Diese Präsentation wurde erfolgreich gemeldet.
Die SlideShare-Präsentation wird heruntergeladen. ×

44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford

Anzeige
Anzeige
Anzeige
Anzeige
Anzeige
Anzeige
Anzeige
Anzeige
Anzeige
Anzeige
Anzeige
Anzeige

Hier ansehen

1 von 40 Anzeige

44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford

Herunterladen, um offline zu lesen

44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford

Risk is often seen as a dirty word in business. It is a thing that needs to be reduced to nothing, and has no possible good use in an organization, especially a security programme.

This couldn’t be more wrong! Risk is an inherent part of any business, and yet it is often poorly recognized and leveraged in the security organisation. In this presentation Thom will look at three areas of the risk conundrum to open the veil on the elusive art of understanding and ultimately measuring risk.

44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford

Risk is often seen as a dirty word in business. It is a thing that needs to be reduced to nothing, and has no possible good use in an organization, especially a security programme.

This couldn’t be more wrong! Risk is an inherent part of any business, and yet it is often poorly recognized and leveraged in the security organisation. In this presentation Thom will look at three areas of the risk conundrum to open the veil on the elusive art of understanding and ultimately measuring risk.

Anzeige
Anzeige

Weitere Verwandte Inhalte

Andere mochten auch (20)

Weitere von 44CON (20)

Anzeige

Aktuellste (20)

