It seems that to make better cybersecurity-related decisions a senior FBI official recommends considering a simple algebraic equation:
risk = threat x vulnerability x consequence
rather than solely focusing on threat vectors and actors.
To be honest, I sometimes wonder why people obsess about threat vectors in the first place. There seems to be a beleive that the more threats you face, the higher your risk, regardless of your controls and regardless of the classification of the threats.
Look at it this way: what do you have control over?
Why do you think that people like auditors refer to the protective and detective mechanisms as “controls”?
Yes, if you’re a 600,000 lb gorilla like Microsoft you can take down one – insignificant – botnet, but the rest of us don’t have control over the threat vectors and threat actors.
What do we have control over?
Vulnerabilities, to some extent. We can patch; we can choose to run alternative software; we can mask off access by the threats to the vulnerabilities. We can do things to reduce the the “vulnerability surface” such as partitioning our networks, restricting access, not exposing more than is absolutely necessary to the Internet (why oh why is your SqlServer visible to the net, why isn’t it behind the web server, which in turn is behind a firewall).
Asset to a large extent. Document them. Identify who should be using them and implement IAM.
And very import: we have control over RESPONSE.
Did the FBI equation mention response? I suppose you could say that ‘awareness’ is a part of a response package. Personally I think that response is a very, very important part of this equation, and its the one you have MOST control over.
And response is – or should be – totally independent of the threats
since it focuses on preserving and recovering the assets.
I think they have it very, very confused and this isn’t the most productive, most effective way of going about it. But then the FBI’s view of policing is to go after the criminals, and if you consider the criminals to be the threat then that makes sense.
But lest face it, most corporations and are not in the business of policing. neither are home users.
Which is why I focus on the issue of “what you have control over”.
