Transcript

FUD and Cyber · CYBR.Signal

0:00
SPEAKER_00: And hello, everybody.
0:01
SPEAKER_00: Happy Cyber Sunday.
0:02
SPEAKER_00: Hope you're doing well.
0:04
SPEAKER_00: So, one of the things that pops up in our industry a lot is around alert fatigue and you know inability to make decisions sometimes because just too much information or not knowing that a decision needs to be made because there's too information, too much information.
0:25
SPEAKER_00: So you've just got so much stuff hitting you.
0:28
SPEAKER_00: You've got kind of the whole term we've used, unknown unknowns.
0:34
SPEAKER_00: You just don't know what's what because you got too much coming at you.
0:37
SPEAKER_00: So you don't know what kind of decision make to decision to make.
0:40
SPEAKER_00: You don't even know if there is a decision to be made.
0:44
SPEAKER_00: And when bad things don't happen, maybe in your environment, and that maybe because you can't detect them because you got so much information coming at you, then you get kind of desensitized after a while.
0:58
SPEAKER_00: You don't know that something's going on, possibly in your environment, which it probably is if you can't make heads or tails of the information that's coming at you.
1:08
SPEAKER_00: So you get desensitized to it because it doesn't look like anything bad is happening.
1:14
SPEAKER_00: Um, you get fatigue from all this stuff coming at you.
1:18
SPEAKER_00: You don't make decisions, so you kind of have a paralysis because you you don't know with so much information, you don't know what decision to make, or you just don't know that there's a decision to be made.
1:29
SPEAKER_00: So that's all very common in cybersecurity, in security operations, all of that, where you're seeing all this stuff and you just don't know what to do, or you don't know that there's something to do.
1:42
SPEAKER_00: Um I look at that same thing happening with, and this is a recent article that popped up uh here in a friend of mine, Ben Rothkey, is uh he commented on it.
2:00
SPEAKER_00: And it's not around alerts coming through, it's around FUD marketing or fear, uncertainty, and doubt marketing.
2:12
SPEAKER_00: So I think we've if you're in this environment, even if you're not in cybersecurity, it's a term that's used, but I think it's absolutely used a lot in cybersecurity.
2:22
SPEAKER_00: And that is somebody who is uh or are someone who's a leader or decision maker or whatever within cybersecurity department, within a company, and they try to um make sense, make heads or tails of all of the information coming at them from cybersecurity vendors.
2:45
SPEAKER_00: And and what they end up seeing is a lot of like uh they this one says that this is a bad thing, this one says this is a bad thing.
2:53
SPEAKER_00: If we don't implement implement their product, um we're gonna have a huge gap in our network, all of these things.
3:00
SPEAKER_00: How do I make a decision?
3:03
SPEAKER_00: Um, hey, we there was a hack last week, uh an attack, and it was because of this particular vulnerability, and this happens in my industry a lot, or it could are, you know, we developed applications that had this vulnerability, and if I don't implement this, all those things.
3:21
SPEAKER_00: Fear, uncertainty, and doubt.
3:23
SPEAKER_00: What if I don't do this?
3:24
SPEAKER_00: Am I going to have a problem?
3:27
SPEAKER_00: And what I see is that they're I think a lot of marketers and vendors have, and this is not talking evil about all vendors, like they all do this or anything, but I do think that some of them or a lot of them have learned their lesson on putting FUD out there.
3:49
SPEAKER_00: But for the ones who still do, you still run the danger of having people be desensitized to things because you're talking about it all the time in all of your marketing.
4:03
SPEAKER_00: You run the danger of them not knowing what decision to make because they've got five vendors all telling them the same thing, all in the same space, or they don't know that there's a decision to be made because hey, they didn't implement your technology and nothing bad happened, even though, again, something bad might be happening, we don't know.
4:24
SPEAKER_00: So the same it's the same concept in both, and we have to make sure that as best we can as cybersecurity decision makers, excuse me, that we don't get caught up in that, for one.
4:42
SPEAKER_00: And two, it's not just vendors doing it.
4:47
SPEAKER_00: There are, and you can read the article, we'll I'll link it in here.
4:52
SPEAKER_00: There are organizations that have, you know, they have a skin in the game, if you will, of making making sure the cybersecurity market keeps going and gets better and better and better.
5:05
SPEAKER_00: And they're they're not necessarily providing or bigger and bigger and bigger, and they're not necessarily providing a product.
5:11
SPEAKER_00: What they're probably providing in a lot of ways is a service, and that could be something like news articles, that could be, hey, I want you to buy my service to make you a better cybersecurity professional, things like that.
5:23
SPEAKER_00: So we have to look out in this industry and make sure that we're not just watching FUD coming from vendors, but we're looking at it from other areas that have skin in the game who are trying to make the cybersecurity market bigger and doing it in artificial ways.
5:44
SPEAKER_00: Look at the article that I post.
5:46
SPEAKER_00: You'll know what I'm talking about, but it essentially has to do with the number of jobs that are open, how big the cybersecurity market is, how big of a problem it is, things like that.
5:57
SPEAKER_00: Watch out for those things and make sure you don't just go parrot those numbers without there being some evidence to back it up.
6:04
SPEAKER_00: So, kind of an important topic.
6:06
SPEAKER_00: Let me know what you think.
6:08
SPEAKER_00: Read the article.
6:09
SPEAKER_00: It's a great article.
6:09
SPEAKER_00: Ben Rothke did a great job in putting his stuff in there too.
6:12
SPEAKER_00: It's not just his article, but actually, I'll link that article and his article as well, uh, another article that he wrote on this very topic.
6:20
SPEAKER_00: So let me know what you think.
6:21
SPEAKER_00: Talk to you next time.