Oz infosec spooks: ease back on the “cybers”, this is serious Sensationalist language is making it hard to educate businesses and the public about infosec risks*, according to the Australian Cyber Security Centre's 2016 threat report. While every ICMP ping is treated as an attack by some, the report says unequivocally: “Australia still has not been subjected to malicious cyber activity …
The problem is that if you're a bureaucrat and you don't make the problem look dire, then your funding gets taken away, and also your promotion.
There's more money, publicity and career advancement in scaring people than in saying everything's all-right. When nothing happens 3 years down the line, you can say it was due to all your efforts.
Terrible tactics.
Something Bad may or may not happen to Australian CNI by way of cyber attack in, say, the next three years. The probability of that is unknowable.
ASC have made an (educated) guess that it won't.
If they're right, they won't get any thanks for it. No-one's going to be asking questions in Parliament congratulating them on their prescience.
If they're wrong, they're going to be dragged through the streets behind the metaphorical technical of public and political opprobrium.
Thus, this tactic is one that can only lead to a draw, or a loss.
If they'd said "Arooga arooga, the cybers are coming" and nothing happens, no-one will blame them, because the need to improve security is universal; any improvements can only be beneficial, and have a mitigating effect on the overall, aggregate cost of Teh Cybers across the entire economy.
If they'd said "aroooga!" and something /does/ happen, they will get to look good, *and* be able to shift the blame onto those organisations who tuned out their comms as just more noise. "We warned you!"
win / win.
And that, O best beloved, is why the founders of cyber security firms in California all drive Porsches.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
