Thread by @ErrataRob

27% chance of #ransomware happening on a weekend

compared with

28.6% of any random event happening on a weekend (2 divided by 7).

https://twitter.com/KaseyaCorp/status/1240101619385143297

Such reports really bug me. Completely random events break down as:
28.6% on weekends
29.8% during work hours
41.7% after work hours

Statistically, #randomware is slightly more likely to happen during work hours than random chance.

It's like the age-old observation that 40% of "sick days" that employees claim take place next to a weekend (Mon or Fri).

Sometimes the field of cybersecurity is little different than the science of astrology. Let's take what a statistically random sequence of events and search for patterns that fit our prejudices.

Oops, I see that I accidentally misspelled #ransomware. On further reflection, however, maybe I didn't. Maybe my subconscious is smarter than my conscious.

Bah, I knew it was Dilbert from which I got the joke, but I couldn't remember, and didn't want to search for the cartoon.

Now if somebody could find the Dilbert cartoon for me where the PHB fails to priority things because everything is the top priority.

https://twitter.com/vmyths/status/1411455648831885317

Note that this thread is not a criticism of Fireeye. They do work and have good data. And even the smartest person falls into the astrology trap. It's the plague of data breach investigations where we tend to see what we are biased to see rather than what really happened.

Instead, this thread is meant as a lesson in the problem. See how we look at the data and come away with nearly opposite conclusion? (the data shows slightly more likely to happen during work hours than random chance)