In the Challenger accident report, the “information environment” was found to be a significant contributing factor to creating the conditions for the costly (money & lives) consequences.

Can the information environment also be leading to more #CyberSecurity #breaches ?

Dekker writes “reconstructing or studying the information environment in which actual decision are shaped, in which loca rationality is constructed, can help us penetrate processes of organisational sensemaking”

Something particularly highlighted was the use of “bullets” used to summarise things. “One after the other of these little goddamn bullets in briefing books and slides” says Feynman

“Bullets filled up the information environment of NASA engineers and managers at the COST of other data and representations”. A particular page used the word ‘significantly’ 5 times with meanings ranging from “ability to see calibrated tests” up to “everyone onboard would die”

“The slide weakened important material, & the life threatening nature of the data on it was lost behind bullets and abbreviated statements” We all agree that security needs to talk in business terms, but when we aggregate information for management, do we not run this risk too?

By expressing security concerns in the “normal business terms” we achieve the benefit of normalisation against other business pressures supporting informed decision making by execs, but we also increase the likelihood of bringing to life the potential viability-affecting nature

Of the problems we wish to illustrate. I think this has significant implications into how we organise reporting and how we setup BOTH our executive security information environments as well as the operational ones.

The abstractions we use, the way we represent the data, ideally creating some dissonance between achievement of team or org objectives and which make it harder to “rationalise complex and risky decisions”

I don’t know what the best approaches are, but I’m convinced that it needs to be a consideration on the way we design security reporting at all levels so our message doesn’t get lost in a sea of abstractions and summarisations