The Rest of the Cybersecurity Story

News stories about cyberattacks — SolarWinds, Colonial Pipeline, Capital One, Equifax, and many others — have become all too common. The stories usually focus on what happened, with little about the “how” and almost nothing about the “why.” But when the “why” isn’t examined, the circumstances that made the cyberattack possible are rarely addressed. What’s the rest of the story?1 Consider a simple example: A bank is robbed; that’s the “what.” The “how” might be that the burglar alarm failed to go off. And that’s usually the end of the story: There was an unfortunate malfunction.