Over/Under

Click Through for The Register Story

Starting Friday, Salesforce.Com had a fifteen-hour outage due to their having to "pull the plug" after a script went rogue and gave all comers full access to the database. Anyone logged in could do anything to anyone's data.

Not cool. Restricting access was the right thing to do.

The interesting question in my mind is how people will evaluate this incident as it relates to their future judgment on the safety of SaaS platforms like Salesforce. I think people will overestimate the dangers for much the same reasons that many more people are afraid to fly than to drive.

When making estimates of danger, humans take the impact of an event much more seriously than the probability, especially if the probabilities are relatively small. Worse impacts cause us to overestimate probability, even where there is no correlation between the two. This leads to overly pessimistic projections on high-profile risks (Chinese hackers steal all our designs!). It also creates corresponding under-reactions to more present risks (Users can't be bothered to use 2FA, easily get phished).

Success in information security, as well as business and life in general, depends on being able to view these numbers objectively. They're just numbers, after all.