3 ms·
Engineers design for resilience to physical failures, whose types are known and can be estimated, predicted, and modeled. Cybersecurity has to deal with human a
by warkdarrior 5y ago
Engineers design for resilience to physical failures, whose types are known and can be estimated, predicted, and modeled. Cybersecurity has to deal with human attackers, which cannot be modeled.
- syshum 5y ago>>Cybersecurity has to deal with human attackers, which cannot be modeled. It absolutely can, it is called Zero Trust, as has been a cyber security model for many many years now The problem is most organizations have their entire business workflow around the Ring Fence model, and organizations is extremely prone to "we have always done it that way" when it comes to business processes so they expect IT to buy some software, or some widget to bolt on to the ring fence that will protect them Businesses need to completely rework their internal methodologies, and processes which is something most companies refuse to do
- staticassertion 5y agoWe model human attackers all the time, it's probably one of the core components of the role.
- throw10920 5y agoHuman behavior is absolutely modelable - usefully, even ("all models are wrong but some are useful") - and people in security do it all the time. Moreover, engineers also design for resilience to human "attackers" in physical systems all the time. If anything, cybersecurity is easier because you can leverage the work of tens of thousands of other people in your tooling. You wanna re-write ssh or fail2ban yourself?