Dear Cybersecurity, We Need to Talk: My Apology to the 3Rs
Dear Reduce, Replace, and Recover,
I owe you an apology. Actually, several.
For years, you tried to tell me that cybersecurity was about more than clicking “Remind Me Later” until my computer stopped asking nicely.
I thought I had things under control.
What more could cybersecurity possibly want from me?
Apparently… a lot.
As we think about Securing the Next 250, I’ve realized that protecting our digital future requires more than hoping cyber threats politely leave us alone.
Dear Reduce, I'm Sorry I Kept Putting Things Off
Reduce, you warned me about vulnerabilities.
You told me that outdated or vulnerable technology could give attackers opportunities to get into systems.
You encouraged me to think about risk and prioritize security updates accordingly.
And what did I do?
“Remind me tomorrow.”
“Remind me next week.”
“Remind me later.”
At this point, “Later” and I are practically coworkers.
CISA emphasizes reducing exposure to vulnerabilities by prioritizing security updates based on risk. That means focusing attention on vulnerabilities that present the greatest danger rather than treating every update the same.
Not every vulnerability carries the same risk, but ignoring vulnerabilities isn't a strategy.
Because every vulnerability we reduce today is one less opportunity an attacker may have tomorrow.
My promise to Reduce:
I will stop treating security updates like optional calendar invitations.
I will support efforts to identify vulnerabilities, understand their risk, and address the ones that could have the greatest impact.
Relationship status:
It's complicated…. but we're patching things up.
Dear Replace, I Know That Device Has “Been Here Forever”
Replace, this apology may be overdue.
Possibly… end-of-support overdue.
You told me some technology eventually reaches the end of its supported life.
I responded:
“But this twenty year old server... it still works!”
You said:
“The manufacturer doesn't support it anymore.”
I said:
“But look! The lights are still blinking.”
You tried explaining that blinking lights are not, in fact, a cybersecurity control.
Point taken.
CISA has highlighted the cybersecurity risks associated with end of support edge devices, technology that may continue operating even though the manufacturer no longer provides the security support necessary to address newly discovered vulnerabilities.
Instead of asking:
“Does it still work?”
We need to ask:
“Can it still be securely supported?”
Because “we've always used it” is a lovely sentiment for a family recipe. It's considerably less comforting when we're talking about technology connected to important systems.
My promise to Replace:
I will recognize that technology has a lifecycle.
I will support identifying technology by approaching or reaching end of support and replacing it before unsupported equipment creates unnecessary cybersecurity risk.
Because sometimes the safest upgrade isn't another patch.
It's retirement.
Relationship status:
It's not you, legacy device. It's your lack of security updates.
Dear Recover, I Thought We Would Just… Restart Everything
Recover, this one is embarrassing.
I assumed that if something bad happened, someone would fix it.
Probably IT.
My disaster recovery strategy was essentially:
Step 1: Panic.
Step 2: Restart computer.
Step 3: Panic more professionally.
Cybersecurity isn't only about preventing incidents. Organizations also need to be prepared to recover quickly and sustain critical operations when disruptions occur.
That means resilience matters.
Planning matters.
Backups matter.
And practicing recovery before an actual emergency matters.
My promise to Recover:
I will remember that cybersecurity includes preparing for what happens after something goes wrong.
I will support resilience, recovery planning, testing, and the ability to maintain essential operations during disruptions.
Because successful cybersecurity isn't always:
“Nothing happened.”
Sometimes success is:
"Something happened and we were ready.”
Relationship status: Committed to making this relationship resilient..
The 3Rs: A Cybersecurity Relationship Worth Keeping
Cybersecurity isn't one product.
It isn't one update.
It's a continuous practice:
REDUCE
Reduce vulnerabilities and prioritize security actions based on risk.
REPLACE
Replace technology that has reached end of support before unsupported systems create unnecessary exposure.
RECOVER
Prepare to recover quickly and sustain essential operations when disruptions occur.
Together, these three practices help us move from simply reacting to cyber threats to building lasting cyber resilience.
Us Securing the Next 250 Starts Now
As we look toward America's next 250 years, it's impossible to predict exactly what technology will look like.
Artificial intelligence will evolve.
Networks will change.
Devices will change.
Cyber threats will change.
But one thing won't change:
The decisions we make today help shape the security and resilience of tomorrow.
Securing the next 250 years doesn't require any one person to predict every future cyber threat.
It requires all of us to practice good cybersecurity today.
Reduce the vulnerabilities we can.
Replace technology when it can no longer be securely supported.
Prepare to recover when disruption occurs.
Three simple words.
Reduce. Replace. Recover.
So, dear cybersecurity…
I'm sorry I ignored you.
I promise I'll do better.
And Software Update?
If you're reading this…
I'll stop clicking “Remind Me Later.”
Probably.
Sincerely,
A Reformed “Remind Me Later” Employee
