We’ve heard of “security by obscurity”, the idea that if one doesn’t tell anyone about anything security related they are more secure (they’re not). We’ve heard of “security theatre”, the idea that waving hands and making a show of being security conscience makes them more secure (they’re not).
Welcome to “security by pity” I guess:
What’s worse?
Being hit by ransomware attack that sees criminals steal information about your staff and passengers…
or…
Being hit by ransomware attack that sees criminals steal information about your staff and passengers, AND then have the gang tell the world that your firm’s IT infrastructure is so chaotic, poorly-secured, and downright irritating that it refuses to repeat the attack.
(via Graham Cluley)
I don’t have another source to verify the story, but even if it’s fake it still is a lesson.
I don’t post much about security these days, be it information or “cyber” or physical. Why?
- There’s not much new under the sun;
- Few learn from what’s come before;
- As such, the same mistakes are made over and over again, because
- Magical thinking (It can’t happen to me).
This story breaks #1, at least for me, and thus warrants a post.
※ Do not copy AirAsia’s approach.
Throwing up one’s arms and giving up on security while staying in business is not valid. If unconvinced, look at the public school systems, hospitals, and charities criminals are happy to raid.
But also, do not be the CISO/CIO/CRO who’s organization is not attacked through pity for weak security hygiene.

