COVID information risk analysis - retrospective

Two and a half years ago in March 2020 as we were fast approaching our first lockdown, I published the following Probability Impact Graph depicting my analysis of the information risks relating to COVID:


The PIG reports the information risks I identified at the time, thinking about COVID from the general societal perspective as opposed to a personal or organisational perspective.

You may feel this analysis was inept, superficial, vague and pointless. "Quants" may whine at the lack of numbers and statistical analysis, no doubt berating me for the dreaded red-amber-green colouring, pointing out the assumptions, biases and various other issues with it. 

Fair enough.

Despite all that, I contend that it worked well for my purposes, namely this blog. It enabled me to identify, describe/communicate, compare and contrast the concerns I foresaw - foresaw, notice: this was a prediction, projecting forward into an uncertain future.

Today, with the benefit of hindsight, I'm taking another look at the PIG. I recognise the risks and recall my analysis. I remember some of my rationale, the reasons why I placed the issues in those particular positions relative to each other.

The collateral damage risk was the highest in my estimation, heading towards the red corner but largely in the amber zone. Digging deeper, these were the forms of collateral damage that concerned me most:
  • Global economic crisis: by all accounts, we are now plummeting into a global recession with high inflation caused, in large part, by our governments spending large to bolster struggling national economies damaged by COVID, creating massive debts that will be tricky to service and clear down. Supply chain and logistical issues during COVID remain a concern as the world returns to normal (perhaps, a 'new normal' due to the great resignation and working from home?  We'll see);

  • Health system collapse: I'm not aware of any total system collapses yet thanks to the tremendous resilience of health workers and systems ... but it's a close call. Here in NZ, for instance, the health service is currently in crisis facing severe staff shortages and an exhausted workforce. Although not noted on the PIG, the NZ police and fire service are also facing crises caused, I suspect, by the coincidence of societal pressures and funding shortages, both exacerbated by COVID.

  • Widespread fear/panic ...: fear was and remains a factor although we largely avoided sheer panic leading to social disorder and looting thanks, in part, to concerted action by the authorities.

A little lower came increased cyber risks working from home:

  • Cloud service overloads: I don't think this happened, although it's hard to tell what causes the performance reductions and delays that we notice occasionally. I believe cloud services are more resilient than I anticipated, whereas "the last mile" of our telecomms services seems less reliable - well certainly down here in rural NZ anyway. This risk was a possibility that hasn't materialised, not yet anyway, and I think I over-estimated the probability.   

  • Ransomware and phishing: well before COVID, it was widely accepted that both ransomware and phishing were increasing global risks. I included them on the COVID PIG, specifically, because I thought the scammers would take advantage of COVID fears plus working from home to up the ante. In retrospect, I'm not sure about this one. There have been some incidents along those lines but the problem has not really mushroomed. Again, I think I over-estimated the risk.

I rated the FUD (Fear, Uncertainty and Doubt) and large volume of poor quality information risks similarly, with deliberate misinformation (fake news, exploitation, hidden agendas) somewhat lower. The whole anti-vaxx craziness turned out worse than I expected, in other words I under-estimated the information risks in this area. Incidents were more prevalent and caused worse problems than I anticipated, partly reflecting my own bias as a scientist with a background in infectious disease, and partly because of the (to me) surprising influence of social media which could also be a bias or misunderstanding since I'm not personally into Twitter, Facebook etc. I am perplexed at the depth of feeling in this regard, and should have paid more attention to the "outrage effect" fuelling conspiracy theories and irrational distrust of the scientific community.

Having said that, I appreciate the way that our governments and health authorities, coupled with numerous high-profile public health officials, responded to COVID with lockdown and mask mandates, and tackled the anti-vaxx movement sensitively. Collectively and individually, they stepped up to the mark. Remember, for instance, those daily TV appearances and updates by politicians flanked by epidemiologists as COVID dominated the news headlines for months on end? Three years ago, I suspect a far smaller proportion of the population would have even recognised the word 'epidemiology', or had much of a clue about infectious disease, vaccines, immunity and all that.

As to the mRNA vaccines, I am astonished at the speed with which they were developed, tested and administered en masse. Sharing of valid information among professionals is a rare example in this field of a beneficial risk with positive impacts. Without open collaboration among the scientific community, we would be in a much worse position right now. Perhaps I should have moved this risk over the left edge of the PIG.  

