October is Cybersecurity Awareness Month -- or is it?

Last year, the president declared October to be "Cybersecurity Awareness Month". But, October has already been Breast Cancer Awareness Month for the pat 25 years.

So which is it? Cybersecurity or Breast Cancer?

The easy answer would be "both", but that's silly. Why not, then, make it "everything awareness month"? Indeed, why don't we make every month Everything Awareness Month.

Choosing both would teach a bad lesson. Everything we do to make cyberspace more secure comes with tradeoffs making cyberspace less useful. If we measured cybersecurity only by what is most secure, then we'd turn of the computer, cut the wires, and bury it. That'll keep the hackers out.

Thus, cybersecurity is about choosing between tradeoffs. It recognizes that we can't endless ask for our budget to increase, but must work within the budget we are given. If that means forgoing anti-virus because we spent this year's money on a firewall, then so be it.

That means with an "awareness month", we only have a fixed "awareness" budget. Every dollar spent promoting Cybersecurity awareness means one dollar taken away from Breast Cancer awareness.

It's not just dollars, but attention span budget. Let's say you disregard my advice and increase your budget to promote both. People still have only a limited attention span, and thus, will pay half the attention to both campaigns.

1 in 8 women will get breast cancer in their lifetimes. I'm not aware of anybody dying to a cybersecurity fail. That makes me think breast cancer is a bit more important than cybersecurity.