Dan Geer, in a recent keynote[1]: >> The root source of risk is dependence, especially dependence on the expectation of stable system state. Dependence is not

Dan Geer, in a recent keynote[1]: >> The root source of risk is dependence, especially dependence on the expectation of stable system state. Dependence is not only individual but mutual, not only am I dependent or not but rather a continuous scale asking whether we are dependent or not; we are, and it is called interdependence. Interdependence is transitive, hence the risk that flows from interdependence is transitive, i.e., if you depend on the digital world and I depend on you, then I, too, am at risk from failures in the digital world. If individual dependencies were only static, they would be eventually evaluable, but we regularly and quickly expand our dependence on new things, and that added dependence matters because we each and severally add risk to our portfolio by way of dependence on things for which their very newness confounds risk estimation and thus risk management. Interdependence within society is today absolutely centered on the Internet beyond all other dependencies excepting climate, and the Internet has a time rate of change five orders of magnitude faster. Remember, something becomes "a critical infrastructure" as soon as it is widely enough adopted; adoption is the gateway drug to criticality. [1] https://www.youtube.com/watch?v=gbDEbfijxNY https://www.youtube.com/watch?v=gbDEbfijxNY (plaintext: http://www.bsidesdc.org/history/geer.html http://www.bsidesdc.org/history/geer.html )