The cyber industry needs to accept it can’t eliminate risk

In the field of cybersecurity, there is a belief that we must hold ourselves to a higher standard of scrutiny than others. We are expected to be the benchmark of excellence – a level of perfectionism that is unattainable. So, what happens when a cybersecurity company makes a simple mistake?

CrowdStrike serves as a case study in this regard. I recall reading the technical report, and it was as ‘simple’ as adding an extra field to a template that caused everything to crash. However, I suspect this was not just a simple test case failure; it was likely a series of events that led to a significant global issue. This is often referred to as the Swiss cheese model, where a series of failures align, creating holes in the system that allow an incident to occur.

It is important to acknowledge that these incidents do happen because we can never completely eliminate risk in technology. By changing our perception of this fact, we can better prepare to handle future incidents effectively and understand the risks involved, no matter how unlikely they may seem.