When the forecast for a snowstorm -- or a cyber event -- ranges between nothing and a disaster, it isn't really a forecast at all. It is a bad guess.
This has been an interesting winter. There have been lots of snowy forecasts, many of which failed to live up to their billing. As I write this post there is yet another forecast for perhaps somewhere between zero and 24 inches of snow scheduled to start less than 48 hours from now.
How is that forecast helpful? When the range of possibility is somewhere between nothing and a disaster or when forecasts are wrong more than they are right, they aren't forecasts at all. They are bad guesses. The truth is, when it comes to snow, we don't know what's going to happen until it happens. It's all a big guess. This winter has proven that.
When you think about it, that's where we are with cybersecurity. We have just enough threat and vulnerability data to know that something bad could happen, but we don't have the ability to predict, when, where, or how bad an event will be. We deal with cyber events after the fact... once the damage is done... after the bad guys are in. Alternatively, as happens with snow forecasts, sometimes we sound the alarm for a cyber event that doesn't happen. Such false alarms can be disruptive and can cause people to ignore legitimate warnings.
Big data and analytics could give us the ability to radically change our current cybersecurity strategies by allowing us to move beyond purely reactive behavior to be more predictive and enable us to implement preventative solutions in a proactive manner. To achieve this it will be necessary to harness vast amounts of security-related data very quickly in order to recognize meaningful patterns and trends that could be indicators of clear and present danger, rather than low probability guess-work.
The ability to anticipate cybersecurity events with a high degree of accuracy will be very valuable as it will give us the ability to recognize legitimate threats and prevent them from happening, instead of reacting to such events after they occur, or overreacting to non-events.
Now, let's see what happens with this snow storm. The forecast is somewhere between 0 and 24 inches. Plan accordingly.