Everything, including Cyber Security, You Learned in Kindergarten

If our approach should be centered on the idea of ‘watch the data’ instead of ‘identify the threat,' then, as discussed in earlier articles, the military and intelligence approaches are not the best fit. In my search for a different model, I next thought about a shepherd looking after a flock. This analogy also didn’t work because the sheep, unlike data, all generally follow each other and are serving the same role or function. The system was not complex enough and the shepherd’s role too defined.

What other model is organically internal looking and in charge of items that are similar, but often act in different and unpredictable ways?

A kindergarten teacher…yes, kindergarten. Think about it. The teacher is not monitoring the bin of scissors, the windows, or the sharp corners of tables – they are focused on the children. They are focused on the thing they must protect, not the things that could threaten them. Because the children, much like your data, are what really matter.

My wife has been a kindergarten teacher for more than 20 years. Anyone that has ever observed a kindergarten class knows that kids do not all act the same way or do the same thing. One group is at choice time, another is reading, and a third is at Spanish, while another child is in the bathroom. A kindergarten teacher also does not have complete control of his or her classroom on day one of the school year. To maximize their effectiveness, teachers have to learn the unique aspects of each new class and the specific patterns and behaviors of each child.  

Plus, if you don’t think a threat to a kindergartner can come from anywhere, even the most unexpected places, you have never been a babysitter or parent. My son nearly choked on a small felt sticker, an incident that sent him to the hospital. I would never have been able to pre-identify that threat coming. It was my daughter watching him and noticing something wrong that sounded the warning and enabled us to respond quickly and adequately.

I am not saying threat intelligence is not important or that endpoint defense are unnecessary. However, instead of centering on the prediction of attack or building up walls, we should focus on understanding and watching our data. Accurately predicting every attack is a nearly impossible task, but enterprises should already know their data and the assets they need to protect.

My next two articles will cover what elements are key for an effective kindergarten driven watch the data model.