MIT Sloan Management Review Article on The Rest of the Cybersecurity Story

News stories about cyberattacks — SolarWinds, Colonial Pipeline, Capital One, Equifax, and many others — have become all too common. The stories usually focus on what happened, with little about the “how” and almost nothing about the “why.” But when the “why” isn’t examined, the circumstances that made the cyberattack possible are rarely addressed. What’s the rest of the story?1

Consider a simple example: A bank is robbed; that’s the “what.” The “how” might be that the burglar alarm failed to go off. And that’s usually the end of the story: There was an unfortunate malfunction.

About the Author

Stuart Madnick is the John Norris Maguire Professor of Information Technologies, Emeritus, at the MIT Sloan School of Management and the founding director of the Cybersecurity at MIT Sloan research consortium.