I partially solved an Infosec mystery recently. The mystery is “why do most incidents always happen on a Friday? And especially the Friday before a long weekend?”
Well friends, after a lot of empirical data gathering I can announce that it’s because people who realized something was wrong had been sitting on the knowledge of something being wrong, but didn’t want to let it sit through a weekend, and especially not a long weekend.
So like that last push to production on the way out the door Friday afternoon, people are often submitting incident reports as they take off for the weekend with a clear conscience and a spring in their step.
