full-disclosure - Learn from history?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87wu3k0wfv.fsf@it029205.massey.ac.nz>
From: j.riden at massey.ac.nz (James Riden)
Subject: Learn from history?

Michal Zalewski <lcamtuf@...ttot.org> writes:

> On Mon, 10 May 2004, Alerta Redsegura wrote:
>
>> When we talk about risk, we are already taking into account the odds of the
>> event happening:
>>
>> R = E x p
>>
>> Where:
>>
>> R = Risk
>> E = event
>> p = probability of the event happening
>
> If we must toy with bogus marketspeak "equations", shouldn't E - at the
> very least - numerically correspond to the consequences (loss?) caused by
> an event, rather than being an event itself?
>
> Otherwise, my risk R of getting a bar of chocolate from a stranger is
> 0.001 * getting_chocolate_bar_from_stranger.

If you feel happier with probability, the expected loss is the loss if
X occurs times the probability of X occurring.  This is nice and
solid, but practically useless because the two terms on the right hand
side are very hard to estimate. If you have no evidence for how likely
X is to occur, and you're a good Bayesian, it basically comes down to
"do I feel lucky?" - though statisticians would insist on calling this
a prior probability.

Of couse since Blaster, we know that Very Bad Things could happen if
we're not patched, which means we're prepared to put Quite a Lot of
effort into making X as unlikely as possible.

There are more sophisticated ways of stating the equation, but they
all run up against the same problem of estimating the likelihood of
events and the loss that would occur if they happened, and you need to
account for the fact that the fix may cause problems as well.

-- 
James Riden / j.riden@...sey.ac.nz / Systems Security Engineer
Information Technology Services, Massey University, NZ.
GPG public key available at: http://www.massey.ac.nz/~jriden/