Last week I started a new job as Principal Modeler for Cyber Risk at Risk Management Solutions (RMS). This is HUGE, coming after a 12 year quest that was far from easy or certain.
I don't normally post personal stories on this blog (or elsewhere) but today feels like the right time for this particular personal story. I'm writing this as a way of connecting to my community, many of whom have shared the ups and downs of this journey. I don't have any big lessons or advice. Even so, some readers may find this story instructive or inspirational, even indirectly. I hope so.
Caveats: In this post, I don't individually acknowledge and thank all the people who have helped me along the way. There are so many, so I will do that separately, both in one-on-one communications and later blog posts. I'm also going to discipline myself not to write about all the details, all the events, all the feelings along the way. That would be too long. I aim is to have a post that is readable and still specific enough to be meaningful.
Even so, it's a long blog post. If this suits you, the story continues below.
Here is a video demo of the NetLogo "Cyber Security Investment Game", as a work in progress. This run is a 6/3 multiplayer game, meaning 6 cooperative Defenders and 3 adversarial Attackers. Defenders play a 2-player game with everyone else, while Attackers only play 2-player games with Defenders. It's a complicated game, with up to 400 possible "moves" for each agent at each step, and also a dynamic game, meaning the structure of the game can change dynamically during the course of play. (Game Theory Purists will probably hate it for that reason!)
Here's a video of 1,700 time steps, with 20x speed-up.
What you see in this simulation is an ecosystem that provides a positive environment for both Defenders and Attackers. That is, they both have consistently positive payoffs (see bar graph, center left).
While the overall trends of payoffs are pretty clear (bottom graph), there is an "unruly" back and forth between attackers and defenders. Crucially, the time series of payoffs is non-stationary for all agents (see center graphs, third and fourth from the top). Simply, non-stationary means that the probability distribution for each payoff changes over time. You can see a sample distribution of payoffs in the two histograms, center right. You'll notice them changing shape (going from skew to symmetric) and also changes in mean and standard deviation ("SD"). Non-stationarity has implications for risk estimation, as I will detail in the up-coming WEIS paper.
In terms of progress toward the goal, I would say this is not yet a model of cyber security investment. It models competitive relationships rather than not host-parasite relationships which I believe are close to the true nature of cyber security ecosystems. The good news is that I believe I know what extensions and modifications need to be made. I'll save that for a later post.
Here are some key features of this version of the model:
Three levels of investment: 1) architecture/infrastructure; 2) capabilities; 3) practices/routines (a.k.a. "moves")
Asymmetric number and variety of "moves" for Defenders and Attackers
Parametric control over diversity of "moves" and investments by Defenders and Attackers
Yes, the model is getting complicated. But I hope this richness will be rewarded when crucial results are revealed in experiments. We shall see...
<update>
Here is the same run after 4,000 time steps. No sign of equilibrium or stationary time series.
Summary: Time and uncertainty are essential features of any model of the "game of cyber security". Models that do not include them as central features are not fit for purpose. But, yes, they do make life more difficult for modelers and their audiences. While I make the case that both are essential, I leave open the question as to what is the most parsimonious method or treatment.
This is first in a series of blog posts where I think out loud as I build a paper for WEIS 2016, and also a component for my dissertation.
The focus is on "investment" broadly defined. This means money invested in people, tools, infrastructure, processes, methods, know-how, etc. It also means architectural commitments that shape the business, technical, legal, or social aspects of cyber security for a given person or organization. All these investments provide the foundation for what a person or organization is able to do (i.e. their "capabilities") and the means of executing day-to-day tasks ("routines", "processes", "practices", etc.).
If cyber security investment is a strategic game between attackers and defenders, and among defenders, then what kind of game is it?
Summary
In simple terms, people tend to think of cyber security investment as being one of (at least) five types of games:
An optimization game, where each player finds the optimal level of spending (or investment) to minimize costs (or losses). This view is favored by Neo-classical Economists and most Game Theorists.
A collective wisdomgame, where the collective searching/testing activities of players leads to the emergence of a "collective wisdom" (a.k.a. "best practices") that everyone can then imitate. This view is favored by many industry consultants and policy makers.
A maturity game, where all players follow a developmental path from immature to mature, and both individual and collective results are improved along the way. This view is favored by many industry consultants.
A carrots-and-sticks game, where players chose actions that balance rewards ("carrots") with punishments ("sticks") in the context of their other goals, resources, inclinations, habits, etc. This view is favored by some Institutional Economists, and some researchers in Law and Public Policy. It is also favored by many people involved in regulation/compliance/assurance.
