Neil Daswani - Big Breaches: Cybersecurity Lessons for Everyone

John Caruthers, former FBI SSA

Neil and Moudy have written a book that will help us reduce our exposure as a society to future big breaches but also to many of the technology risks we face in an increasingly digitized society. They do this not by presenting a recipe for success but by making the subject accessible to audiences who are not usually addressed by cybersecurity books.

Cybersecurity, or more broadly computer and information security, is now very clearly a concern for more than just the security specialist or the software engineer. Thats been true for a while. But while the technical bookshelves are full of security textbooks and guides, I dont think weve yet seen the range of material which would help bring a greater variety of backgrounds and professions into the security tent. Policy and political analysis or hacker human interest stories are increasingly common subject matter for the publishing industry. They are important as the field grows, but I see in Big Breaches a category that blazes a different and challenging trailbridging the divide between the deep technical details of attacks and the practical technical, corporate, and societal actions which would make us less vulnerable. It is not easy to summarize or simplify while remaining accurate and useful, but that is what this book does. I hope Big Breaches is but one of the many books that will continue to fill this gap of understanding.

Let me illustrate this with a couple of topics which are integral to Neil and Moudys narrative. Theyll discuss them in greater detail, but I think they are particularly important as we build this societal understanding.

First is the ever-so-exciting hygiene and maintenance. Thats part of the problem; nobody wants to do it. But hygiene, starting with an accurate inventory of the IT assets and data which any company relies upon, is foundational to cyber defense in the twenty-first century. Beyond inventory, its not hard to see why hygiene is often ignored. Who wants to spend their time on bug fixes or rewriting code and testing it for a new version of middleware or a new database when you could be innovating for your customers? The shiny object of a new user journey on a mobile platform or expanding into new markets and geographies is stiff competition for the software developers time. How do we get better at hygiene? Its not the only way, but a shared understanding between the technical experts and the business decision makers of the vulnerabilities that sloppiness can introduce is a necessary start. To help build such a shared understanding, the first part of