Mortman/Hutton Security B-Sides Presentation

Challenging the Epistemological Anarchist to Escape our Dark Age The Shep Pettibone 12” Remix David Mortman Alex Hutton

Agreed: Data is good

Agreed?

• “Risk management inputs are estimates and the results are therefore questionable • Risk management attempts to predict the future; that is hard • Risk management is based on backward-looking statistics, which does not make sense in an environment where you’re up against a creative attacker These are the reasons I reject Risk Management.” - a well known Security RockStar

• Risk management inputs are estimates and the results are therefore questionable • All measurements are estimates. We’re just quibbling about the amount of uncertainty.

• Risk management inputs are estimates and the results are therefore questionable • All measurements are estimates. We’re just quibbling about the amount of uncertainty. • Risk management attempts to predict the future; that is hard • This simplifies information theory. Risk Management only describes certainty (Bayesian - “belief”) about a current state of nature in order to make decisions. • Are climate studies “science”? If so, then how is this different than the global warming “debate”?

• Risk management inputs are estimates and the results are therefore questionable • All measurements are estimates. We’re just quibbling about the amount of uncertainty. • Risk management attempts to predict the future; that is hard • This simplifies information theory. Risk Management only describes certainty (Bayesian - “belief”) about a current state of nature in order to make decisions. • Are climate studies “science”? If so, then how is this different than the global warming “debate”? • Risk management is based on backward-looking statistics, which does not make sense in an environment where you’re up against a creative attacker • This is just silly. It’s saying the past is non-informative

“These are the reasons I reject Risk Management.”

“These are the reasons I reject Risk Management.” Rejection in favor of what, exactly?

Epistemological Anarchy Rain Dances and Astrology are just as valid as Biology and Physics

Epistemological Anarchy The rejection of an ability to derive a State of Knowledge

Meet The Rev. Thomas Bayes and E.T. Jaynes

Bayesian Rationalism There is no certainty, but degrees of certainty that create a state of probable knowledge

The search for Truth aside, can we acquire a “body of knowledge”?

Kuhn’s Protoscience A stage in the development of a science that is described by: • somewhat random fact gathering (mainly of readily accessible data) • a “morass” of interesting, trivial, irrelevant observations • A variety of theories (that are spawned from what he calls philosophical speculation) that provide little guidance to data gathering

What is required To develop a “body of knowledge”, a social science for security & risk management?

Loss Landscape Threat Landscape risk security / state of vulnerability Asset Landscape Controls Landscape

capability to manage Loss Landscape Threat Landscape risk management security / state of vulnerability Asset Landscape Controls Landscape

To develop a “body of knowledge”, a social science for security & risk management? Loss Landscape Economics, Behavioral Economics, Security, Management Science, Probability Theory Threat Landscape Behavioral Economics, Probability Theory risk Asset Landscape Management Science, Probability Theory Controls Landscape Management Science, Probability Theory, Control Theory

To develop a “body of knowledge”, a social science for security & risk management? Capability to Manage Decision Theory, Management Science, Probability Theory Loss Landscape Economics, Behavioral Economics, Security, Management Science, Probability Theory Threat Landscape Behavioral Economics, Probability Theory risk Asset Landscape Management Science, Probability Theory Controls Landscape Management Science, Probability Theory, Control Theory

What is required To develop a “body of knowledge”, a social science for security & risk management? - Information & Theories (Models) About the Risk Landscape - Data. At first applicable within context provided by those theories, but data tends to stand by itself for future theories

Models (Theories) Don’t have to be perfect, just ego-less

The Mortman/Hutton Model for Exploit Development/Use

A Vulnerability List Isn’t Enough

The Sexiest Vuln Isn’t The One You Should Be Worrying About.

Patch availability prior to breach < 1 month 0% 1-3 months 4% 3-6 months 6% 6-12 months 16% >1 year 74%

What About CVSS?

The Mortman/Hutton Model for Expectation of Exploit Use

example: Microsoft Security Advisory (972890)

The Mortman/Hutton Model Taxonomy

Expectation of Development/ Use Saturation of Exploit Vulnerable Utility Technology Expected Code Value of Dissemination Ability To Systems Market Compensate Penetration (inverse) Ease of Use Nature of Access Resources Information Discovering Expectation Individual Ability To Ability To Apply Expected Repair Controls Value of Expected Systems Volume Market (fractal) Return Computing Bandwidth Power = Actor performs Risk Assessment

Saturation of Vulnerable Technology Expectation of Development/ Use Saturation of Exploit Vulnerable Utility Technology Ability To Market Compensate Penetration (inverse) Ability To Ability To Repair Apply Controls = Actor performs Risk Assessment

Exploit Utility Expectation of Development/ Use Saturation of Exploit Vulnerable Utility Technology Expected Code Value of Dissemination Systems Ease of Use Nature of Access Resources Information Discovering Expectation Individual Expected Value of Expected Systems Volume Market (fractal) Return Computing Bandwidth Power = Actor performs Risk Assessment

Expectation of Development/ Use Saturation of Exploit Vulnerable Utility Technology Expected Code Value of Dissemination Ability To Systems Market Compensate Penetration (inverse) Ease of Use Nature of Access Resources Information Discovering Expectation Individual Ability To Ability To Apply Expected Repair Controls Value of Expected Systems Volume Market (fractal) Return Computing Bandwidth Power = Actor performs Risk Assessment

Model lives & will be maintained & information can be shared at: The New School of Information Security Website http://www.newschoolsecurity.com

Question & Answer

http://newschoolsecurity.com	117
http://www.slideshare.net	1
http://translate.googleusercontent.com	1

Mortman/Hutton Security B-Sides Presentation

by Alex Hutton on Aug 17, 2009

Accessibility

Categories

Tags

Upload Details

Usage Rights

3 Embeds 119

Statistics

Mortman/Hutton Security B-Sides Presentation — Presentation Transcript