44CON 2014 - Flushing Away Preconceptions of Risk, Thom Langford

  1. 1. FLUSHING AWAY PRECONCEPTIONS OF RISK Thom Langford! @thomlangford September 2014
  2. 2. DISCLAIMER The opinions expressed in this presentation are my own and do not necessarily represent those of my employer @thomlangford
  3. 3. • our interpretation of risk! • our measurement of risk! • our effective treatment of risk @thomlangford
  4. 4. THE INTERPRETATION OF RISK riskier? @thomlangford
  5. 5. @thomlangford
  6. 6. @thomlangford
  7. 7. @thomlangford
  8. 8. @thomlangford
  9. 9. 49 sq/in @thomlangford
  10. 10. 1,676 sq/in @thomlangford
  11. 11. 3,295 sq/in @thomlangford
  12. 12. 20,961 sq/in @thomlangford
  13. 13. 25,127 sq/in @thomlangford
  14. 14. @thomlangford
  15. 15. @thomlangford
  16. 16. “perceived” risk @thomlangford
  17. 17. “hygiene” risk @thomlangford
  18. 18. “actual” risk @thomlangford
  19. 19. THE MEASUREMENT OF RISK @thomlangford
  20. 20. Malik, Javvad (2014-05-12). The CISSP companion handbook: A collection of tales, experiences and straight up fabrications fitted into the 10 CISSP domains of information security (Kindle Locations 918-923). . Kindle Edition. The Malik Risk Model! Ver 1.0 Impact Won’t Hurt Is that the best you got? Ouch! Holy Crap! Likelihood Ain’t Happening “a swift half” “it’s your round” “easy Tiger…” “hold my drink Steve” Possibly “it’s your round” “easy Tiger…” “hold my drink Steve” “Get off him Dave, he ain’t worth it” It’s On “easy Tiger…” “hold my drink Steve” “Get off him Dave, he ain’t worth it” “cab to A&E please” Holy Crap! “hold my drink Steve” “Get off him Dave, he ain’t worth it” “cab to A&E please” “Ambulance please” @thomlangford
  21. 21. The Langford/ Malik Risk Model ver 1.0 Likelihood of threat Ain’t Happening It’s On! Holy Crap! Ease of Exploitation I’m a Ninja I’m a drunk Ninja I’m drunk I’m a Ninja I’m a drunk Ninja I’m drunk I’m a Ninja I’m a drunk Ninja I’m drunk Asset Value Arm “It’s your round” “have a word, mate” “easy Tiger…” “have a word, mate” “easy Tiger…” “cheeky slap” “easy Tiger…” “cheeky slap” “get off him Dave” Leg “have a word, mate” “easy Tiger…” “cheeky slap” “easy Tiger…” “cheeky slap” “get off him Dave” “cheeky slap” “get off him Dave” “Let’s ‘ave it then” Chest “easy Tiger…” “cheeky slap” “get off him Dave” “cheeky slap” “get off him Dave” “Let’s ‘ave it then” “get off him Dave” “Let’s ‘ave it then” “cab to A&E please” Face “cheeky slap” “get off him Dave” “Let’s ‘ave it then” “get off him Dave” “Let’s ‘ave it then” “cab to A&E please” “Let’s ‘ave it then” “cab to A&E please” “Ambulance please” Testicles “get off him Dave” “Let’s ‘ave it then” “cab to A&E please” “Let’s ‘ave it then” “cab to A&E please” “Ambulance please” “cab to A&E please” “Ambulance please” “Mortuary please” @thomlangford
  22. 22. The Langford/ Malik Risk Model ver 1.0 Likelihood of threat Ain’t Happening It’s On! Holy Crap! Ease of Exploitation I’m a Ninja I’m a drunk Ninja I’m drunk I’m a Ninja I’m a drunk Ninja I’m drunk I’m a Ninja I’m a drunk Ninja I’m drunk Asset Value Arm “It’s your round” “have a word, mate” “easy Tiger…” “have a word, mate” “easy Tiger…” “cheeky slap” “easy Tiger…” “cheeky slap” “get off him Dave” Leg “have a word, mate” “easy Tiger…” “cheeky slap” “easy Tiger…” “cheeky slap” “get off him Dave” “cheeky slap” “get off him Dave” “Let’s ‘ave it then” Chest “easy Tiger…” “cheeky slap” “get off him Dave” “cheeky slap” “get off him Dave” “Let’s ‘ave it then” “get off him Dave” “Let’s ‘ave it then” “cab to A&E please” Face “cheeky slap” “get off him Dave” “Let’s ‘ave it then” “get off him Dave” “Let’s ‘ave it then” “cab to A&E please” “Let’s ‘ave it then” “cab to A&E please” “Ambulance please” Testicles “get off him Dave” “Let’s ‘ave it then” “cab to A&E please” “Let’s ‘ave it then” “cab to A&E please” “Ambulance please” “cab to A&E please” “Ambulance please” “Mortuary please” 18-24 YEAR @thomlangford OLD (SINGLE & UP FOR IT)
  23. 23. The Langford/ Malik Risk Model ver 1.0 Likelihood of threat Ain’t Happening It’s On! Holy Crap! Ease of Exploitation I’m a Ninja I’m a drunk Ninja I’m drunk I’m a Ninja I’m a drunk Ninja I’m drunk I’m a Ninja I’m a drunk Ninja I’m drunk Asset Value Arm “It’s your round” “have a word, mate” “easy Tiger…” “have a word, mate” “easy Tiger…” “cheeky slap” “easy Tiger…” “cheeky slap” “get off him Dave” Leg “have a word, mate” “easy Tiger…” “cheeky slap” “easy Tiger…” “cheeky slap” “get off him Dave” “cheeky slap” “get off him Dave” “Let’s ‘ave it then” Chest “easy Tiger…” “cheeky slap” “get off him Dave” “cheeky slap” “get off him Dave” “Let’s ‘ave it then” “get off him Dave” “Let’s ‘ave it then” “cab to A&E please” Face “cheeky slap” “get off him Dave” “Let’s ‘ave it then” “get off him Dave” “Let’s ‘ave it then” “cab to A&E please” “Let’s ‘ave it then” “cab to A&E please” “Ambulance please” Testicles “get off him Dave” “Let’s ‘ave it then” “cab to A&E please” “Let’s ‘ave it then” “cab to A&E please” “Ambulance please” “cab to A&E please” “Ambulance please” “Mortuary please” 40 YEAR @thomlangford OLD (MARRIED WITH KIDS)
  24. 24. ISO 27005 Risk Model Likelihood of threat Low Medium High Ease of Exploitation Low Medium High Low Medium High Low Medium High Asset Value 0 0 1 2 1 2 3 2 3 4 1 1 2 3 2 3 4 3 4 5 2 2 3 4 3 4 5 4 5 6 3 3 4 5 4 5 6 5 6 7 4 4 5 6 5 6 7 6 7 8 @thomlangford IN PRACTISE
  25. 25. WHAT’S WRONG WITH ORDINALS? And nobody uses “red” because it means failure Therefore the risk world becomes “amber” Nobody uses “green” because it means no more budget H M L @thomlangford
  26. 26. Nassim Nicholas Taleb, “The Black swan” @thomlangford
  27. 27. @thomlangford
  28. 28. @thomlangford THE TREATMENT OF RISK
  29. 29. @thomlangford
  30. 30. @thomlangford
  31. 31. @thomlangford
  32. 32. @thomlangford
  33. 33. @thomlangford
  34. 34. CAUSATION VS CORRELATION 900 675 450 225 0 34 32.75 31.5 30.25 29 Per capita consumption of cheese (US)! Pounds (USDA) Number of people who died by becoming tangled in their bedsheets! Deaths (US) (CDC) 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 Source: Spurious @thomlangford Correlation, www.tylervigen.com
  35. 35. FLEXIBLE RISK RESPONSE @thomlangford
  36. 36. TAKEAWAYS @thomlangford
  37. 37. TAKEAWAY #1 • Recognise and understand the difference between “hygiene” risks and “actual” risks @thomlangford
  38. 38. TAKEAWAY #2 • Spot patterns in your risks over time. What has become a commodity? What were the black swans? @thomlangford
  39. 39. TAKEAWAY #3 • A risk hasn’t been mitigated just because it hasn’t happened; don’t suffer a placebo effect. @thomlangford
  40. 40. thom@thomlangford.com @thomlangford uk.linkedin.com/in/thomlangford

×