1/ I'm going to use holiday travel as an analogy for "infosec burnout". A big cause of burnout is struggling to make people see the obvious. In this case, I struggle with the fact that airline travel over the holidays is NOT particularly busy, despite what everyone knows.
2/ Airlines fly about 85% full all the time, and on busy days (Xmas, Xgiving, summer), those numbers may rise to 95% full. A 10% increase is not large, thus those huge crowds you believe exist, and see on local TV news, don't really exist.
3/ I cite as evidence this chart. The busiest days are in the summer, when people travel on vacation. The months June through August are busier than right now for Christmas. 
4/ That airlines aren't busy on the holidays is as obvious as the non-existence of Santa Claus. It's basic logistics. It means airlines have to fly empty the rest of the year, or a stash of airplanes in reserve they pull out only for holidays.
6/ Cybersecurity is full of similar problems. Believe believe in feelings rather than measurements, evidence, math. This happens on both sides: those who ignore obvious problems, and those who believe in imminent doom.
5/ I scan the Internet, I measure things, I can see things that are obvious. I'm regularly astonished by big organizations who are unaware of their public exposure on the Internet, and the inevitable risks this causes.
7/ Conversely, there are the prognosticators of doom. Everyone is prognosticating what Mirai means for the future, but they are all wrong, because they refuse to look at what actually happened with Mirai.
8/ Eg. Mirai was due to public exposure to IPv4. No, the coming wave of 20 billion IoT devices isn't a Mirai-style danger since there are no public IPv4 addresses left. They all go on random IPv6 or behind NAT.
9/ what’s more likely in the coming years, another Mirai-style worm? Or a vendor gets popped and pushes out a signed update that automatically gets applied?
10/ When that happens, I’ll be in a conversation:
“I told you IoT was a problem”
“Yes, but your solution was to force vendors to auto update their products”
“I told you IoT was a problem”
“Yes, but your solution was to force vendors to auto update their products”
• • •
Missing some Tweet in this thread? You can try to
force a refresh
