Not All Security Incidents Are Train Wrecks

Well, we hope not. On Saturday morning, the train I was travelling on from London to Newcastle was slightly delayed due to the imposition of speed limits caused by high winds. As we began to pull out from Darlington Station, there was a shudder and we stopped. It seems we had been shunted from behind by a smaller Northern Rail train.

I think there were some minor injuries to some passengers on the Northern Rail train, but as far as I could tell the larger National Express East Coast train only suffered from being withdrawn from service. I must say I felt surprise that minor train accidents still occur—we are aware of serious incidents "wrecks", such as the Paddington rail crash 10 years ago, but we don't hear much about defects and minor accidents. These must be occurring too and are not necessarily rare events.

So perhaps it's similar for web site security? Whilst the vast majority of web application security incidents won't lead to loss of life, we should expect to see smaller problems and minor incidents, not just the larger breaches and losses. If you only see the train wrecks, then I suspect there isn't enough monitoring and reporting. I don't have any further data regarding this, but will do some research.

Update 2nd June 2010: National Express East Coast hyperlink removed from above text. Their franchise is now operated by East Coast Main Line Company.