11 terrorist attacks changed how our nation thinks about security. Nowhere was this change more visible than in aviation, with the creation of the Transportation Security Administration and the development of multiple layers of security designed to protect air travelers.

That lesson extends beyond aviation. Twenty-five years later, as cyber threats increasingly target systems that support critical infrastructure, cybersecurity faces a similar challenge: how do we build systems resilient enough to withstand the failure of any single layer?

The challenge is especially apparent as the Cybersecurity and Infrastructure Security Agency prepares to finalize its sweeping Cyber Incident Reporting for Critical Infrastructure Act rules in September. Washington continues to miss the broader lesson of systemic resilience. 

Federal policy focuses heavily on mandatory breach reporting, yet reporting a crisis does not prevent one. Paradoxically, although TSA aggressively expands its own cybersecurity mandates across transit networks, the agency’s greatest lesson in systemic design continues to be overlooked. Digital defense frameworks remain dangerously tethered to centralized, single points of failure. True digital resilience requires less focus on compliance checklists and more on independent, multi-layered structures modeled on aviation security.

As the world learned during the CrowdStrike outage in July 2024, destruction does not always require bad actors. What began as a routine software update to around 8.5 million computers instantly crippled airlines, banks and hospitals worldwide, causing billions of dollars in damage. It wasn’t a cyberattack; it was digital “friendly fire.” Two months later, when a CrowdStrike executive testified before a congressional subcommittee, the central question wasn’t just what went........

© The Hill