An Infosec lesson from the "Worst Play Call Ever"
It didn’t take long for the Seahawk’s game-losing pass to get a label.
But as Ed Felten explains, there’s actually some logic to it, and one of his commenters (Chris) points out that Marshawn Lynch scored in only one of his 5 runs from the one yard line this season. So, perhaps in a game in which the Patriots had no interceptions, it was worth the extra play before the clock ran out.
We can all see the outcome, and we judge, post-facto, the decision on that.
In security, we almost never see an outcome so closely tied to a decision. As Jay Jacobs has pointed out, we live in a wicked environment. Unfortunately, we’re quick to snap to judgement when we see a bad outcome. That makes learning harder. Also, we don’t usually get a chance to see the logic behind a play and assess it.
If only we had a way to shorten those feedback loops, then maybe we could assess what the worst play call in infosec might be.
And in fact, despite my use of snarky linkage, I don’t think we know enough to judge Sony or ChoicePoint. The decisions made by Spaltro at Sony are not unusual. We hear them all the time in security. The outcome at Sony is highly visible, but is it the norm, or is it an outlier? I don’t think we know enough to know the answer.
Hindsight is 20/20 in football. It’s easy to focus in on a single decision. But the lesson from Moneyball, and the lesson from Pete Carroll is Really, with no second thoughts or hesitation in that at all.” He has a system, and it got the Seahawks to the very final seconds of the game. And then.
One day, we’ll be able to tell management “our systems worked, and we hit really bad luck.”
[Please keep comments civil, like you always do here.]
I have no idea what a seahawk is, or why someone doesn’t give the guy in the funny hat an aspirin …
But you raise a good point about security. Even in the event of a complete breach, we still don’t know … much. What is it that we do know? I mean, beyond raw data, do we for example know as much as aircraft crash investigators know after a plane falls?
And, if after such an event we say we don’t know, what does that tell us about what we do before the event?