The Obsidia Project Launches
The Obsidia Project is stepping up to document important incidents.
Why we believe what we believe, and how we update those beliefs are at the heart of any community of practice. Science, engineering, medicine and more have hierarchies of knowledge, starting with case studies, and going up to double-blind randomized trials to test new treatments. In cybersecurity, we rarely even get independent case studies, where the facts are captured and protected against link-rot and fading memories.
That independent history and analysis were amongst the reasons I was so happy to see the US (and then Australia) stand up Cyber Safety Review Boards. Sadly, the United States has left ours unstaffed.
That's why I’m excited that the Obsidia Project is stepping up to create “authoritative public case studies of the world’s most consequential cybersecurity incidents, built so the field can stop repeating its disasters.” It’s also why I’m happy to be an advisor as they release their first study, on Colonial Pipeline.
The 23 page report includes a 2 minute briefing, a verified timeline of events, technical analysis, findings and recommendations, and is accompanied by a 12 page tabletop.