A part of governance, risk, and compliance campaigns is “setting a tone from the top.” Executive management should point out different types of cybersecurity threats and how they can be recognized. It should then be clear on what part IT plays in preventing the cyberattacks, and what part everyone else plays. Right now, I don’t know where this line is drawn. In the arena of cybersecurity, what should I worry about versus what is IT tasked with preventing?
Respondent, McAfee Online Ethnographic Study
The headline for the short article was barely noticeable, buried at the bottom of the page, along with a feature on the upcoming high school football game. Those who looked closer may have dismissed it outright as hysterical doomsday prophesy, “Is World Series Quake Coming?” Four days later, the magnitude 6.9 Loma Prieta earthquake struck, killing 63 people in its wake, causing billions of dollars in damage and disrupting Game 3 of the World Series at Candlestick Park.1
Earthquakes are terrifying specters of nature. Every day, several hundred occur worldwide, though most of us don’t even notice them. They’re relatively small in nature—magnitude 2 or less. Major earthquakes, greater than a magnitude 7, happen more than once a month. Great earthquakes of at least a magnitude 8 hit about once a year. Unlike their smaller siblings, we notice these major and great quakes. Even if we’re lucky enough to be spared Mother Nature’s wrath, the media ensures we recognize her devastation by filling our screens with the images of fallen buildings and victims in her path of destruction.
What makes earthquakes terrifying is their certainty. There’s no getting around an earthquake happening. Earth is active. Its plates are shifting. There’s no escaping this phenomenon.
And yet, for all their certainty, earthquakes are completely unpredictable. There’s no way to forecast an earthquake. That single point of distinction separates earthquakes from other natural disasters, like hurricanes, tornadoes, and floods, where scientific models can help people avoid a deadly strike.
Not so with earthquakes. They hit without warning. The United States Geological Survey (USGS) makes the point unequivocally clear on its website: “Neither the USGS nor any other scientists have ever predicted a major earthquake. We do not know how, and we do not expect to know how any time in the foreseeable future.”2
So when Jim Berkland, a county geologist, provided that unbelievably accurate (or extremely lucky) prediction of the mag-6.9 quake that rocked Loma Prieta back in 1989, those who missed the obscure headline days before were certainly taking notice of it after the dust settled.
Berkland used scientific indicators, like the presence of high tides and position of the moon to inform his predictions, of which Loma Prieta was one of 300 he had made in the past 15 years. In addition, one more data point Berkland included in his black box to calculate the probability of the quake was the number of missing animals as reported in local pet classifieds leading up to the event. His theory in including this unconventional metric? Pets run away when sensing an impending earthquake.3
This hypothesis isn’t new. For centuries, prognosticators have suggested that animals have a veritable sixth sense, capable of feeling vibrations or detecting electrical changes in the air or gas imperceptible to humans.
Science hasn’t been able to prove any such sixth sense exists—so far. Studies abound looking for the linkage between strange animal observations and a subsequent quake. Indeed, there are scores of anecdotal data points recording animals retreating, acting frantically, or otherwise exhibiting unusual behavior, though the body of “proof ” lacks the rigidity of controlled scientific experimentation to clearly link cause and effect.
But within this research, there does appear to be evidence that animals can, in fact, sense earthquakes before they occur. That’s not to say they can predict a quake, but they do seem to detect foreshocks, mild tremors that precede violent shaking, that are indiscernible by humans.
While the jury may still be out on whether unusual animal behavior can help humans forecast an earthquake, there is at least some evidence to show that animals are more in tune with subtle abnormalities in their environment—even if only by being on heightened alert just before disaster strikes—than humans are. Those few moments, however fleeting, can mean the difference between an animal’s life or death.
I believe the same is true for organizations that summon the power of the crowd—the proverbial herd instinct—to acquire and develop a sixth sense for cyber threats that is generally lacking in their counterparts. It happens when every employee hones her capabilities for practicing sound cybersecurity defense. More importantly, it occurs when the role of cybersecurity becomes so inextricably intertwined in the day-to-day job of every employee that the collective sixth sense of the organization amplifies the detection of threats before irreparable damage can ensue.
Let’s put a culture of security in place across your entire organization.
There’s something every employee can do and every functional leader can adopt to embed cybersecurity in the daily fabric of the workplace, to bring the might of the 12th Man to the cybersecurity field and the sixth sense of the collective herd to the first-order fight of the digital sphere.
To that end, this chapter sums up key questions and actions for every employee, manager, executive, and board member.
You’ve now been enlisted.