Tastes Great vs Less Filling: Deconstructing Risk Management (A Practical Approach Towards Decision Making)

Tastes Great vs Less Filling:
Deconstructing Risk
Management
(A Practical Approach Towards Decision Making)

Michael Dahn
ChaordicMind.com

Thursday, April 29, 2010

Who am I?


Which side are you on?
• « Risk Management is Dead …
Long Live Risk Management »

Tastes Less
Great! Filling!

Pete Lindstrom

« We have already solved the problem of
Risk Management over 200 times, the
problem is that we don’t know which
one is right. »


Question Group 1
Question Answe
r
What year was George ?
Washington born?
How many countries are in ?
South America?
How many calories in a In- ?
n-Out Double-Double
burger?  was Diet Coke
What year ?
invented?
How many elements are in ?
the periodic table?

Variance?

• Upper bound
• Lower bound
• Range (Upper – Lower)
• Standard deviation


Question Group 1
Question Answe
r
What year was George 1732
Washington born?
How many countries are in 13
South America?
How many calories in a In- 670
n-Out Double-Double
burger?  was Diet Coke
What year 1982
invented?
How many elements are in 102
the periodic table?

Question Group 2
Question Answe
r
How many languages are ?
available on Flickr.com?
How many breach incidents ?
were reported by
DatalossDB in 01/10?
When did Arnold Palmer ﬁrst ?
win the PGA Masters
Tournament?
How many minutes do ?
Facebook users spend on
the site / month?
How many contributors to ?
the Encyclopedia Britannica
in 2008?

Question Group 2
Question Answe
r
How many languages are 8
available on Flickr.com?
How many breach incidents 35
were reported by
DatalossDB in 01/10?
When did Arnold Palmer ﬁrst 1958
win the PGA Masters
Tournament?
How many minutes do 500b
Facebook users spend on
the site / month?
How many contributors to 4,411
the Encyclopedia Britannica
in 2008?

Question Group 3
Question Answe
What percentage of all r
?
malicious code will be
executed in 2012? there in
How many bugs are ?
Windows Vista?
What is the chance a ?
Wikipedia article will contain
an error? will it take for an
How long ?
average computer to be
p0wned in 2015?
What is the air speed ?
velocity…

Unknown-Unknowns

• Known Knowns (KK)
– People in this room now
• Unknown Knowns (UK)
– Population of the earth
• Known Unknowns (KU)
– The day I will die
• Unknown Unknowns (UU)
– Which risk management is
right for you…

To Know
“kennen” vs “wissen”

« kennen »

:: to know a fact
– KK, UK, KU, UU

« wissen »
:: to know a
concept
– KK, UK, KU, UU


Concepts vs Domains

« Concepts »
– an abstract or generic idea
generalized from particular
instances

« Domain »
– a sphere of knowledge,
inﬂuence, or activity

Domains contain
Concepts


Adam Shostack

« What the industry needs it more data
in order to form proper conclusions »


I got your “more data”!


Donn Parker

Frequent-ism

Due to the unknown-unknown number of data
breaches, any data set we collect may be too small
to statistically analyze data.
« Risk-based security is impossible »
« Dilligance-based security is what we need »


Parker-nomics
• Risk based approaches are
nothing more than data
alchemy
• There is simply not enough
public data available to make
any sort of statistically
signiﬁcant conclusion when
you assume that the entire
population of data breaches or
security failures (realistically
unknown) is vastly larger


Example
Rogue Device Detection
(Sampling?)


Diligence-based Model
• Diligence to avoid negligence
• Compliance to meet or exceed
requirements of regulations, laws, and
standards to avoid penalties
• Enablement to meet business and
budget needs

« generally agreed upon best practices »

https://www.issa.org/Library/Journals/2008/January/Parker-A%20Diligence-Based%20Idealized%20Security%20Review.pdf


Alex Hutton

Bayesian-ism
Probability is a probable term…
« Governance without metrics and
models, is superstitian »
« Governance with metrics and models ,
describes capability to manage risk »

Hutton-nomics
• Risk management: Time to
blow it up and start over?
• Evidence-based risk
management
– Deconstructed, notional view
of risk
• Metrics based management,
governance, and risk
– Failure if lack of data


Managing Risk

« Managing risk means
aligning the capabilities of
the organization, and the
exposure of the
organization with the
tolerance of the data
owners »

- Jack Jones


Managing Risk

« Risk management may be
hard (or even impossible)…
… but we all manage risk »

- Me


Spheres of Expertise

You don’t know everything
« We > You »
Practitioners don’t know everything
« Experts > Practitioners »
Next up…

« Reputational weighted value »

Success = more detailed info, per
domain

Domains of Knowledge
Expertise


Sounds simple? Nope
« Education, education,
education »

« Flexibility of Domains »

« More data (per domain) for
risk modeling »


Conclusion

« Seek ﬁrst to understand and then to
be understood »
« Holistic information security »
« Intra-connectedness of domains drive
value of (risk) data »


Tastes Great vs Less Filling: Deconstructing Risk Management (A Practical Approach Towards Decision Making)

Recomendados

Recomendados

Más contenido relacionado

Similar a Tastes Great vs Less Filling: Deconstructing Risk Management (A Practical Approach Towards Decision Making)

Similar a Tastes Great vs Less Filling: Deconstructing Risk Management (A Practical Approach Towards Decision Making) (12)

Más de Security B-Sides

Más de Security B-Sides (20)

Tastes Great vs Less Filling: Deconstructing Risk Management (A Practical Approach Towards Decision Making)