Matthew RosenquistFounder & CISO Advisor, Cybersecurity Insights · CISO, Cybersecurity Strategist, & Industry Advisor

Cybersecurity for Digital Media Industry - The Fallacy of Perfect Cybersecurity

29 May 2023 · 1 min

Watch on YouTube

1:28

In this presentation, the speaker challenges the common misconception that cybersecurity aims for an all‑or‑nothing, perfectly impervious state. He argues that achieving zero impact is technically infeasible and economically prohibitive. Instead, effective cybersecurity programs should seek an optimal balance among three dimensions: acceptable risk, cost, and user friction. To illustrate this, he draws a parallel with everyday car safety—seat belts, airbags, and road markings—where we knowingly accept some risk while employing protective measures. The core message is that striving for absolute security is a fallacy; realistic, reasonable trade‑offs are the true goal of cybersecurity.

Chapters

There are dangerous misconceptions about the goals of cybersecurity. It's not binary, like turning on a switch to be impervious, but rather a range. To eliminate all impacts would be near impossible technically. And even if you could do it, it would be outlandishly expensive. The real goal of cybersecurity programs is to find an optimal level of security that balances trade-offs between what's acceptable risks, what are the costs, and the friction to end users or customers. We take risks every day when we get in our car. We have safety and security measures like seat belts and airbags and lines on the road, um, but we accept the risk even though there is a chance of harm. Cybersecurity is the same. It's about finding that right balance between those aspects of risk and cost and friction, just as we do when we get in the car. Cybersecurity is not about making an organization impervious. It's a fallacy. We have to be reasonable, and that's part of the challenge.