Causation vs. correlation

#DiaryOfCriticalThinking #2 - Causation vs. Correlation

We are a little late to the party, however it is still worth mentioning: The #Louvre heist. Do not fear, this is not the trillionth iteration on the heist itself or the wildely creative password #Louvre123 for the CCTV surveillance. This time, we look into the #whataboutism of security, or in more formal: The difference between #causation and #correlation (no pure statistics happening here, sorry).

Countless times, people were bashing the Louvre for their weak security posture and how a proper security concept would have prevented the heist. And yes, a concept could have prevented it, but no, definitely not the CCTV password. Why bash the Louvre for the uncreative choice of passphrase if it did not impact the heist? I mean sure, we should raise the awareness for proper password policies, but should not mistake it for actually assessing risks. The burglars accessed the Louvre through a window via a lifting truck, smashed the cabinets and exited through their entrance window...All caught on the CCTV cameras.

The point is that we need to understand the impacts that our security measures actually have on a certain risk. A weak CCTV password may correlate with an improper security architecture, yet does not cause the "vulnerability" of a smashable window. We really need to ask the right questions: Does measure X reduce the likelihood of scenario Y? Does measure X1 influence measure X2 or are they even redundant? Is measure M reducing impact on asset A in scenario S?
The basic understanding of assets, impacts, likelihoods, and risks (we can go into those details if you want) helps us to derive proper causation chains and to understand if we are actually improving our security system.

TL;DR: Security should not be about fingerpointing, flabbergasting, and flashiness (finally using my grammar knowledge on #alliterations here) but clear, logical threat scenarios and impact analyses.

And if in doubt: Kindly check our everlasting friend Mr. GenAI for a proper description on causation vs. correlation.

Over and out. #keepthinking