Quantifying CyberRisks- Solving the Riddle (per AT&T CyberSecurity Blog) March 11, 2021
Posted by Chris Mark in Uncategorized.Tags: AT&T, Bayes, Chris Mark, cybersecurity, data breach, hacker, risk
add a comment
I recently published a new article on the AT&T CyberSecurity blog titled Quantifying CyberRisks- Solving the Riddle. Below is an excerpt. Click ‘read more’ to read the entire piece.
In the late 1990’s and early 2000’s there was a concept that was bandied about that was coined “Return on Security Investment” or ROSI. Borrowing from the common business term Return on Investment (ROI) where a return on a particular investment (capital investment, personnel, training etc.) could be quantified, the cybersecurity industry attempted to quantify a return on security investment.
Fundamentally, the primary failing of this concept is that it is mathematically impossible (approaches mathematical impossibility) to quantify an event “not occurring”. In short, if a company has “zero” security events that impact them deleteriously in a given year, was the $5 million security expenditure appropriate? Should it have been less since there was no security event that caused a loss? If the company experienced an event, was the return on the investment then the difference between the expenditure and the overall losses from the incident? It simply did not work, as it was mathematically flawed.
Fast forward to 2021 and companies once again are fixated on quantifying cyber risk and, more importantly, cybersecurity exposure. The question is similar and is asked: “Can companies accurately quantify cybersecurity risks today?”
This is a complex question but to attempt an answer it is first important to have a working definition of several terms.
Risk- is an artificial construct which can be easily expressed as the function of the likelihood of an adverse event occurring (often provided as a statistical probability) and the impact, should the event be realized (in business, and for the purposes of this article, it will be expressed in monetary terms.). In short R=fPI. Click Here to Read More!
Chris Mark published in Computing Security Magazine May 21, 2020
Posted by Chris Mark in Uncategorized.Tags: computer security, coronavirus, covid19, cybersecurity, data breach, Exploits, PCI DSS, threats, vulnerabilities
add a comment
Computing Security magazine recently published an article I wrote on COVID19 and Threats, Vulnerabilities and Exploits.
“The suitability of security strategies is relative to the controls implemented to address risks; therefore, security should be viewed as a function of time and resources. Naturally, there can be no guarantee of security when threats are constantly adapting. Adaptive Threats are caused by something that can change its behaviour in reaction to prevention. As defences improve, threat actors adapt and so this cycle continues.
Adaptive Threats react to take advantages of vulnerabilities which are characteristics of design, location, security posture, operation and they render an asset, system, network, or entity susceptible to disruption, existing even if yet unidentified. An exploit is something that takes advantage of a bug or vulnerability and can be used to gain advantage of a susceptibility in a control. However, not all vulnerabilities are of equal risk or severity.
Furthermore, exploits and vulnerabilities are not mutually independent, and one can only exist without knowledge of the other…”.READ MORE!
New Article: Exploits, Vulnerabilities & Threat Adaptation March 17, 2020
Posted by Chris Mark in cybersecurity, InfoSec & Privacy.Tags: adaptation, AT&T, Chris Mark, cybersecurity, Exploits, privacy, threats, vulnerabilities
add a comment
AT&T CyberSecurity published my new blog post. You can read it here!
“Security, whether focused on physical, cyber, operational, or other domains, is an interesting topic that lends itself to considerable debate among practitioners. There are, however, basic concepts and underpinnings that pervade general security theory. One of the most important, yet often misunderstood concepts are those inextricably entwined concepts of vulnerabilities and exploits. These basic underpinnings are critical in all security domains.
What are exploits and vulnerabilities and why are they important to the study of security?
First, security cannot be considered a binary concept such as: “secure” or “not secure”. The appropriateness of any security strategy is relative to the controls implemented to address to identified risks. One cannot say: “my house is secure”. The measure of security is predicated upon the identified risks and the associated controls implemented to address those risks. One can say: “My house has been secured in a manner that is commensurate with the identified risks”. Second, security should be viewed as a function of time and resources. Finally, security, in any domain, can never be ‘assured’ nor can there be a ‘guarantee’ of security. The reason is simple. Technologies change and human threats are adaptive. According to the Department of Homeland Security’s Security Lexicon, Adaptive Threats are defined as:
“…threats intentionally caused by humans.” It further states that Adaptive Threats are: “…caused by people that can change their behavior or characteristics in reaction to prevention, protection, response, and recovery measures taken.” The concept of threat adaptation is directly linked to the defense cycle. In short, as defenses improve, threat actors change their tactics and techniques to adapt to the changing controls. As the threat actor improves their capabilities the defensive actors necessarily have to change their own protections. This cycle continues ad infinitum until there is a disruption.” Read the whole article!
