Dear HAL 9000

Reading the news lately has me wishing that, in the wake of cybersecurity incidents, there was something between press releases and brutal take downs. I don't want the bland reassurance of the average press release. I don't want the 20/20 hindsight of the average blog post. When I see a cybersecurity incident in the news I want a clear, credible description of the issue, ideally from the people who experienced that incident, followed by some expert advice, perhaps from an AI. I want Dear Abby but written by the HAL 9000.

On the one hand the spin machine is trying to minimize the business impact of whatever happened. Mostly these efforts are aimed a share price and market share, instead of enlightenment and greater community security.

On the other hand the click bait is trying to paint a terrible picture of the kind of horror we can all feel better reading about--at least I'm not that guy!

True, there are a few cybersecurity news outlets which are both responsible and technically sound, but they always stop short of giving us the lessons or the recommendations that any of us would need or want in order to make sure that this doesn't happen to us some day.

My hands are not clean on this score, I am the first to admit. All too often I stop reading these articles once I find that I don't have the targeted vulnerability.

Do I stop and reflect on whether or not I have the equivalent vulnerability, or if I have a variant of that issue? Not often enough because I suffer from Cybersecurity Incident Fatigue. There is too much news to skim. There are too many vulnerabilities to know about so I can't afford the mental bandwidth to contemplate issues that I likely don't have.

The problem is that I don't have the perfect insight to know exactly what issues I do have. Someone on my team ought to be doing this. On our team we share this responsibility around a bit but I think that it is time to get serious and rigorous. Join me in trying to normalize worrying more about cybersecurity and less about PR or hit jobs or postmortems that don't end in action items. Until someone creates the Dear HAL 9000 agony column we are all we've got.