Data Breaches: Puzzles or Mysteries?

A short post today since I'm on the road!

I've been reading the Malcolm Gladwell book "What the Dog Saw: And Other Adventures". It's a good read, which doesn't come as a surprise since I've enjoyed his other works. One of the chapters resonated with me; its title is "Enron, Intelligence, and the Perils of Too Much Information." The premise of the chapter is this - we have two kinds of investigative situations. Some are mysteries, others are puzzles. Puzzles are those where you have the ability to get "the answer"...you may just be waiting on the critical piece of information from someone before you can do so. Mysteries, on the other hand, are a bit different - you HAVE all the information, but you still can't explain what went down. Enron is a good example in this story. While many viewed the meltdown there as a puzzle, waiting for one more piece to fall in place, it was in reality a mystery. Why? Well, simple: all the data was actually in their financials. Once people looked there, it was obvious things were a real mess. But WHY did it happen, and how could it have gotten to that? That, unfortunately, was a more difficult question to answer.

This whole chapter reminded me of the data breaches organizations are going through today. Are they puzzles, or mysteries, or both? I think the answer probably depends on which side of the fence you're on. To consumers or the public who hear about the breach through some defined notification mechanism, it's a puzzle. You get that piece of information (the notification) and then you know what happened, at least as it affects you. However, for those of us detecting and responding to breaches, it could go either way. Sometimes you may actually be able to determine what happened by finding all the evidence that backs it up. Other times? Well...you may be left wondering what the hell just went wrong.

Overall, as defenders we need to get to "puzzle" more often than "mystery." I'd rather think the answers are available to us with just a little extra digging....but only time will tell.

Some interesting things in the news this week:

• Apparently, German researchers have hacked satellite phone communications. OUCH.
• Just today on ThreatPost, a great article talking about a Droid botnet with 100,000 nodes. Again....OUCH.