Jeff Walzer's Library tagged risk → View Popular

Filter:
All
Annotated

30 Apr 08

Security preparedness instead of threat prediction - Network World

www.networkworld.com/...042908-risk-reward.html - Preview

security Network World risk

The strategy of threat prediction suffers from two major flaws. First, it
assumes predictability in a field that is full of surprises.
New attacks are not designed in a vacuum; they are designed explicitly to
sidestep our expectations.
5 more annotations...
- Second, threat prediction causes tunnel vision. It pushes us to focus on attacks
  rather than assets, on the “bad” rather than the “valuable.”
- This plays right into the hands of attackers, as tunnel vision narrows our
  defenses thereby making them easier to bypass. Rather than trying to predict
  threats, we should focus on general security preparedness.
- Rather, secure companies are those that minimize both the incidence of
  successful attacks and then further minimize the impact of those few breaches.
- But most companies put a lot less emphasis on preparedness that they do on
  specific threats.
- We have seen this in our research year after year, where we find very few
  companies with specific, well designed and well drilled incident-response
  policies.

04 Apr 08

The Psychology of Security

www.schneier.com/essay-155.html - Preview

Bruce Schneier psychology risk security

The reality of security is mathematical, based on the probability of different
risks and the effectiveness of different countermeasures.
But security is also a feeling, based not on probabilities and mathematical
calculations, but on your psychological reactions to both risks and
countermeasures.
44 more annotations...
- Or, more generally, you can be secure even though you don't feel secure. And you
  can feel secure even though you're not. The feeling and reality of security are
  certainly related to each other, but they're just as certainly not the same as
  each other.
- Four fields of research--two very closely related--can help illuminate this
  issue. The first is behavioral economics, sometimes called behavioral finance.
- Behavioral economics looks at human biases--emotional, social, and
  cognitive--and how they affect economic decisions. The second is the psychology
  of decision-making, and more specifically bounded rationality, which examines
  how we make decisions.
- Neither is directly related to security, but both look at the concept of risk:
  behavioral economics more in relation to economic risk, and the psychology of
  decision-making more generally in terms of security risks.
- There is also direct research into the psychology of risk.
- A fourth relevant field of research is neuroscience.
- Security is a trade-off.
- Security costs money, but it also costs in time, convenience, capabilities,
  liberties, and so on.
- It makes no sense to just look at security in terms of effectiveness.
- in terms of effectiveness.
  "Is this
  effective against the threat?" is the wrong question to ask. You need to ask:
  "Is it a good trade-off?"
- There are several specific aspects of the security trade-off that can go
  wrong. For example:
  
  The severity of the risk.
  The probability of the risk.
  The magnitude of the costs.
  How effective the countermeasure is at mitigating the risk.
  How well disparate risks and costs can be compared.
- The more your perception diverges from reality in any of these five aspects, the
  more your perceived trade-off won't match the actual trade-off.
- It's my contention that these irrational trade-offs can be explained by
  psychology.
- Most of the time, when the perception of security doesn't match the reality of
  security, it's because the perception of the risk doesn't match the reality of
  the risk.
- These heuristics affect how we think about risks, how we evaluate the
  probability of future events, how we consider costs, and how we make trade-offs.
  We have ways of generating close-to-optimal answers quickly with limited
  cognitive capabilities.
- The first, and most common, area that can cause the feeling of security to
  diverge from the reality of security is the perception of risk. Security is a
  trade-off, and if we get the severity of the risk wrong, we're going to get the
  trade-off wrong.
- Traditional economics is based on something called "utility theory," which
  predicts that people make trade-offs based on a straightforward calculation of
  relative gains and losses.
- The authors of this study explained this difference by developing something
  called "prospect theory." Unlike utility theory, prospect theory recognizes that
  people have subjective values for gains and losses. In fact, humans have evolved
  a pair of heuristics that they apply in these sorts of trade-offs. The first is
  that a sure gain is better than a chance at a greater gain. ("A bird in the hand
  is better than two in the bush.") And the second is that a sure loss is worse
  than a chance at a greater loss.
- These two heuristics are so powerful that they can lead to logically
  inconsistent results.
- People make very different trade-offs if something is presented as a gain than
  if something is presented as a loss.
- Behavioral economists and psychologists call this a "framing effect": peoples'
  choices are affected by how a trade-off is framed. Frame the choice as a gain,
  and people will tend to be risk averse. But frame the choice as a loss, and
  people will tend to be risk seeking.
- Another way of explaining these results is that people tend to attach a greater
  value to changes closer to their current state than they do to changes further
  away from their current state.
- people also value something more when it is considered as something that can be
  lost, as opposed to when it is considered as a potential gain.
- This is called the "endowment effect,"
- Given that, prospect theory implies two things. First, it means that people are
  going to trade off more for security that lets them keep something they've
  become accustomed to--a lifestyle, a level of security, some functionality in a
  product or service--than they were willing to risk to get it in the first place.
  Second, when considering security gains, people are more likely to accept an
  incremental gain than a chance at a larger gain; but when considering security
  losses, they're more likely to risk a larger loss than accept the certainty of a
  small one.
- We have other heuristics and biases about risks. One common one is called
  "optimism bias": we tend to believe that we'll do better than most others
  engaged in the same activity.
- The literature also discusses a "control bias," where people are more likely
  to accept risks if they feel they have some control over them. To me, this is
  simply a manifestation of the optimism bias, and not a separate bias.
- Another bias is the "affect heuristic," which basically says that an automatic
  affective valuation--I've seen it called "the emotional core of an attitude"--is
  the basis for many judgments and behaviors about it.
- With regard to security, the affect heuristic says that an overall good
  feeling toward a situation leads to a lower risk perception, and an overall bad
  feeling leads to a higher risk perception. This seems to explain why people tend
  to underestimate risks for actions that also have some ancillary
  benefit--smoking, skydiving, and such--but also has some weirder effects.
- Another bias is that we are especially tuned to risks involving people.
- The second area that can contribute to bad security trade-offs is probability.
  If we get the probability wrong, we get the trade-off wrong.
- Generally, we as a species are not very good at dealing with large numbers.
- Additionally, there are heuristics associated with probabilities. These aren't
  specific to risk, but contribute to bad evaluations of risk. And it turns out
  that our brains' ability to quickly assess probability runs into all sorts of
  problems.
- The "availability heuristic" is very broad, and goes a long way toward
  explaining how people deal with risk and trade-offs. Basically, the availability
  heuristic means that people "assess the frequency of a class or the probability
  of an event by the ease with which instances or occurrences can be brought to
  mind."^²⁸ In other words, in any
  decision-making process, easily remembered (available) data are given greater
  weight than hard-to-remember data.
- In general, the availability heuristic is a good mental shortcut.
- But like all heuristics, there are areas where the heuristic breaks down and
  leads to biases.
- The moral here is that people will be persuaded more by a vivid, personal story
  than they will by bland statistics and facts, possibly solely due to the fact
  that they remember vivid arguments better.
- More generally, this kind of thing is related to something called "probability
  neglect": the tendency of people to ignore probabilities in instances where
  there is a high emotional content.
- The availability heuristic also explains hindsight bias. Events that have
  actually occurred are, almost by definition, easier to imagine than events that
  have not, so people retroactively overestimate the probability of those events.
- The best way I've seen this all described is by Scott Plous:
  
