Cybersecurity is radically asymmetrically distributed.
Rick Howard: Hey everybody, Rick here. Let's start with this. Cybersecurity is radically asymmetrically distributed. [ Music ] I first heard of this idea from an unusual source, Malcolm Gladwell, the famous author and podcast host. He gave one of the keynotes at the 2023 Google Mandiant MWISE Conference in Washington D.C., and you may be rightfully asking yourself, what does a world-renowned author and podcast host, whose expertise is in the ballpark of the social sciences, know about the world of cybersecurity? And why was he presenting the keynote at one of the infosec profession's flagship conferences? I'm glad you asked. I think mostly it was because Google paid him to do it.
Tim Allen: Oh, yeah.
Rick Howard: That said, he brought an original idea that I had never considered, or at least he crystallized an idea that had been bouncing around in my head since we started writing our First Principles book back in 2022. [ Music ] His idea was that most of us believe that the problems we all are trying to solve in our daily lives are normally distributed to everyone. That things like climate change, nuclear accidents, and the most effective ways to water our lawns impact everybody equally. When he suspects that some problems are asymmetrically distributed. In many cases they are radically asymmetrically distributed. He said that he appreciated the hubris of a non-cybersecurity expert like him coming into a room filled with cybersecurity experts like us and suggesting not only a new idea, but perhaps a revolutionary way to approach the problem of cybersecurity. With that big caveat, he said that he thought cybersecurity was a radically asymmetrically distributed problem. Well now, that seems interesting, since the entire purpose of our first principles book was to talk about cybersecurity strategies and tactics, does understanding and believing that cybersecurity is a radically asymmetrically distributed problem change the strategies that we might choose? Gladwell seems to think so. Let's find out. So hold on to your butts.
Samuel L Jackson: Hold onto your butts -- butts -- butts --
Rick Howard: This is going to be fun. [ Music ] My name is Rick Howard, and I'm broadcasting from the N2K CyberWire's Secret Sanctum Sanctorum studios located underwater somewhere along the Patapsco River near Baltimore Harbor, Maryland, in the good old US of A, and you're listening to "CSO Perspectives," my podcast about the ideas, strategies, and technologies that senior security executives wrestle with on a daily basis. [ Music ] For those who don't know, I'm a huge fan boy of Malcolm Gladwell. He's the best-selling author of books like The Tipping Point, Blink, Outliers, Talking to Strangers, and The Bomber Mafia, which is my all-time favorite. It's about the U.S. Army Air Corps' glorious quest to make warfare less murderous in the transition between World War I and World War II. The men behind the effort spectacularly failed, but boy, did they give it a try. Gladwell is also the co-founder of Pushkin, an audio production company similar to N2K CyberWire in that Pushkin hosts a network of podcasts. Out of the 44 that Pushkin publishes, my favorites are "Against the Rules," hosted by Michael Lewis of Moneyball fame, "Medal of Honor, Stories of Courage," hosted by Gladwell, and "Revisionist History," also hosted by Gladwell, and I'm a little bit envious that Gladwell thought of the Medal of Honor podcast before we did. Those kinds of stories are like catnip to me.
Tim Allen: Oh, yeah.
Rick Howard: There have been over 3,500 recipients since President Lincoln signed the medal into existence in 1861, and there are 61 living recipients as of this summer, 2024. All of their stories are in the public domain, and each one is inspiring and jaw-dropping heroic. They are perfect for a podcast. But I've been listening to "Revisionist History" for years. Whenever a new episode drops, that's the first thing that I'm listening to that day. He takes a subject that everybody thinks they know, revisits it, and completely blows your mind with another version of the story. His rant about how taxpayers fund private golf courses on city land that the public can't use will make you think twice about the late great comedian Bob Hope. His screed about college rankings and how elite schools with large endowments have no interest in public education and diversity will make you weep for the country. His six-part series on gun control will make you realize that all the efforts to restrict automatic weapons and magazine sizes that have thus far failed to get through in the U.S. Congress would probably have little effect on reducing the damage caused anyway. And his current series on the run-up of the United States' participation in the 1936 Olympics in Nazi Germany may provide some insight into America's modern-day flirtation with its own version of fascism, former President Trump's version of how he wants to run the government. See what I did there? I slyly threw in my opinion about the upcoming United States presidential election, hoping you wouldn't notice. I guess you know where I stand now. I'm not supposed to talk about politics in this podcast but allow me this one tiny digression. As Craig Ferguson, the former late-night talk show host, used to say:
Craig Ferguson: I look forward to your angry letters.
