Cybersecurity Lessons from the Election: Human Behavior

There have been a number of recent articles in the popular press suggesting that behavioral science can serve to explain people’s responses to COVID-19 and indicate how individuals might be persuaded to act in line with the common good. This concept is examined in two recent articles, one scholarly, providing ... Read More

Solar Winds Blow Hard

Unbelievable! But true. The enormous hack, purportedly by Russia (per Secretary of State Mike Pompeo and others), of major U.S. government agencies and the U.S.’s biggest corporations—apparently some 18,000 organizations according to the software maker—came through malware planted in updates to third-party network-monitoring software called Orion from SolarWinds. However, this ... Read More

CISA and Desist

It’s an old joke: “Heads I win, tails you lose,” but it can also play out in reality. How often do cybersecurity professionals end up on the wrong side of that bet? CISOs (Chief Information Security Officers) don’t seem able to get a break. They invariably get blamed, and sometimes ... Read More

Cybersecurity Lessons from the Pandemic: Protection

To paraphrase an old saying: “One person’s prevention is another person’s protection.” This may well apply to the wearing of masks during the pandemic, the efficacy of which is still being hotly debated by some. Having gone through various iterations, the argument for wearing masks has been mainly to prevent ... Read More

Cybersecurity Lessons from the Pandemic: Prevention

Prevention lies somewhere between avoidance and protection, and preventative methods can belong to either. For example, what is stopping outsiders from entering your country or state or town in order to limit the spread of the novel coronavirus? Some might say that is avoidance. Others might consider it preventing the ... Read More

Cybersecurity Lessons from the Pandemic: Avoidance

There are a number of confusing differences of opinion with respect to handling the COVID-19 pandemic. Some of the confusion seems to center around a common misunderstanding of the roles of various mitigation approaches. Perhaps this is a case where those managing the pandemic could benefit from the experiences of ... Read More

Cybersecurity Lessons from the Pandemic: Plans, Exercises and Warnings

Like many others during this stay-at-home period, I have been sorting through old articles and reports, culling out those that are no longer of value. But, in the process, I came across a number of documents relevant to the current pandemic. One such document was “Scenario Update 3” of a ... Read More

Cybersecurity Lessons from the Pandemic: Perception of Risk

The more “mature” among us may recall when decision-making under uncertainty was based on the concept of “rational economic man.” We estimated or calculated the probability and amount of a loss (or gain) of various courses of action, multiplied the numbers together to arrive at a range of expected losses ... Read More

Cybersecurity Lessons from the Pandemic – Positive and Negative Feedback

Systems use negative feedback in order to converge to stability and equilibrium (a positive quest). Positive-feedback systems diverge, which leads to instability and sometimes surging out of control (usually a negative outcome). Negative feedback inhibits and positive feedback amplifies. Each has its role in nature. Body temperature, for example, is ... Read More

The Massive Shift to Cyber Crime

There is a cartoon in The New Yorker of March 30, 2020 showing four mobsters, one with a gun, sitting around a table. The caption reads: “For health and safety reasons, we’ll be transitioning to cyber crime.” You can see the cartoon at https://www.newyorker.com/cartoon/a24009 No kidding! The huge increase in ... Read More