Security Curve Weblog

Thoughts about Tragedy and Cyber Hype

First off, my apologies for being slow on the blogging the past week or so - it's that time of year when work is at it's maximum volume, and free minutes are few and precious; the blog - along with my personal grooming - have suffered because of it. In any event, this morning, as I sit in a hotel in upstate New York, I came across an article describing a report by the Business Roundtable that describes how we are all metaphorically sitting around with our pants down waiting for the inevitable "Cyber Katrina." The watchword from this thinkitank is apparently preparedness - like the boyscouts, we should all be prepared for the fact that any minute now, a digital weathersystem could move in, burst our various levies and leave us homeless... or so they say.

The idea of a "Cyber Katrina" was what really struck me; for years, we've been hearing about a Cyber Pearl Harbor, a Cyber 9/11, or a Cyber Tsunami - insert the most recent newsworthy disaster and slap a "cyber" in front of it, and experts have been telling us that it's going to happen for the past ten years. Which got me thinking - how likely is this really? Nobody seems to really question this concept, but yet the Internet has been around for a while now, and we have yet to see a disaster materialize. Have we just been lucky? I don't think so.

Instead, I think the metaphor is inapplicable. I think the press (and us as readers) should stop participating in the FUD-mongery by eschewing articles telling us this kind of thing is unavoidable. Look, disasters on the Internet are different from disasters in the physical world. Aside from the fact that nobody dies because they can't run Solitare for a few days, the kind of damage these events cause renders the metaphor inapplicable. The worst of worms we've seen to date like the Morris worm, Code Red, and SQL Slammer that shut down double-digit percentages of the Internet have damages listed in millions of dollars just like a physical disaster. But the kind of damage is different - worms and other outages cause damage mostly in loss of productivity, whereas Katrina caused millions/billions of dollars in property damage. Not the same thing: if houses and other buidlings are washed away, it takes years to rebuild; if machines are disabled, you just reboot and reinstall. in one case, business stops because workers are in the hospital or can't get to the office - in the other case, you might need to reload some data from backup tapes. Sounds totally different to me...

So, I am asking for a moritorium from the "digital --insert-disaster-here--" crowd. It won't happen, it can't happen, so please stop hyping it up.