In my previous column (Jan/Feb issue), I discussed the negative effects of bean counters on cybersecurity efforts and possible ways to mitigate their destructive influence. In this column, I address another, less pernicious roadblock to cybersecurity: human memory.

Humans are odd collectively. While we talk about “collective memory” and “learning from history,” what we actually exhibit is a “collective amnesia.”

For example, consider the following events from history.

• The 1600s through 1900s; Native American Genocide (approximately 9 million died)
• The 1918 Spanish flu pandemic (an estimated 50 million people died worldwide)
• The 1921 Tulsa Race Riot massacre (55 to 300 people died; 10,000 left homeless)
• The 1968 My Lai massacre in Vietnam (347 to 504 people died)
• 2017-2021 Trump’s first term (National debt at $7 trillion; lost trade war with China; U.S. firms lost $1.7 trillion in value)
• The 2019 COVID-19 Pandemic (18 to 33 million died worldwide)

Some might say, “Yeah, but some of those are just politics.” However, what are “politics” but the activities groups of people use in making decisions?

Ultimately, what we can take away from this is “humans don’t like to recall things that aren’t comfortable for them.” This is strange because you would assume a species would benefit from retaining and avoiding “bad things” that have occurred in the past. As an example, remembering a tiger ate everyone in your village except for you would sound like a good way to improve the odds of your DNA being passed on to your descendants. So, if the trait is anti-survival then why do we do this?

Behold the weird world of cognitive biases. This is a set of systemic patterns defined by psychologists as deviations from rational judgment by humans. There is a long list of cognitive biases, including confirmation bias, egocentric bias, extension neglect, framing effect (that might be responsible for the “political” influence), etc.

The focus of this article is optimism bias, which causes someone to believe they are less likely to experience a negative event even when all other information indicates the opposite. Psychologists believe we have this bias because we are mortal. If every moment we had to face the fact that each one of us is eventually going to die, we would most likely curl up in the fetal position and wait to die. As such, it makes sense why we have this bias, but it contributes to our demise as well (remember the tiger). (If any of you are immortal, feel free to drop me an email describing if you have the optimism bias or not.)

Currently, we see this occurring with the Bird Flu (H1N1 strain) and a total mishandling of this virus outbreak. We know it has spread widely among farm animals (eggs are largely unavailable and expensive, and every day, we see new notifications of herds of cows being infected). That said, is there mandatory testing of animals and humans for this virus? No, there isn’t. So, when this virus mutates and starts being transmitted from human to human, we will have nobody to blame except ourselves. (By the way, those old N95 masks you saved from the last pandemic won’t help you here; the Bird Flu’s infection vectors include the eyes.)

Combine this optimism bias with bean counters (i.e., the subject of the last Cybersecurity column) and you have the setting for a perfect storm: “We don’t want to remember this, and we don’t want to pay for any mitigations against this future negative event.”

At this point, I can already hear you saying, “Chris, you’re painting a pretty bleak picture here, mate. What am I supposed to do?”

Well, for the answer to that, let’s travel back several decades to 1982. It was then a PBS TV series called “The Constitution: That Delicate Balance” first aired. The program was an amazing series with each episode addressing a specific topic. The setting was Congress Hall in Philadelphia, with all of the participants sitting in a large circle around the host, Fred Friendly. The participants were comprised of both active and past members of government, journalists, and educators. There was even at least one former president. Fred would pose the topic of discussion and then guide the group through specific scenarios; it was an amazing dive into the minds of the movers and shakers of the day. (While I would love to re-watch this series, my eyes would scream from the standard definition video.)

In one episode, the topic was terrorism and among the participants was Secretary of State George Schultz. When asked about a terror attack, he had an interesting response: “Whenever an attack occurs, we have 72 hours in which we can respond in any way we choose. After that time, criticism and obstruction will start to occur.” (I’m paraphrasing here as this is to the best of my recollection; it has been 43 years after all.)

As “defenders,” we can use this same approach. You have evaluated, documented, and received quotes for the state-of-the-art cybersecurity mitigations you feel need to be in place, but the bean counters and collective amnesia have prevented you from moving forward with these plans. This delay puts your organization at risk. Unfortunately, this means you have exhausted your options with regard to putting the proper protections in place (or at least the plan to do so), and without authorization, you’re unable to implement it. As such, at some point, your organization is going to take a hit. When that occurs, so too will you take a hit; remember, bean counters never accept responsibility for their previous actions. Assuming the organization is going to survive this attack, you have 72 hours in which to implement the state-of-the-art mitigations you previously proposed. Everyone will be on board—or at least withhold objections—and some might even take credit for the plan. 

With this in mind, keep that state-of-the-art package ready and updated with the latest quotes and equipment required to achieve the goal of securing the organization. In the event of an attack, you won’t have time to reassemble a comprehensive cybersecurity package. It is essential to strike while the board is panicked and seeking a solution. Take the cybersecurity solution directly to the board; don’t allow any middle managers to get in the way.

You’re not going to receive additional funding at a later date, so include support contracts and any ongoing expenses in your package.

Finally, don’t expect anyone to thank you for this or a pat on the back, but it will allow you to accomplish your job.

In the next Cybersecurity column, I will leave these abstract “adverse working environments” as a topic behind and return to more traditional cybersecurity subject matter.

MORE FROM THIS AUTHOR: Human-Readable SBOMs in Medtech

Christopher Gates is a recognized thought leader in medical device cybersecurity and the current co-chair for H-ISAC’s MDSC. He has more than 50 years of experience developing and securing medical devices and works with numerous industry-leading device manufacturers. He frequently collaborates with regulatory and standard bodies, including the CSIA, Health Sector Coordinating Council, H-ISAC, and Bluetooth SIG.