How to Describe Cybersecurity: Bottom Up vs Top Down

At Pythia Cyber we keep bumping into managers and leaders who are surprised to hear that cybersecurity (C/S) isn't an IT function. After we explain how C/S isn't an IT function, they often ask "then why it is always presented to us as an IT function?"

The answer is pretty simple: because most explanations use the bottom up approach. Those explanations work backwards from foiling an on-going cyberattack by showing an evil hacker in his lair and contrasting that with our heroes at their desks, heroically typing away to thwart evil in real-time.

This image is ridiculous but in an understandable way: this image is visual, which suits film and TV. This image compresses the time-scale, which suits film and TV. This image gives us a nice symmetry of evil versus good.

Of course this image is grossly simplified, as so many images are. We show teaching as the act of standing up in front of a class and talking or writing on the whiteboard. Anyone who has ever known a teacher knows that a shocking amount of time is spent in preparation, in planning lessons, in grading tests and assignments. But this activities are visually uninteresting and more slowly. Who wants to watch that? And almost all of us have had the experience of being in a classroom while very few of us have had the experience of teaching in a classroom.

Similarly almost off of us have had the experience of using a computer while very few of us have had the experience of reviewing network topology for security holes. Such review is pretty dull work even if you know exactly what to do; watching someone do it would be lethally dull.

Moving up from the bottom, from the people (let's call them CSEs) typing on keyboards to try to keep you safe up to their managers who review the evidence of the CSE's monitoring, further up to the leaders who set the priorities of the managers who manage the CSEs is simply beyond the scope of most popular entertainment or popular explanations of C/S. We run out of steam before we get past the guards on patrol. We never get to the sergeants who drill them, the lieutenants who monitor the sergeants and so on. We certainly don't get many depictions of the senior staff meetings which drive the entire process. Who cares?

If you use the top down approach, you start with the senior staff meetings but describing executives who define "digital assets" and then prioritize their protection is also pretty dull. You likely won't make it to the managers who turn policy into procedure and certainly won't make it all the way down the chain to the CSEs who follow the procedures and log their monitoring of logs.

Neither approach is perfect. Which is better depends on the audience. We start with the NIST CSF because we feel that it is easy to understand, but it is not the only option.

Unconscious bias is also a factor. If your goal is to hear that C/S is not your problem and that your fear, uncertainty and doubt (FUD) is in the driver's seat and you will love the idea that C/S is an IT function. If your premise is that managers and leaders don't know anything about technology and that you need to save them from themselves, then you will love the idea that C/S is an IT function.

Get your head out of the sand and learn to trust your colleagues to their jobs. Figure out your role in C/S and embrace it. That can be hard. We can help. Ask us how.