Excellus breach reporting is symptomatic of a security media malaise
Instead of focussing on the scale of the Excellus breach, the security industry should stick to the what and the how of what happened. The news that there has been yet another large breach is not a surprise to me. The fact that it has hit the healthcare sector is not a surprise to me. That media coverage has concentrated, for the most part, on reporting the size of the breach is not a surprise to me. In the words of the great Radiohead “no alarms and no surprises (let me out of here)” and I feel like I’m in the video for that particular piece of music as well, in danger of drowning inside a sealed helmet while the IT security industry watches on. Why am I so narked about media coverage anyway? Because the media coverage shouldn’t, but it sure appears to, drive much of the security agenda in organisations up and down the country. Even those within the IT security industry itself, professionals who really should know better, all too often get caught up in the desire to attribute, record break, size and extrapolate (which gives us the apt acronym of ARSE you may have spotted) instead of sticking to the what and how of the matter. Yes, I know I am part of that media circus and just as guilty as the next writer for indulging in precisely this kind of ARSE behaviour. However, I also appreciate that it’s got to stop and now is as good a time as any to start stopping.