I'd like to discuss two other risks near the middle of the PIG:
  • Mental health issues: this is another risk I think I underestimated in both probability and impact, although we seem to have dodged the bullet thanks to the resilience of strong social networks, plus positive messages of hope and support from the authorities and experts communicated through conventional and social media. However, we may have accumulated problems that could take years to surface, perhaps causing an increase in depression and suicide due to the economic problems and other COVID-related stresses such as the social isolation, furloughs and job losses. If so, it will be difficult to disentangle the causes.

  • Diversion of attention from more important or urgent matters: aside from COVID and the looming recession, two other news headlines right now are the war in Ukraine and climate change. Maybe the world could have handled both issues quicker and more effectively without COVID but that is pure conjecture. No doubt there are other serious issues still fermenting but as COVID recedes, so does any consequent diversion of attention. Our excuses are fading!

So, all-in-all, I am reasonably happy with the information risks I identified and placed on the PIG. My predictions weren't bad but weren't entirely accurate either - such is the nature of risk and uncertainty.

I'm also satisfied with the subjective approach to risk analysis, and the colourful PIG. Regarding all those objective, scientific, statistical data and predictions that appeared frequently in the news during the height of COVID, the vast majority related specifically to epidemiology - infection rates, morbidity, the effects of vaccinations etc. Mostly they presented historical data with limited, cautious predictions. As to publicity about information risks, about all I can recall are some graphs about working from home, ransomware and phishing - none that I've seen were as wide-ranging or forward-looking as my analysis (please let me know if you are aware of any: i'd like to compare the methods). The background noise generated by endless marketing-led security surveys has not abated, and I remain as cynical as ever about those.

The PIG suits my purposes as a communication tool for explaining complex, diffuse, overlapping and emerging issues. The lack of hard values or even estimates on the axes is, for me, a strength rather than a limitation in the particular way I am using the PIG. Likewise, the deliberate absence of categories and category labels on the axes avoids any temptation to use spurious arithmetic to 'calculate risk levels'.  With no N-by-N grid overlay to worry about, we waste no brain-cycles wondering whether a risk should be 'a little to the left, on, or just to the right of the line'.  

What about COVID-related information risks that I totally failed to identify and analyse, though? What did I miss? Hmmmm, I'll have to cogitate on that. Meanwhile, if you'd like to point them out, challenge my analyses or poke fun at the Noddy colouring, go ahead. Comments are welcome.

Popular posts from this blog

Pragmatic ISMS implementation guide (FREE!)

Image
Early this morning ( very  early!) I remotely attended an ISO/IEC JTC 1/SC 27/WG 1 editing meeting in London discussing the planned revision of ISO/IEC 27003:2017 . Overall, the meeting was very productive in that we got through a  long  list of expert comments on the preliminary draft standard, debated the objectives of the project and the standard and reached consensus on most points. In summary: 27003 is to be revised to align with the current 2022 releases of ISO/IEC 27001 , 27002 and 27005 : These changes are  mostly  minor aside from the new section 6.3 on ISMS changes.
Read more

Two dozen information risks that ISO forgot

Image
Selecting the wrong controls - controls that are inappropriate, ineffective, too costly, impracticable, fragile, unnecessary, counterproductive or whatever, often as a result of blind faith in fads and fashions of the day and FOMO e.g. MFA, AI, cyber Failing to select the right controls - controls that are ideal for the particular situation, both now and in perpetuity, for whatever reason - mostly ignorance and prejudice Selecting and implementing controls at the wrong time or in the wrong way (where 'wrong' includes ineffective, inappropriate, sub-optimal e.g. bolting on controls rather than designing and building them in) Inept and inaccurate identification, analysis and quantification of risk, including reliance on p oor quality (incomplete, inaccurate, out of date, misleading, unreliable ...) information about actual risks, particularly subtle and emerging risks plus those involving deliberate concealment and misdirection e.g. fraud, misinformation, disinformation, propagan
Read more

Philosophical phriday - compliance risk

Image
According to a vendor's promotional video interview I saw recently, the 'cybersecurity compliance burden' has allegedly become so significant that [customer] organisations are eagerly buying [their] software tools and services to help them manage and fulfil their obligations. The vendor's argument goes that, instead of accumulating a ragtag bunch of policies and other controls relating to user Identification and Authentication (I&A), for instance, it makes sense to:  Identify all the cybersecurity-related laws, regulations and standards that apply to the organisation; Examine them for any security control requirements relating to, say, I&A; Rationalise the I&A controls down to the smallest set that satisfies all the requirements - the lowest common denominator; Design, implement, use, manage and maintain those I&A controls; Have the I&A controls checked or audited to gain assurance that the compliance requirements are met.  OK so far? Sounds reasonab
Read more

