What's Happening?
Richard Bird, a cybersecurity executive, has developed a new website called The Hacker in a Hoodie (HIH) Index to track disclosed material breaches. This initiative aims to provide a resource for cybersecurity professionals, journalists, policymakers,
and the public. Bird, who is the Chief Strategy and Chief Security Officer at Singulr AI, created the index independently of his role at the company. The HIH Index features two ledgers: one based on SEC EDGAR filings, which public companies must submit following a material cyber incident, and another based on news articles and company statements. The index grades entries by their source reliability, categorizing them as 'verified,' 'attested,' or 'inferred.' The project does not sum the losses due to the varied reliability of the data sources, aiming instead to provide a reliable reference for checking claims.
Why It's Important?
The HIH Index addresses a significant gap in the cybersecurity industry, where financial impacts of breaches are often underreported or inaccurately estimated. By providing a graded and citable reference, the index offers a more reliable way to assess the financial implications of cyber incidents. This initiative could influence how companies and policymakers approach cybersecurity, potentially shifting the perception of cybersecurity from a mere cost of business to a measurable performance outcome. The index's approach challenges the industry's reliance on speculative estimates, promoting a more data-driven understanding of cyber risks and their financial impacts.
What's Next?
As the HIH Index gains traction, it may encourage more companies to disclose accurate financial impacts of cyber incidents, leading to better industry standards for reporting. Policymakers might also use the index to inform regulations and policies aimed at improving cybersecurity practices. The project's growth could parallel that of other successful cybersecurity initiatives, like the Have I Been Pwned service, by filling a critical information gap. The index's development could also inspire similar projects, further enhancing transparency and accountability in cybersecurity reporting.
Beyond the Headlines
The HIH Index highlights a broader issue in the cybersecurity industry: the need for more accurate and transparent reporting of cyber incidents. By treating cybersecurity as a measurable business function rather than an overhead cost, companies might be incentivized to invest more in effective cybersecurity measures. This shift could lead to a cultural change within organizations, where cybersecurity is integrated into overall business strategies. The index also underscores the importance of reliable data in shaping public and industry perceptions of cybersecurity threats and their economic impacts.