Rick Howard: For the U.S. listeners specifically, and maybe international listeners with a passing interest in the state of democracy in the world, I'm recording this on the morning after President Biden dropped out of the 2024 U.S. presidential election. Regardless of who replaces him as the Democratic nominee, this election is unique. Normally, presidential elections are about which politician you hate or love or about this policy or that. But in this election, those things pale to what it's really about. In this election, citizens will decide if the United States will continue to be a liberal democracy or transition to a fascist state. When you strip away everything else, that's the choice. For the American listener, then, choose wisely, grasshopper. Whichever way it goes, the result will impact generations of Americans. The reason I'm a big Gladwell fan is that he excels at blending storytelling with scientific research in an effort to make complex ideas accessible to a wide audience. He tells the executive summary so that we, mere mortals, can get a glimpse, however shallow, of the underlying issues of the topic. His critics say that he oversimplifies and lacks scientific rigor.
Tim Allen: Oh, no!
Rick Howard: I find that puzzling and quite amusing when, for example, he summarizes a 15-page peer-reviewed research paper on the threshold models of diffusion and collective behavior from the Journal of Mathematical Sociology. Of course, he's going to shave off some of the details and round off the corners of some of the math. That's what happens when you summarize. I think his critics are mostly bitter that Gladwell's books regularly land on bestseller lists, while their deeply researched academic books and papers do not. In his keynote, Gladwell described two problems that most people think are normally distributed, when in fact they are radically asymmetrically distributed. U.S. automobile pollution and COVID-19 infection causes. Let's start with car pollution. [ Music ] In 1966, in an effort to improve air quality, California passed the first statewide law to mandate frequent automobile emissions tests. By 2024, at least 30 states have similar laws on the books, mandating that their citizens get their cars checked at least annually to ensure that they aren't spewing dangerous toxic chemicals at unacceptable levels into the environment. According to Gladwell, these laws assume that every citizen's car is likely to do that, that every car is moments away from being a heavy polluter, but he points out that in 2024, almost 60 years after the California law went into effect, car emissions technology has improved. Back in the 1960s, manufacturers didn't even worry about pollution. The 1963 Porsche 911, for example, only had a simple blow-by device to return unburned gases from the crankcase back to the combustion chamber. Catalytic converters weren't a universal thing yet, but in 2024, they are. Modern cars produce significantly fewer emissions due to advanced technology and stricter regulations. The chances that a modern car is spewing exhaust at unacceptable toxic levels is much smaller than the cars made in the 1960s. The problem is no longer universally distributed. According to Gladwell, that means the strategy that worked back in the 1960s, annual exhaust checks for all cars, is probably not the most effective. He suggested that you could have the same effect by deploying exhaust detectors in conjunction with traffic light cameras deployed at key intersections, designed to identify malfunctioning technology. The strategy transforms from making everybody do something to discovering the outliers and making them do something. The outliers in this case are the asymmetric distribution. [ Music ] Gladwell made a similar observation about COVID-19 transmissions. I know that nobody really wants to relive the over three years of COVID-19 pandemic lockdown that we all did from March of 2020 to May of 2024. But Gladwell was interested in the first days when everybody was confused about what COVID-19 was and whether or not it was dangerous. I remember back in February of 2020, I had just joined the CyberWire and my first official act was to represent the company at the annual RSA Security Conference in San Francisco. The World Health Organization had just declared COVID-19 as a public health emergency of international concern just before we all arrived. All of my friends and colleagues were walking around San Francisco asking ourselves if we should really be there mingling with the 35,000 attendees who would immediately get on planes afterward, traveling back to the four corners of the world and spreading whatever diseases they came into contact with. Gladwell's example came a month later, the Boston, Massachusetts super spreader event. Local Boston News reported