A co-evolution game, where the "landscape" of player payoffs and possible "moves" is constantly shifting and overall behavior subject to surprises and genuine novelty. This view is favored by some researchers who employ methods or models from Complexity Science or Computational Social Science. This view is also a favorite of hipsters and "thought leaders", though they use it as metaphor rather than as a real foundation for research or innovation.
But what kind of game is cyber security, really? How can we know?
These questions matter because, depending on the game type, the innovation strategies will be very different:
If cyber security is an optimization game, then we need to focus on methods that will help each player do the optimization, and to remove disincentives for making optimal investments.
If cyber security is a collective wisdomgame, then we need to focus on identifying the "best practices" and to promote their wide-spread adoption.
If cyber security is a maturity game, then we need to focus on the barriers to increasing maturity, and to methods that help each player map their path from "here" to "there" in terms of maturity.
If cyber security is a carrots-and-sticks game, then we need to find the right combination of carrots and sticks, and to tune their implementation.
Finally, if cyber security is a co-evolution game, then we need to focus on agility, rapid learning, and systemic innovation. Also, we should probably NOT do some of the strategies listed in 1) through 4), especially if they create rigidity and fragility in the co-evolutionary process, which is the opposite of what is needed.
How fast does the space of possibilities expand? This question is explored in the following paper (free download):
Tria, F., Loreto, V., Servedio, V. D. P., & Strogatz, S. H. (2014). The dynamics of correlated novelties. Nature Science Preport, 4. (http://dx.doi.org/10.1038/srep05890)
From the abstract:
Novelties are a familiar part of daily life. They are also fundamental to the evolution of biological systems, human society, and technology. By opening new possibilities, one novelty can pave the way for others in a process that Kauffman has called “expanding the adjacent possible”. The dynamics of correlated novelties, however, have yet to be quantified empirically or modeled mathematically. Here we propose a simple mathematical model that mimics the process of exploring a physical, biological, or conceptual space that enlarges whenever a novelty occurs. The model, a generalization of Polya's urn, predicts statistical laws for the rate at which novelties happen (Heaps' law) and for the probability distribution on the space explored (Zipf's law), as well as signatures of the process by which one novelty sets the stage for another.
I've written a NetLogo program to replicate their model, available here. The code for the model is quite simple. A majority of my code is for a "pretty layout", which is a schematic version of a "top-down view" of the urn. Here's a video of a single run
Full screen with controls. (click to enlarge)
The charts on the top and center right show the frequency distribution by ball type (a.k.a. "color"). These are log-log plots, so a straight line (declining) is signature of a power law distribution, while a gradually curving (concave) is signature of lognormal or similar distribution with somewhat thinner tail. Sharply declining curve is signature of a thin tailed distribution such as Gaussian.
So what?
This model will be useful in my dissertation because I need mechanisms to endogenously add novelty -- i.e. expand the possibility space based on the actions of agents in the simulated world, and not simply as external "shocks".
This is essential for modeling cyber security because some people claim that quantitative risk management is impossible in principle because of intelligent adversaries who can generate and exploit novel strategies and capabilities.
Say you are an entrepreneurial sort of person who wants to really change the world of cyber security. Problem: nobody seems to know where the game-changing innovation is going to come from. Is it technology? Is it economics? Is it law and policy? Is it sociology? Maybe combination, but what? And in what sequence?
If you aim for institutional innovation, then at some point you are going to need to take sides in the great "Quant vs. Non-quant" debate:
Can cyber security and risk be quantified?
If "yes", how can quantitative information be used to realize security to significantly improve outcomes?
Whether you choose Quant or Non-quant, you will need some tools and methods to advance the state of the art. But how do you know if you are choosing the right tools, and using them well? (Think about the difference between Numerology and Calculus as they might be applied to physics of motion.)
Whoever makes sufficient progress toward workable solutions will "win", in the sense of getting wide-spread adoption, even if the other is "better" in some objective sense (i.e. "in the long run").
I examine this innovation race in a book chapter (draft). The book will probably come out in 2016.
Abstract:
"The focus of this chapter is on how the thoughts and actions of actors coevolve when they are actively engaged in institutional innovation. Specifically: How do innovators take meaningful action when they are relatively ‘blind’ regarding most feasible or desirable paths of innovation? Our thesis is that innovators use knowledge artifacts – e.g. dictionaries, taxonomies, conceptual frameworks, formal procedures, digital information systems, tools, instruments, etc. – as cognitive and social scaffolding to support iterative refinement and development of partially developed ideas. We will use the case of institutional innovation in cyber security as a way to explore these questions in some detail, including a computational model of innovation."
Your feedback, comments, and questions would be most welcome.
The computational model used is called "Percolation Models of Innovation". Here is the NetLogo code of the model used in the book chapter. Below are some figures from the book chapter.