ISMS internal audit priorities

Image
A thread on the ISO27k Forum sparked my imagination over coffee this morning. Hope had previously asked for assistance with an ISO/IEC 27001:2022 audit plan.  Bhushan offered a lengthy and generally sound response explaining how to use a spreadsheet with tabs to plan and record the audit work performed on 100% of the main body clauses and 50% of the 93 Annex A controls, day-by-day. That's OK ... except it wasn't entirely clear that he was interpreting and elaborating on the standard's actual requirements. ISO/IEC 27001 does not explicitly require, for example, that (as Bhushan stated) "ALL the management system clauses from 4 to 10 AND their sub-clauses need to be listed and audited" in an ISMS internal audit, although evidently he interprets it in that way. In clause 9.2.1, the standard states a requirement for internal audits to provide information on whether the ISMS conforms to the organization’s own requirements for the ISMS plus the requirements of the stan
Read more

Reading between the lines of ISO27001 [L O N G]

Image
ISO/IEC 27001 is a succinct, formally-worded standard for two key reasons: It is deliberately generic, being applicable to all manner of organisations regardless of difference in location/s, size, industry, maturity, structure, information risk and security status ... and so on. In effect, it specifies the lowest common denominator - the things that ALL organisations should be doing to manage their information security controls, as a minimum. The hurdle is set low enough that every organisation ought to find value in designing, implementing and operating an I nformation S ecurity M anagement S ystem as laid out in the standard. It is a certifiable standard, explicitly specifying the characteristics that every certified organisation's ISMS is expected to have. Again, it is a minimal specification with no concept of typical, average or maximum security: that is entirely down to the organisations themselves to determine, following the information risk management processes minimally de
Read more

Passionate dispassion

Image
Someone who is actively involved in, or is managing, an activity is patently not independent of it. They may well make a conscious, rational and determined effort to be objective, dispassionately reviewing evidence etc ., but their subconscious/emotional biases/prejudices and beliefs/value-systems will inevitably influence what they do. With the best will in the world, they will struggle to challenge and assess their past decisions and activities, especially if they were "certain" or "determined" or genuinely believed they were "doing the right thing". Furthermore, it is very hard for anyone to review the things they did not do, decisions they did not make or options they did not even consider. Mostly, they remain out of sight or out of the question.
Read more

45 ISO Management Systems Standards

Image
The ISO website  currently lists 45 published M anagement S ystems S tandards: 1. ISO 7101:2023 Healthcare organization management — Management systems for quality in healthcare organizations — Requirements 2. ISO 9001:2015 Quality management systems — Requirements 3. ISO 10012:2003 Measurement management systems — Requirements for measurement processes and measuring equipment 4. ISO 13485:2016 Medical devices — Quality management systems — Requirements for regulatory purposes 5. ISO 14001:2015 Environmental management systems — Requirements with guidance for use 6. ISO 14298:2021 Graphic technology — Management of security printing processes
Read more

Philosophical phriday - a noncompliance ramble

Image
In a previous philosophical phriday post , I moaned about vendors of security compliance support/management tools and services over-promising and under-delivering - an admittedly biased, even cynical opinion piece about the compliance imperative . A recent article in Corporate Compliance Insights notes that "CISOs are not just defenders against cyber threats but also champions of compliance and operational resilience". Hmmm, are CISOs 'compliance champs', really? Today, I'm discussing alternatives to being compliance-driven. How else can organisations drive their information risk, security and related concerns in a positive direction?
Read more

Adaptive SME security Crowdstrike special

Image
As if on cue, along comes a golden opportunity to consider what the Adaptive SME security  approach has to say regarding the Crowdstrike incident: That's not 20/20 hindsight but foresight: I've picked out the most relevant rows from the security controls table published in the guide 24 hours before the incident.  Although Crowdstrike primarily supplies much larger enterprises than SMEs, the incident could equally have afflicted other security software, or indeed operating systems such as Windows and assorted cloud apps commonly used by SMEs. Regardless of the details, it is a wake-up call, an opportunity to consider and respond to the information risks ... and to adapt , accordingly.
Read more