44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford
-
Upload
44con -
Category
Technology
-
view
129 -
download
2
description
Transcript of 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford
![Page 1: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/1.jpg)
FLUSHING AWAY PRECONCEPTIONS OF RISK
Thom Langford!@thomlangford
September 2014
![Page 2: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/2.jpg)
DISCLAIMERThe opinions expressed in this presentation are my own and do not necessarily represent
those of my employer
@thomlangford
![Page 3: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/3.jpg)
• our interpretation of risk!
• our measurement of risk!
• our effective treatment of risk
@thomlangford
![Page 4: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/4.jpg)
THE INTERPRETATION OF RISK
riskier?
@thomlangford
![Page 5: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/5.jpg)
@thomlangford
![Page 6: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/6.jpg)
@thomlangford
![Page 7: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/7.jpg)
@thomlangford
![Page 8: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/8.jpg)
@thomlangford
![Page 9: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/9.jpg)
49 sq/in
@thomlangford
![Page 10: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/10.jpg)
1,676 sq/in@thomlangford
![Page 11: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/11.jpg)
3,295 sq/in
@thomlangford
![Page 12: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/12.jpg)
20,961 sq/in
@thomlangford
![Page 13: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/13.jpg)
25,127 sq/in
@thomlangford
![Page 14: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/14.jpg)
@thomlangford
![Page 15: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/15.jpg)
@thomlangford
![Page 16: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/16.jpg)
“perceived” risk
@thomlangford
![Page 17: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/17.jpg)
“hygiene” risk
@thomlangford
![Page 18: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/18.jpg)
“actual” risk
@thomlangford
![Page 19: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/19.jpg)
THE MEASUREMENT OF RISK
@thomlangford
![Page 20: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/20.jpg)
Malik, Javvad (2014-05-12). The CISSP companion
handbook: A collection of tales, experiences
and straight up fabrications fitted into the 10 CISSP domains of information security
(Kindle Locations 918-923). . Kindle
Edition.
The Malik Risk Model!Ver 1.0
Impact
Won’t HurtIs that the best you
got?Ouch! Holy Crap!
Likelihood
Ain’t Happening
“a swift half ”
“it’s your round”
“easy Tiger…”
“hold my drink Steve”
Possibly “it’s your round”
“easy Tiger…”
“hold my drink Steve”
“Get off him Dave, he ain’t
worth it”
It’s On “easy Tiger…”
“hold my drink Steve”
“Get off him Dave, he ain’t
worth it”
“cab to A&E
please”
Holy Crap! “hold my drink Steve”
“Get off him Dave, he ain’t
worth it”
“cab to A&E
please”
“Ambulance please”
@thomlangford
![Page 21: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/21.jpg)
The Langford/Malik Risk Model ver
1.0
Likelihood of threat Ain’t Happening It’s On! Holy Crap!
Ease of Exploitation
I’m a Ninja
I’m a drunk Ninja
I’m drunk
I’m a Ninja
I’m a drunk Ninja
I’m drunk
I’m a Ninja
I’m a drunk Ninja
I’m drunk
Asset Value
Arm “It’s your round”
“have a word, mate”
“easy Tiger…”
“have a word, mate”
“easy Tiger…”
“cheeky slap”
“easy Tiger…”
“cheeky slap”
“get off him Dave”
Leg“have a word, mate”
“easy Tiger…”
“cheeky slap”
“easy Tiger…”
“cheeky slap”
“get off him Dave”
“cheeky slap”
“get off him Dave”
“Let’s ‘ave it then”
Chest “easy Tiger…”
“cheeky slap”
“get off him Dave”
“cheeky slap”
“get off him Dave”
“Let’s ‘ave it then”
“get off him Dave”
“Let’s ‘ave it then”
“cab to A&E
please”
Face “cheeky slap”
“get off him Dave”
“Let’s ‘ave it then”
“get off him Dave”
“Let’s ‘ave it then”
“cab to A&E
please”“Let’s ‘ave it then”
“cab to A&E
please”“Ambulance
please”
Testicles “get off him Dave”
“Let’s ‘ave it then”
“cab to A&E
please”“Let’s ‘ave it then”
“cab to A&E
please”“Ambulance
please”
“cab to A&E
please”“Ambulance
please”“Mortuary
please”
@thomlangford
![Page 22: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/22.jpg)
The Langford/Malik Risk Model ver
1.0
Likelihood of threat Ain’t Happening It’s On! Holy Crap!
