1 Raindrop

2010 Goal #1: No more "general risk"

Goal 1. Exorcise the word "risk" from the infosec profession, unless its qualified with an adjective, for example Marty Whitman in "Distress Investing":

'Risk is not a meaningful concept unless modified by an adjective. There exist market risk, investment risk, Chapter 11 reorganization risk, credit risk, failure to match maturities risk, hurricane risk, terrorism risk, and so forth; but it not really useful to look at general risk. When risk is discussed in conventional academic finance, the subject is almost always market risk (i.e. fluctuations in market prices). Beta, alpha, and the capital asset pricing model (CAPM) are based on market prices. We ignore market risk and focus on investment risk, especially in distress investing (i.e. the probabilities of something going wrong with the company and/or the securities issued by the company).

For us there is no risk-reward ratio. A risk-reward ratio exists where price is in equilibrium. In that instance, risk and reward for securities are measured by two variables:

1. Quality of the issuer.
2. Terms of the issue.

The higher the quality and the more senior the terms, the less the risk and the smaller the potential for gain. Introducing price turns the risk-reward ratio on its head. The lower the price, the less the risk of loss and the greater the prospect for gain.'

As often as the word "risk" is used in the infosec profession, there is almost no consistency in how its used, so whenever you hear someone say we should or should not do something because its risky ask them what type of risk? Project risk, financial risk, availability risk, throughput risk, reputation risk, and so on. A little more clarity will go a long way to producing a higher resolution exchange.

Wine Made Simple

One of the best things about living in the Twin Cities is that Dara Moskowitz Grumdahl will find all kinds of great restaurants and places for you to go (I mean Bruce Schneier can't find them all by himself). The bad news for the rest of the world is that, unlike Schneier, her advice was pretty localized. Until now, that is. Just in time for the holidays, Dara has a new book out Drink This: Wine Made Simple. There's also a killer quote from the reviews of her book

"Dara Grumdahl is right about absolutely everything. If she calls me up at four in the morning, says 'Get dressed, get some money—and a gun—you'll need it where we're eating,' I don't ask any questions. I just go."
—Anthony Bourdain

Its always a treat when a great subject and great writer meet.

FT Books of the Year

Just in time for the holidays, last week the FT released its books of the year for 2009. I have read two of them and strongly vouch in both cases. 

The first is P.W. Singer's Wired for War, which is about the ongoing robotic revolution, specifically military robotics. Its a book that you want to blaze through, because once Singer establishes the basic concepts of robotics and where they are going (hint: vacuuming your house is the beginning not the end game), a number of these themes are described in his TED Talk; he goes on to connect various dots of the implications of exactly how these capabilities are likely to be used. 

For those of us in infosec, we see problems in various information systems that mainly have indirect impacts on the physical world (credit card fraud and so on), but because they occur in the meta layer they can often (not always) be addressed after the fact. But in robotics, we have the same software issues *plus* we are now running actual physical actions, meaning software problems can cascade directly into the physical space. Have I got your attention? I thought so. Its not discussed in the book, but I have heard anecdotally about some software assurance work at Intuitive Surgical Robotics. ISRG does around 2/3 of the prostatectomies in the US, its basically a medical robot that assists the surgeon in doing much more precise incision and stitching, meaning the healing time for the patient is markedly reduced. You can imagine that you won't want a software bug to cause the stitching in these areas to go awry, the assurance program at ISRG is studied in university programs as a model program.

The second book from the FT list is Lords of Finance by Liaqut Ahamed, the FT selected this as the Book of the Year. Its a history of the central bankers in Britain, France, Germany in the US during the early part of the 20th century leading up. The parallels of the current financial crisis and how the decisions made during that time re-map the global power structures are fascinating. 

The Third Wave in Security

Fram iang, found this post concerning the PCI Blame Game which along with saying that no system that blames the victim can long survive (the inside out version of Dan Geer's statement that when the ones charged with protecting an asset are not the ones who suffer when the asset is compromised you can you expect mediocre protection), also contains this quote:

"Internet banking as we know it, the kind that happens when a user launches a browser, and goes through even a decent approximation of layered security on a bank's Website, is dead, made untenable by the massive fraud now draining hundreds of millions from corporate accounts."
-- Rebecca Sausner, Editor-in-Chief, Bank Technology News

The post is by Phill Mellinger who was formerly CISO at First Data, he looks at the trends from lower value attacks to the current style of much larger unauthorized ACH transfers. Next he describes five things that need to happen to reverse these trends.

(Also, Brian Krebs has some more recent  stories on exactly this)