Computer Security David Wagner, C79, 4/4/2013 Thursday, April 4, 13 - - PowerPoint PPT Presentation

▶
computer security
SMART_READER_LITE
LIVE PREVIEW

Computer Security David Wagner, C79, 4/4/2013 Thursday, April 4, 13 - - PowerPoint PPT Presentation

May 03, 2023 171 likes •964 views

Computer Security David Wagner, C79, 4/4/2013 Thursday, April 4, 13 themes so far: - measuring risk - cognitive biases - probability reduction (e.g., vaccines) - harm reduction (e.g., treatment) Thursday, April 4, 13 themes so far: -

slide-1
SLIDE 1

Computer Security

David Wagner, C79, 4/4/2013

Thursday, April 4, 13

slide-2
SLIDE 2

themes so far:

  • measuring risk
  • cognitive biases
  • probability reduction (e.g., vaccines)
  • harm reduction (e.g., treatment)

Thursday, April 4, 13

slide-3
SLIDE 3

themes so far:

  • measuring risk
  • cognitive biases
  • probability reduction (e.g., vaccines)
  • harm reduction (e.g., treatment)

today: dealing with uncertain risks

Thursday, April 4, 13

slide-4
SLIDE 4

computer security is immature

Thursday, April 4, 13

slide-5
SLIDE 5

Thursday, April 4, 13

slide-6
SLIDE 6

computer security is risk management traditional view:

Thursday, April 4, 13

slide-7
SLIDE 7

Thursday, April 4, 13

slide-8
SLIDE 8

Thursday, April 4, 13

slide-9
SLIDE 9

Thursday, April 4, 13

slide-10
SLIDE 10

Thursday, April 4, 13

slide-11
SLIDE 11

Thursday, April 4, 13

slide-12
SLIDE 12

Thursday, April 4, 13

slide-13
SLIDE 13

computer security is risk management traditional view:

Thursday, April 4, 13

slide-14
SLIDE 14

risk = E[loss] = P(breach) × cost(breach)

Thursday, April 4, 13

slide-15
SLIDE 15

risk = E[loss] = P(breach) × cost(breach)

  • ften not known

Thursday, April 4, 13

slide-16
SLIDE 16

risk = E[loss] = P(breach) × cost(breach)

  • ften not known

does the system have a vulnerability?

Thursday, April 4, 13

slide-17
SLIDE 17

risk = E[loss] = P(breach) × cost(breach)

  • ften not known

does the system have a vulnerability? will attackers exploit it?

Thursday, April 4, 13

slide-18
SLIDE 18

1 million lines of code

Thursday, April 4, 13

slide-19
SLIDE 19

1 million lines of code × 1 bug / thousand lines of code

Thursday, April 4, 13

slide-20
SLIDE 20

1 million lines of code × 1 bug / thousand lines of code = 1000 bugs

Thursday, April 4, 13

slide-21
SLIDE 21

1 million lines of code × 1 bug / thousand lines of code = 1000 bugs attacker only needs to find 1 bug; defender must find all of them

Thursday, April 4, 13

slide-22
SLIDE 22

1 million lines of code × 1 bug / thousand lines of code = 1000 bugs attacker only needs to find 1 bug; defender must find all of them don’t know whether system is vulnerable

Thursday, April 4, 13

slide-23
SLIDE 23

attackers choose how and whether to attack

Thursday, April 4, 13

slide-24
SLIDE 24

attackers choose how and whether to attack attacks change rapidly

Thursday, April 4, 13

slide-25
SLIDE 25

attackers choose how and whether to attack attacks change rapidly no good data about prob. of breach

Thursday, April 4, 13

slide-26
SLIDE 26

risk = E[loss] = P(breach) × cost(breach)

  • ften not known

Thursday, April 4, 13

slide-27
SLIDE 27

implications

Thursday, April 4, 13

slide-28
SLIDE 28

security market is sometimes dysfunctional

Thursday, April 4, 13

slide-29
SLIDE 29

market for lemons

Thursday, April 4, 13

slide-30
SLIDE 30

thinking about risks, when there are multiple players

Thursday, April 4, 13

slide-31
SLIDE 31

Thursday, April 4, 13

slide-32
SLIDE 32

but fraud rates higher in UK US banks spent less on security

Thursday, April 4, 13

slide-33
SLIDE 33

UK: US: but fraud rates higher in UK US banks spent less on security

Thursday, April 4, 13

slide-34
SLIDE 34

UK: US: liability for fraud on customer but fraud rates higher in UK US banks spent less on security

Thursday, April 4, 13

slide-35
SLIDE 35

UK: US: liability for fraud on customer liability for fraud on bank but fraud rates higher in UK US banks spent less on security

