You live in a small village on Shark Island. Your village has about 100 people, and the island, a remote paradise in the South Pacific, has a total of ten villages, all the same size. The island's name has always seemed a bit odd to you, because you've never seen a shark. In fact, nobody in your village has ever seen a shark, and even in the stories of your great-grandparents and great-great-grandparents, nobody ever saw a shark. There is one story, though, from another village, far on the other side of the island, and a hundred years ago, about a shark that ate a swimmer.
So here's the question. It's a hot, humid day, and a dip in the cool ocean water sure would be refreshing. Do you take a swim, or does that shark attack in a far away village in a far away time scare you off?
I've asked many people, and almost always they say, "That doesn't sound dangerous. I think I'll take a swim."
Here's how Shark Island plays out with modern mass media. Shark Island had a thousand people, and one person died in a hundred years. That's a death rate of one per hundred-thousand. Greater Los Angeles has a population of about 13 million, so the equivalent death rate there would be 130 people per year. Based on the media excitement that one shark attack generates, I'm sure that 130 deaths in one city would have people fleeing the beaches in droves, all across America.
The problem is, our brains are wired for an environment more like Shark Island than like Los Angeles – small groups of small villages – so media reports spanning millions of people baffle our risk intuition. The exact same death rate that seemed safe in our evolutionary environment causes mass hysteria in our modern environment. No wonder watching television news causes fear in children. What's worse, there are problems much riskier than sharks that don't make the headlines because they aren't "newsworthy". (Auto accidents kill 40,000 people per year. Sharks get better ratings.)
This started as a rant against mass media and bad risk assessment, but there is a lesson for IT:
Don't let mass media drive your risk reduction strategy!
Headlines are not a good indicator for the most important risks in your data center. After 9/11 and again after Katrina, many customers suddenly had a keen interest in remote data replication. After a series of headlines about how lost backup tapes exposed millions of credit card records and social security numbers, people had a sudden interest in encrypting backup tapes. And after headlines about lost medical records from stolen laptops, attention switched to protecting mobile devices.
A good risk management plan should take into account hurricanes, lost tapes, lost laptops, and maybe even terrorist attacks, but realistically, headlines typically don't highlight the most important risks. You are much more likely to lose data from human error or inadequately tested backup and recovery processes than from floods or attacks, but inadequate processes don't make good headlines. In addition, headlines fade quickly – if something becomes frequent it's often less newsworthy, but the risk remains. Our more sophisticated customers, like financial institutions, build risk management models that already include the items most likely to show up in the headlines, and if they use media reports at all, it's to update some aspect of their model, like the probability of a particular event, or the impact and cost.
In summary, don't worry about terrorists until restore from your nightly backup is well tested.
Comments