I’ve been found myself over the other side of the world lately doing a bunch of talks on all sorts of different security things. One of them has been about lessons learned running the data breach service known as
Have I been pwned. There’s a whole bunch of interesting things I’ve come across in my travels, but what really seems to be resonating with people is how the media tends to represent these incidents compared with the underlying reality. Let me share a examples from the talk here.
One that immediately comes to mind is the sensationalism of the malicious actor. No longer content with merely acknowledging that a “hacker” was to blame, we see headlines such as
TalkTalk hacked by 'cyber jihadi' group. In fact that particular piece goes on to quote a “former cyber crime cop” as stating the perpetrators were “from Russia and are an Islamic cyber jihadi group”. This is pretty much your most fearsome possible combination of buzzwords all rolled into one statement and it completely belies what we ultimately came to know as the truth…