I am back ;) “The Markerian Heptad and Understanding Attacker Motivations” February 24, 2020
Posted by Chris Mark in cybersecurity.Tags: AT&T, attacks, Chris Mark, cyber, cybersecurity, data breach, hacking, InfoSec, motivations, security
add a comment
It has been a bit of time since I have posted. I am back with a blog post I wrote for AT&T CyberSecurity Blog. Titled, “Understanding CyberAttacker Motivations” It discusses what I call the “Markerian Heptad” (Yes..I named it after myself 🙂 and describes the 7 basic motivations that underpin why an attacker would target a particular person, company, organization, etc.
“Implementing a risk based security program and appropriate controls against adaptive cyber threat actors can be a complex task for many organizations. With an understanding of the basic motivations that drive cyber-attacks organizations can better identify where their own assets may be at risk and thereby more efficiently and effectively address identified risks. This article will discuss the Rational Actor Model (RAM) as well as the seven primary intrinsic and extrinsic motivations for cyber attackers.
Deterrence and security theory fundamentally rely upon the premise that people are rational actors. The RAM is based on the rational choice theory, which posits that humans are rational and will take actions that are in their own best interests. Each decision a person makes is based upon an internal value calculus that weighs the cost versus the benefits of an action. By altering the cost-to-benefit ratios of the decisions, decisions, and therefore behavior can be changed accordingly.
It should be noted at this point that ‘rationality’ relies upon a personal calculus of costs and benefits. When speaking about the rational actor model or deterrence, it is critical to understand that ‘rational’ behavior is that which advances the individual’s interests and, as such, behavior may vary among people, groups and situations.”..READ MORE HERE!
HR 4036, the “Hack Back Bill”; Understanding Active & Passive Deterrence and the Escalation of Force Continuum. October 22, 2017
Posted by Chris Mark in cybersecurity, Uncategorized.Tags: cybersecurity, deterrence, escalation of force, force continuum, game theory, Hack Back, HR4034, john lott, john nash, rational actor, van neuman
2 comments
I wrote this original post several years ago but it seems to be more relevant now. As CNN reports HR4036…”…formerly called the Active Cyber Defense Certainty (ACDC) Act and informally called the hack-back bill – was introduced as an amendment to the Computer Fraud and Abuse Act (CFAA) last week. Its backers are US Representatives Tom Graves, a Georgia Republican, and Kyrsten Sinema, an Arizona Democrat.”
This is a bill that is sound in theory and terrible in practice. According to the Bill, (named ACDC) it would enable a company to take “..active defensive measures..” to access an attacker’s computer. This is only applicable in the US…Think about this for a minute. What is the evidence that I was the attacker of company A? Maybe (quite possibly…almost certainly) a hackers is using my system as a proxy. So some company can now attack my personal computer? What happened to “due process”?. If company X simply believes I am a hacker, they can access my personal data without a court order or any due process. More profoundly, the issues it raises pose very real and very direct risks to employees of the company who ‘hacks back’. This, I think, is unacceptable.
Having performed physical security in very real and very dangerous environments, I can personally attest to the fact that physical threats are real and difficult to prevent. By allowing a ‘hack back’ the company faces a very real risk of escalating the situation from the cyber domain into the physical domain. There is NO corporate data that is worth risking a human life.
Too often cybersecurity professionals forget that they are SECURITY professionals first and the same rules of deterrence, escalation of force and other aspects apply. Given this new Bill, I felt this was a good time to again discuss deterrence (active and passive) and once again talk about the Escalation of Force Cycle. So, what is deterrence? (warning…long post)..pic of the author off the cost of Somalia doing anti-piracy operations)
The History of Deterrence Theory:
The concept of deterrence is relatively easy to understand and likely extends to the earliest human activities in which one early human dissuaded another from stealing food by employing the threat of violence against the interloper. Written examples of deterrence can be attributed as far back as the Peloponnesian War, when Thucydides wrote that there were many conflicts in which one army maneuvered in a manner that convinced the opponent that beginning or escalating a war would not be worth the risk.[1] In the 4th Century BC, Sun Tzu wrote: “When opponents are unwilling to fight with you, it is because they think it is contrary to their interests, or because you have misled them in to thinking so.”[2] While most people seem to instinctively understand the concept at the individual level, contemporary deterrence theory was brought to the forefront of political and military affairs during the Second World War with the deployment of nuclear weapons against Nagasaki and Hiroshima.[3]
The application of deterrence during WWII was the beginning of understanding that an internal value calculus drives human behavior and that behavior could be formally modeled and predicted with some degree of accuracy. (more…)
Global Security, Privacy, & Risk Management 