I have just returned from two long days and two long nights of 44CON, the premier conference in London for technical InfoSec professionals (and even a few of us management types). It saw the debut of by “Flushing Away Preconceptions of Risk” presentation, an expansion of the my recent post for the Analogies Project.
The core messages of the presentation are not necessarily pleasant ones; the correct use of risk in any organisation is one of the most powerful tools in an information security programme, and yet it seems to me that very few of us understand it fully. Many of us struggle with not only identifying what the real risks are in the first place, but also how to measure them and even how to properly treat them.
Identifying risks at first seems like an easy think – identify assets, and then identify what could go wrong. I won’t elaborate the analogy much here (read it at the Analogies Project), but given how we regularly fail to identify risky behaviours correctly in our daily lives it should be no surprise we fail to do so professionally. The same bias applies to when we subsequently try and measure the risks; every mechanism we use introduces potential errors and even vagueness. I was quite proud to introduce the Langford/Malik Risk Model (ver 1.0), an approach that I evolved from one that Javvad Malik introduced in his book. Again, it uses an analogy although this time of a pub fight to not only describe levels of risk but also risk appetite. I do hope that not too many of you will find it useful next Friday and Saturday night.
Finally the effective treatment of risk was covered, and how we so often simply do what has been done before, not what is going to be effective now. Just because a risk hasn’t been realised doesn’t mean you have treated it effectively, it just means that an incident hasn’t happened (that you know of).
The slides are below, but since my presentation style has evolved more into storytelling rather than bullet point reading, by themselves they may say little to you, but the session was recorded and when it is released I will make it available here. Like any presentation it barely touches the surface of risk management and its issues, but it was intended to be thought provoking and prompt people to not assume that just because they have always done things in a certain way that it is the best or even correct way.
As for 44CON itself, well, any conference that has a “gin o’clock” on each day has to be pretty good in my books! It was a very well organised conference, with an excellent and highly motivated Crew to help support it. SpeakerOps were particularly good providing a personal touch I have not seen at any other conference. The quality of the talks and the speakers was also excellent, but as I alluded to in my introduction, many of them were technically beyond me!
The highlight for me however was a workshop I attended demonstrating the beta version of the Cyber CPR product. This is a virtual machine (that can also be deployed on ultra portable hardware if need be) that builds and entire incident management environment allowing for the discovery, gathering and analysis of evidence during an incident. It build a virtual “war room” environment, where multiple incidents can be tracked at once, in a secure and separate environment from the one that has actually just been breached. With tools built into the backend and access via a browser it even does away to have many of the tools on your own environment, making it great for remote and ad hoc use alike.
The product is in Beta at the moment, and does lack a few features, (they described it as not ready for active duty), but what i saw was very polished and useful even in it’s beta configuration. Commercially it will be available for free with up to three users, and only $5k GBP for up to twenty (please don’t quote me on these figures though). I would strongly recommend you take a look at this excellent environment that for very little outlay will significantly improve many current incident response teams, and their over use of Excel. The team expects it to be commercially ready by Spring next year.
The final highlight was to be able to meet Jonathon Schiefer the director of the film Algorithm which had its European debut at 44CON on Wednesday night. It was fascinating to hear about the backstory of the film, his challenges and even how he made the film financially and technically. He was an absolute pleasure to chat with, and I thoroughly regretted my decision to have a curry instead of watching the film. At a stretch you could say we are kindred spirits when it comes to our film making, but he is without a doubt in an entirely different league to me!
44CON will be back next year, but we were also enticed with the news of another 44CON spring conference being planned as well. I would strongly recommend anyone who can get to London to attend both of these conferences. Congratulations to Adrian and Steve and the many people in the crew for putting on a fabulous conference.
Do you really understand the value of the data in your organisation? Some of it is fairly straightforwards, such as personally identifiable information (PII) and/or credit card information ($188 USD per record in direct and indirect costs to the organisation for every record lost was the figure I last heard and used).
What about your intellectual property though? Or client RFP’s and and pre-sales work left on the train? Salary information? Internal network architecture diagrams? Sometimes, when this information is lost it is difficult to ascertain its value, impact to you and your organisation and therefore the scale of your response.
I was reminded of this value quandary while I was having a second fitting on a suit I was having made at the shop of Charlie Allen in Islington. Before anyone makes a judgement on my salary, the suit was a very welcome prize from my time at the InfoSecurity show in April, from the good folks at Sestus. I have had suits made before, normally in India, but this was my first suit to be made wholly in England and knew there would be a difference in price if i were to pay for it myself. After the fitting I asked to be measured up for some new shirts; I thought I would treat myself and take advantage of the time in Charlie’s studio. I checked the price of £200 with a minimum order of three. Good value I thought, three shirts for £200. It was only after the fabric selection, design, measurements etc the invoice came… The shirts were £200 each, a total of £600. I very nearly handed over my credit card simply to avoid the humiliation of admitting my mistake and exposing myself as someone who quite obviously shops in Top Man.
Blustering my apologies, I mentioned something about obviously not understanding the true value of these shirts, asked for the quote to be put on file for “later” (i.e. when I win the lottery) and made a quick exit. However, as I walked back to the office I realised that it was obviously going to be £200 each; a good quality short from Thomas Pink off the peg costs between £80 and £100 each, therefore how can three made to measure shirts cost £200? I had woefully underestimated the value of something that was actually quite obvious in hindsight.
So what? Understanding your information assets, and their value is a table stakes exercise. Doing this will allow you to do two things;
- Understand the total value of your assets and use the figure to work out what kind of exposure your organisation is likely to experience in case of a breach.
- Subsequently use this information to build a realistic business case for protective and preventative measures to avoid that breach in the first place.
- Ensure the scale of your response when those assets are compromised is commensurate to their value.
There are plenty of good resources to help guide you on this, but one of the most important pieces of the puzzle is to understand the financial value of your assets in the first place, and certainly not after a breach.