  In very general terms: (1) the more available an event is,
  the more frequent or probable it will seem; (2) the more vivid a piece of
  information is, the more easily recalled and convincing it will be; and (3) the
  more salient something is, the more likely it will be to appear
  causal.^³⁷
- "Representativeness" is a heuristic by which we assume the probability that an
  example belongs to a particular class is based on how well that example
  represents the class. On the face of it, this seems like a reasonable heuristic.
  But it can lead to erroneous results if you're not careful.
- As the researchers explain: "As the amount of detail in a scenario increases,
  its probability can only decrease steadily, but its representativeness and hence
  its apparent likelihood may increase. The reliance on representativeness, we
  believe, is a primary reason for the unwarranted appeal of detailed scenarios
  and the illusory sense of insight that such constructions often provide."^⁴¹
- Mental accounting is the process by which people categorize different
  costs.^⁴⁵
  People don't simply think of costs as costs; it's much more complicated than
  that.
- "Time discounting" is the term used to describe the human tendency to discount
  future costs and benefits. It makes economic sense; a cost paid in a year is not
  the same as a cost paid today, because that money could be invested and earn
  interest during the year. Similarly, a benefit accrued in a year is worth less
  than a benefit accrued today.

02 Apr 08

Technology Review: On Markets and Complexity

www.technologyreview.com/...page1 - Preview

Business C. Harvard Merton Review Robert School Technology complexity markets risk

Let me give you this analogy. If you're driving in inclement weather, you'd say
that a four-wheel-drive car is safer than a two-wheel-drive car. Now suppose
that we observed that over the last 15 years, the number of passenger accidents
per passenger mile driven hadn't changed at all. And someone says, Now wait a
minute: Has four-wheel drive made us safer? And the answer would be,
Technically, no, because we're having just the same number of accidents we used
to have. So, was this all a waste, or were we wrong? I think you know the
answer, as I do. What really happened is that people get something that will
unambiguously make you safer if you behave the same way you did before.
That's the key element to understand first. The amount of risk we take
personally, individually, or collectively is not a physical given constant. We
choose it. What happens is, we look at some new, safer instrument and
we say, Yes, we could be safer doing the same thing. Or, we could take the same
amount of risk and do things that were too risky to do before.

23 Mar 08

Attack of the Zombie Computers Is Growing Threat

www.nytimes.com/...07net.html - Preview

botnet bots irc new york times risk security

22 Mar 08

1 - 7 of 7

Showing 20▼ items per page

Selected Tags

risk

Related Tags

Top Contributors

Click in to find related links.

Groups interested in risk

Health Now

Members (90)

bookmarks (1852)
Cancer

Members (22)

bookmarks (485)
Vitamin D

Members (4)

bookmarks (738)

Related Lists on Diigo

Washington H@AS Network Brainstorm

People of all sizes and sha...

Items: 17 | Visits: 65

Created by: Brad Tollefson
Encryption

Items: 6 | Visits: 38

Created by: Jeff Walzer

Highlighter, Sticky notes, Tagging, Groups and Network: integrated suite dramatically boosting research productivity. Learn more »

Join Diigo

Jeff Walzer's Library tagged risk → View Popular

Selected Tags

Related Tags

Sponsored Links

Top Contributors

Groups interested in risk