Ease of Exploitation
I’m a Ninja
I’m a drunk Ninja
I’m drunk
I’m a Ninja
I’m a drunk Ninja
I’m drunk
I’m a Ninja
I’m a drunk Ninja
I’m drunk
Asset Value
Arm “It’s your round”
“have a word, mate”
“easy Tiger…”
“have a word, mate”
“easy Tiger…”
“cheeky slap”
“easy Tiger…”
“cheeky slap”
“get off him Dave”
Leg“have a word, mate”
“easy Tiger…”
“cheeky slap”
“easy Tiger…”
“cheeky slap”
“get off him Dave”
“cheeky slap”
“get off him Dave”
“Let’s ‘ave it then”
Chest “easy Tiger…”
“cheeky slap”
“get off him Dave”
“cheeky slap”
“get off him Dave”
“Let’s ‘ave it then”
“get off him Dave”
“Let’s ‘ave it then”
“cab to A&E
please”
Face “cheeky slap”
“get off him Dave”
“Let’s ‘ave it then”
“get off him Dave”
“Let’s ‘ave it then”
“cab to A&E
please”“Let’s ‘ave it then”
“cab to A&E
please”“Ambulance
please”
Testicles “get off him Dave”
“Let’s ‘ave it then”
“cab to A&E
please”“Let’s ‘ave it then”
“cab to A&E
please”“Ambulance
please”
“cab to A&E
please”“Ambulance
please”“Mortuary
please”
18-24 YEAR OLD (SINGLE & UP FOR IT)@thomlangford
![Page 23: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/23.jpg)
The Langford/Malik Risk Model ver
1.0
Likelihood of threat Ain’t Happening It’s On! Holy Crap!
Ease of Exploitation
I’m a Ninja
I’m a drunk Ninja
I’m drunk
I’m a Ninja
I’m a drunk Ninja
I’m drunk
I’m a Ninja
I’m a drunk Ninja
I’m drunk
Asset Value
Arm “It’s your round”
“have a word, mate”
“easy Tiger…”
“have a word, mate”
“easy Tiger…”
“cheeky slap”
“easy Tiger…”
“cheeky slap”
“get off him Dave”
Leg“have a word, mate”
“easy Tiger…”
“cheeky slap”
“easy Tiger…”
“cheeky slap”
“get off him Dave”
“cheeky slap”
“get off him Dave”
“Let’s ‘ave it then”
Chest “easy Tiger…”
“cheeky slap”
“get off him Dave”
“cheeky slap”
“get off him Dave”
“Let’s ‘ave it then”
“get off him Dave”
“Let’s ‘ave it then”
“cab to A&E
please”
Face “cheeky slap”
“get off him Dave”
“Let’s ‘ave it then”
“get off him Dave”
“Let’s ‘ave it then”
“cab to A&E
please”“Let’s ‘ave it then”
“cab to A&E
please”“Ambulance
please”
Testicles “get off him Dave”
“Let’s ‘ave it then”
“cab to A&E
please”“Let’s ‘ave it then”
“cab to A&E
please”“Ambulance
please”
“cab to A&E
please”“Ambulance
please”“Mortuary
please”
40 YEAR OLD (MARRIED WITH KIDS)@thomlangford
![Page 24: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/24.jpg)
ISO 27005 Risk
Model
Likelihood of threat Low Medium High
Ease of Exploitation Low Medium High Low Medium High Low Medium High
Asset Value
0 0 1 2 1 2 3 2 3 4
1 1 2 3 2 3 4 3 4 5
2 2 3 4 3 4 5 4 5 6
3 3 4 5 4 5 6 5 6 7
4 4 5 6 5 6 7 6 7 8
IN PRACTISE@thomlangford
![Page 25: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/25.jpg)
WHAT’S WRONG WITH ORDINALS?
And nobody uses “red” because it means failure
Nobody uses “green” because it means no more budget
Therefore the risk world becomes “amber”
L
M
H
@thomlangford
![Page 26: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/26.jpg)
Nassim Nicholas Taleb, “The Black swan”
@thomlangford
![Page 27: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/27.jpg)
@thomlangford
![Page 28: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/28.jpg)
@thomlangford
THE TREATMENT OF RISK
@thomlangford
![Page 29: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/29.jpg)
@thomlangford
![Page 30: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/30.jpg)
@thomlangford
![Page 31: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/31.jpg)
@thomlangford
![Page 32: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/32.jpg)
@thomlangford@thomlangford
![Page 33: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/33.jpg)
@thomlangford
![Page 34: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/34.jpg)
CAUSATION VS CORRELATION
0
225
450
675
900
29
30.25
31.5
32.75
34
2000 2001 2002 2003 2004 2005 2006 2007 2008 2009
Per capita consumption of cheese (US)!Pounds (USDA)
Number of people who died by becoming tangled in their bedsheets!Deaths (US) (CDC)
Source: Spurious Correlation, www.tylervigen.com@thomlangford
![Page 35: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/35.jpg)
FLEXIBLE RISK RESPONSE
@thomlangford
![Page 36: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/36.jpg)
TAKEAWAYS
@thomlangford
![Page 37: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/37.jpg)
TAKEAWAY #1
• Recognise and understand the difference between “hygiene” risks and “actual” risks
@thomlangford
![Page 38: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/38.jpg)
• Spot patterns in your risks over time. What has become a commodity? What were the black swans?
TAKEAWAY #2
@thomlangford
![Page 39: 44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford](https://reader037.fdocuments.in/reader037/viewer/2022103014/54b39de34a7959384f8b4652/html5/thumbnails/39.jpg)
TAKEAWAY #3
• A risk hasn’t been mitigated just because it hasn’t happened; don’t suffer a placebo effect.
@thomlangford