that 100 people from around the world convened at the Boston Marriott Long Wharf Hotel for a leadership conference led by the Cambridge-based company called Biogen. When they got home, those 100 people infected more than 330,000 people worldwide with COVID-19. In his keynote, Gladwell cited a preliminary MIT study that theorized many of the 100 attendees to the Biogen conference were super spreaders, individuals who infect many more people than the average person would. The study further theorized that one quality that made them super spreaders was the size of the water droplets coming out of their mouths when they breathe. Compared to an average human, their water droplets were exponentially larger. Larger water droplets could hold more virus. The bigger the virus load then in the water droplet, the greater the chance that the already infected would infect more people. Gladwell was quick to point out that these were just theories and that more study was required, but if you assume that it's true for a second, how does that impact your pandemic survival strategy? What we did do is assume that all people were equal opportunity infectors. We assume that the problem was universally distributed. That meant that we adopted tactics that everybody needed to do. Stay at home, wear masks if you absolutely needed to go out, and keep a safe distance from your friends and colleagues even if you were wearing a mask, but if you assume that infecting other humans is radically asymmetrically distributed to mostly super spreaders with overly large water droplets for breath, your strategy might be completely different. It might be to locate those super spreaders and lock them down, not everybody on the planet. I'm not saying this would have been easy, but it might have been far easier than what we did do. At the very least, we could identify those super spreaders and ask them nicely not to attend the RSA security conference that year. That would have been something. [ Music ] At this point, you're asking yourself, how does this apply to cybersecurity? In our First Principles book, I outlined how in 2021, the FBI said that approximately 5,000 U.S. organizations had self-reported that they had been compromised by some kind of hacker. Assume that there exists some five times that number who didn't self-report. Call it 25,000 then, but there are roughly six million organizations within the United States like federal, state, city, county governments, academic institutions K through college, non-profits, and public companies. Twenty-five thousand divided by six million is a really small number. The chances that any U.S. organization will be materially impacted by a cyberattack is tiny. I've been working in cybersecurity for 30 years. Since the beginning, my peers and I have been treating cybersecurity as if the danger was imminent, that at any moment we would all be overrun by the hacker hoards. That's just not true. [ Music ] And that's our show. Well, part of it. There's actually a whole lot more, and if I say so myself, it's all pretty great. So here's the deal. We need your help so we can keep producing the insights that make you smarter and keep you a step ahead in the rapidly changing world of cybersecurity. If you want the full show, head on over to thecyberwire.com/pro and sign up for an account. That's thecyberwire, all one word,.com/pro. For less than a dollar a day, you can help us keep the lights and the mics on and the insights flowing. Plus, you get a whole bunch of other great stuff like ad-free podcasts, my favorite, exclusive content, newsletters, and personal level of resources like practice tests. With N2K Pro, you get to help me and our team put food on the table for our families, and you also get to be smarter and more informed than any of your friends. I'd say that's a win/win. So head on over to thecyberwire.com/pro and sign up today for less than a dollar a day. Now if that's more than you can muster, that is totally fine. Shoot an email to pro at N2K.com and we'll figure something out. I would love to see you over here at N2K Pro. One last thing. Here at N2K, we have a wonderful team of talented people doing insanely great things to make me and the show sound good. I think it's only appropriate you know who they are.
Liz Stroke: I'm Liz Stokes. I'm N2K's CyberWire's Associate Producer.
Tre Hester: I'm Tre Hester, Audio Editor and Sound Engineer. >> Elliot Peltzman; I'm Elliot Peltzman, Executive Director of Sound and Vision.
Jennifer Eiben: I'm Jennifer Eiben, Executive Producer.
Brandon Karpf: I'm Brandon Karpf, Executive Editor.
Simone Petrella: I'm Simone Petrella, the President of N2K.
Peter Kilpe: I'm Peter Kilpe, the CEO and Publisher at N2K.
Rick Howard: And I'm Rick Howard. Thanks for your support, everybody.
All: And thanks for listening. [ Music ]
