The Fallacy of Despair: Why your security breach is not inevitable!
The Fallacy of Despair: Why your security breach is not inevitable!
There is a growing sentiment within the business community that a security breach affecting their company is inevitable. This is perpetuated by security professionals and providers or services and products who reinforce this mythos with statements resembling:
“It’s not if your company is going to be breached but when your company is going to be breached.”
We do not subscribe to this philosophy of fear; this fallacy of despair. We do not accept the inevitability of anything even death because we are convinced that science will fix that unfortunate end. All that being said, it should come as no surprise that of course we do not agree that your security breach needs to be inevitable.
Fear is the creeping, crawling, insidious splinter of doubt germinating in your mind that compels you to react at times irrationally. Fear is a management tool to control the many or the one. Fear requires two opposing forces to synchronize.
Codependency has been defined as the addiction to people, behaviors or things. Codependency is the fallacy of trying to control interior feelings by controlling people, things and events externally*. The fallacy of despair is that there is nothing we can do to stop a bad thing from occurring.
Keep in mind that reactive cyber security firms want you to fear the unknown, the possibility that your company will be inevitably breached. It is in their business model’s best interest to keep your corporation codependent. They would not be in business if breaches were prevented.
While we have a moment of clarity without fear, consider that a security breach is comprised of. On one side of the equation you have an entity who desires access to your organization for some malicious purpose. On your side of this equation you do not want to allow this to happen; so don’t allow this to happen!
Do not volunteer to be a victim.
If a technologist creates something and another technologist can break that something, don’t you think it is safe to say that another technologist could identify the problem first and prevent the intrusion? Do not submit to this fallacy of despair!
In the cyber security realm there are only two forms of security; Proactive Cyber Security and Reactive Cyber Security. Reactive cyber security is all about cleaning up the mess post-breach. Proactive cyber security is all about preventing the mess from ever occurring.
The best and only thing that a company can do to remain ahead of threats by being proactive in the appropriate implementation of Governance, Technology and Vigilance (AKA The Security Trifecta). When about 96% of all breaches are avoidable through the application of simple and intermediate level controls, it is absolutely within your power to protect your company. Let me show you the way; away from this fallacy of despair philosophy.
Lazarus Alliance is Proactive Cyber Security.
*Wang, Charles R. Profound States of Despair: A Developmental and Systems Approach to Treating Emptiness. Boca Raton, FL: Universal, 2009. Print.
First off, I do have sympathy for NASA and it’s dwindling congressional budget, however, two things are painfully evident and not excusable. First, there is great open source disk encryption available so budgetary excuses do not hold water. Second, this is not cutting edge technology and a few years ago, when the economy was good and the budgets were fat, this was never accomplished. The current, and at a minimum, the preceding NASA CISO’s should be dismissed in shame and given Darwin awards for incompetence. I don’t need to name you two boobs (no offense to actual breasts meant) because everyone can just Google NASA CISO to find out who you are, where you came from and where you went. This would not have happened on my watch.