Thursday, April 4, 13

slide-36
SLIDE 36

UK: US: liability for fraud on customer liability for fraud on bank but fraud rates higher in UK huh? US banks spent less on security

Thursday, April 4, 13

slide-37
SLIDE 37

UK: US:

Thursday, April 4, 13

slide-38
SLIDE 38

UK: US: fraud? you must have been careless. tough luck, sucks to be you

Thursday, April 4, 13

slide-39
SLIDE 39

UK: US: fraud? you must have been careless. tough luck, sucks to be you fraud? no problem, we’ll reimburse you

Thursday, April 4, 13

slide-40
SLIDE 40

UK: US: fraud? you must have been careless. tough luck, sucks to be you fraud? no problem, we’ll reimburse you good for customers, but also good for banks

Thursday, April 4, 13

slide-41
SLIDE 41

moral hazard UK banks got lazy and careless, leading to an epidemic of fraud

Thursday, April 4, 13

slide-42
SLIDE 42

lesson: align incentives

Thursday, April 4, 13

slide-43
SLIDE 43

rule of thumb: place liability on whoever is in the best position to do something about it

Thursday, April 4, 13

slide-44
SLIDE 44

externalities

Thursday, April 4, 13

slide-45
SLIDE 45

spam

Thursday, April 4, 13

slide-46
SLIDE 46

spam ~ 90% of all email is spam

Thursday, April 4, 13

slide-47
SLIDE 47

spam ~ 90% of all email is spam costs US $20 billion per year, in lost productivity

Thursday, April 4, 13

slide-48
SLIDE 48

costs recipient: costs sender:

Thursday, April 4, 13

slide-49
SLIDE 49

costs recipient: costs sender: 10 ¢ per spam < 0.001 ¢ per spam

Thursday, April 4, 13

slide-50
SLIDE 50

10 million Viagra spams → 1 sale $3.5 million in revenue per year, for one botnet

Thursday, April 4, 13

slide-51
SLIDE 51

why is this possible?

Thursday, April 4, 13

slide-52
SLIDE 52

why is this possible? bots

Thursday, April 4, 13

slide-53
SLIDE 53

cost of spam not born by those enabling it (an externality)

Thursday, April 4, 13

slide-54
SLIDE 54

solution?

Thursday, April 4, 13

slide-55
SLIDE 55
  • regulation: prohibit the harmful activity
  • taxation: tax the harmful activity, so market

price reflects the true cost to society

  • liability: make those causing harm liable for

end effects

  • mitigation: develop solutions so others are

harmed less

Thursday, April 4, 13

slide-56
SLIDE 56

Thursday, April 4, 13

slide-57
SLIDE 57

let’s count the externalities:

Thursday, April 4, 13

slide-58
SLIDE 58

let’s count the externalities:

  • 1. attackers used bots to send lots of traffic

Thursday, April 4, 13

slide-59
SLIDE 59

let’s count the externalities:

  • 1. attackers used bots to send lots of traffic
  • 2. attackers exploited open DNS relays to

boost amount of traffic

Thursday, April 4, 13

slide-60
SLIDE 60

let’s count the externalities:

  • 1. attackers used bots to send lots of traffic
  • 2. attackers exploited open DNS relays to

boost amount of traffic

  • 3. ISPs don’t block outgoing traffic with obviously

spoofed source address

Thursday, April 4, 13

slide-61
SLIDE 61

externalities make risks harder to manage

Thursday, April 4, 13

slide-62
SLIDE 62

cyberwar cyberespionage cybercrime

Thursday, April 4, 13

slide-63
SLIDE 63

Thursday, April 4, 13

slide-64
SLIDE 64

Thursday, April 4, 13

slide-65
SLIDE 65

Thursday, April 4, 13

slide-66
SLIDE 66

Thursday, April 4, 13

slide-67
SLIDE 67

Thursday, April 4, 13

slide-68
SLIDE 68

Thursday, April 4, 13

slide-69
SLIDE 69

Thursday, April 4, 13

slide-70
SLIDE 70

Thursday, April 4, 13

slide-71
SLIDE 71

Thursday, April 4, 13

slide-72
SLIDE 72

Thursday, April 4, 13

slide-73
SLIDE 73

Thursday, April 4, 13

slide-74
SLIDE 74

Thursday, April 4, 13

slide-75
SLIDE 75

Thursday, April 4, 13

slide-76
SLIDE 76

cyberwar cyberespionage cybercrime

Thursday, April 4, 13

slide-77
SLIDE 77

cyberwar cyberespionage cybercrime exercise: name some externalities

Thursday, April 4, 13

slide-78
SLIDE 78
  • prevention: reduce probability of bad thing
  • mitigation: reduce cost of bad thing
  • risk transfer: shift cost to someone else

(insurance, taxation, liability, ...) general strategies for dealing with risk:

Thursday, April 4, 13