{"id":1031,"date":"2008-11-21T10:32:09","date_gmt":"2008-11-21T18:32:09","guid":{"rendered":"\/?p=1031"},"modified":"2008-11-21T10:36:55","modified_gmt":"2008-11-21T18:36:55","slug":"the-economics-of-vulnerabilities","status":"publish","type":"post","link":"https:\/\/www.identityblog.com\/?p=1031","title":{"rendered":"The economics of vulnerabilities…"},"content":{"rendered":"

Gunnar Peterson of 1 Raindrop<\/a> has blogged his Keynote <\/a>at the recent Quality of Protection conference<\/a>.\u00a0 It is a great read – and\u00a0a defense in depth<\/em> against\u00a0the binary “secure \/ not secure” polarity that characterizes the thinking of\u00a0those new to security matters.\u00a0<\/p>\n

His argument riffs on Dan Geer's\u00a0famous Risk Management is Where the Money Is<\/a>.\u00a0 He turns to Warren Buffet as someone who knows something about this kind of thing, writing:<\/p>\n

“Of course, saying that you are managing risk and actually managing risk are two different things. Warren Buffett started off his 2007 shareholder letter <\/a>talking about financial institutions’ ability to deal with the subprime mess in the housing market saying, “You don't know who is swimming naked until the tide goes out.” In our world, we don't know whose systems are running naked, with no controls, until they are attacked. Of course, by then it is too late.<\/p>\n

“So the security industry understands enough about risk management that the language of risk has permeated almost every product, presentation, and security project for the last ten years. However, a friend of mine who works at a bank recently attended a workshop on security metrics, and came away with the following observation – “All these people are talking about risk, but they don't have any assets.” You can't do risk management if you don't know your assets.<\/p>\n

“Risk management requires that you know your assets, that on some level you understand the vulnerabilities surrounding your assets, the threats against those, and efficacy of the countermeasures you would like to use to separate the threat from the asset. But it starts with assets. Unfortunately, in the digital world these turn out to be devilishly hard to identify and value.<\/p>\n

“Recent events have taught us again, that in the financial world, Warren Buffett has few peers as a risk manager. I would like to take the first two parts of this talk looking at his career as a way to understand risk management and what we can infer for our digital assets.<\/p>\n

Analysing vulnerabilities and the values of assets, he uncovers two pyramids that turn out to be inverted.\u00a0<\/p>\n

To deliver a real Margin of Safety to the business, I propose the following based on a defense in depth mindset. Break the IT budget into the following categories:<\/p>\n