Sometimes A Breach Is All We Need

This is a repost from the Empath Cyber Power Up Newsletter! Did you miss getting this in your email? You can sign up to the #1 MSP Cybersecurity Newsletter in the world right here: www.empathcyber.com/powerup

You’ve heard it said that experience is the best teacher. But Researchers at MIT recently proved this was the case. They discovered brain activity that actually proves our beliefs and tell us how we view the world around us.

Often times referred to as Bayesian integration (a cool sounding name, no doubt), proves that when we encounter new situations in life, we nearly always rely on previous experiences to determine how to respond.

Researchers believe that prior experiences change the strength of connections between neurons. The strength of these connections, also known as synapses, determines how neurons act upon one another and constrains the patterns of activity that a network of interconnected neurons can generate.

So the premise is this: our brains are hard wired to use prior experiences when working through an unknown confrontation. But what if we’ve never had a prior experience?

That gets me thinking… what do we do with decision makers who simply don’t have any historical prior experiences when it comes to cybersecurity? No wonder they make poor decisions.

They simply don’t have the neuron associations to know how to appropriately respond.

The State of Minnesota Agrees

The state of Minnesota is a perfect example of this scientific revelation. The great Gopher State is ready to spend big when it comes to cyber. Just this week they announced a $24 million grant program, much of it dedicated to cybersecurity to help school systems and state government to shore up their lacking cyber defenses.

I’m curious if you see what’s behind the curtains here. What took the state of Minnesota to move on this was a large scale cyber breach a few months ago from Minneapolis Public School system in which nearly a hundred thousand records were stolen.

Oof.

But hey, here’s the silver lining: now the bureaucrats care. Just as MIT discovered, guess what? Those brain synapses are firing full speed ahead. For the first time, the state is using prior experiences to determine how to handle the unknown.

Will it work? Will throwing money at a problem fix anything?

Probably not. Money doesn’t fix everything. How often do we see misappropriation of funds and complete waste of resources? Having been a government employee many years ago, I witnessed this just as much or more than when those funds were spent and used wisely.

Let’s Bring This Home

Regardless, there’s a lesson learned here. We should encourage our decision makers to try and understand the ramifications of a breach. But we also need to be sensitive and understanding when they simply don’t have the “Bayesian integration” to understand how to prioritize a breach.

But all is not lost. I believe we can “teach” some of this Bayesian integration to our clients. Ever wonder how? Here’s a few ideas as we close out this week’s newsletter:

1. Use other client stories to teach. Everyone loves a good breach story. So learn to tell them. They are powerful.
2. Walk your clients through a cybersecurity tabletop test. Sponsor a lunch and learn session and take them through a simulated breach. This can be an eye-opening experience.
3. Use a data-driven risk assessment salted with peer metrics and measurable data to show clients where they stand and why they are far outside of their peers.

But what else? What’s worked for you? What have you seen to “teach” Bayesian integration to your clients? I’m curious to know!

Reply back to this email and let me know your thoughts!

That's all for now!

Did you miss this from my newsletter? If so, you can sign up to the #1 MSP Cybersecurity Newsletter in the world right here: www.empathcyber.com/powerup

If you have any interesting projects or ideas, please reach out to us by [email protected] or hit me up on LinkedIn. As always, thanks for reading, and see you next time. 🫡

Find Empath Cyber and Wes here:

• empathcyber.com/join 
• linkedin.com/wesspencer 
• https://www.thecybercast.com/
• https://twitter.com/wes_spencer
• https://www.youtube.com/wesspencer