Innovation as percolation. Progress moves from bottom to top. Each column is a "technology",
and neighboring columns are closely related. This version (S&V 2005) only models
rate of progress and distribution of "sizes", not anything about the technology or
trajectory of innovation.
A screen shot of the user interface. Three different models can be selected (upper left).
I have written a NetLogo version of the random game model of Galla & Farmer (2012) (free download). It has been uploaded to the NetLogo community library and should appear in a day or so. Read on if you are interested in Game Theory, esp. learning models and computational methods.
Chaotic dynamics in a complicated game. The payoffs are negatively correlated (-0.7) and memory for learning is long (alpha ≈ 0). Notice the squiggly lines in the time series plots (lower right). Each line is probability for a given move.
If the game were in equilibrium, these lines would be flat. (click for larger image)
Fair warning: it is long -- 72 pages not including Glossary and Bibliography. Being academic work, it will not be 'light reading' for many readers. I have done my best to be clear and direct, but the subject matter is complicated.
Spoiler alert: I don't propose to solve the Cyber Security Problem(tm) in my research. Instead, I'm studying the process of innovation that might, eventually, lead to new solutions, especially institutional innovations. Some readers might find this boring, irrelevant, or 'ivory tower'.
Feedback is most welcome. If you don't have my email address, ping me on Twitter.
I'm presenting today at the 6th Annual Complexity in Business Conference, sponsored by the University of Maryland Center for Complexity in Business. Here are my slides. (FYI: no information security content here, unless you are interested in institutional innovation.)
If you are really, really interested in this topic and want all the details and references, here is a paper I just completed for a Directed Reading class (89 pages, PDF). It's a little rough around the edges due to time constraints.
I'd like to do Frame Analysis (Goffman 1976, Johnston 1995) on a medium-sized corpus of text (articles, speeches, blog posts and comments) and I'm looking for NLP or text mining tools to help with it. Strangely, I can't find anything. All the examples of frame analysis in published research (e.g. Nisbet 2009) use purely manual methods or computer-augmented manual analysis.
Frame Analysis requires sophisticated semantic analysis, filtering, situational understanding, and inference on missing text. Near as I can tell, this level of sophistication is beyond the grasp of the common NLP and text mining tools. Is this true? If not, do any of you know of fully automated tools for Frame Analysis?
I should add that I have two use cases. First, the most demanding, is automatic identification of frames followed by text classification. Second, more feasible, is automatic classification of texts given frame definitions and sample texts. The latter fits the classic machine learning model of supervised learning, so I assume that as long as my training set is large enough and representative enough, I can probably find an adequate ML classification algorithm.
[Edit 7/23/2013: This is the best summary I could find of available tools: Frame Analysis: Software]
__________
Goffman, E. (1976). Frame Analysis: An Essay on the Organization of Experience. Harvard University Press.
Johnston, Hank (1995). A methodology for frame analysis: from discourse to cognitive schemata. In Social Movements and Culture (pp. 217–246). University of Minnesota Press.
Nisbet, M. C. (2009). Communicating Climate Change: Why Frames Matter for Public Engagement, Environment. Science and Policy for Sustainable Development, 51(2): 12–23.
Given that I'm a student in the first-ever Department of Computational Social Science, I strongly agree with Nicholas Christakis in his New York Times article "Let’s Shake Up the Social Sciences". I especially like the points he makes regarding teaching social science students to do experiments early in their education process.
I'm back in California after two wonderful weeks at Summer School in Trento, Italy. I learned many things, both great and small. One of them was resolving the mystery as to the organization of PhD dissertations in economics and management. In engineering, computer science, and sociology, dissertations are generally organized as a report on a one project -- a cohesive whole. In contrast, many or most dissertations in economics and management are collections of "essays", usually numbering three. For a long time, I couldn't figure out why. Now I know.
The driving force is the hiring criteria in the academic job market in economics and management. I was told by a professor that, to even get an interview at a top university, an applicant had to have one or more publications in a high ranking journal, and that having many conference publications or a top-quality dissertation were not enough. Therefore, from the start of the dissertation process, candidates are guided toward journal publication, even at the expense of fully researching the thesis as is done in engineering, computer science, and sociology.
Another reason, I suspect, is a shortage of post-doc positions in economics and management, particularly the latter. I don't have any data to back this up, so maybe I'm wrong, but it seems that PhDs in management are pushed into the job market for tenure-track positions immediately after completing their dissertations. If this is so, then it would explain why they would be structuring their dissertation as a collection of three "publishable units".
I imagine that many golfers believe they would play their best golf at Augusta National (home of the Masters). Maybe many musicians believe they would perform their best at Carnegie Hall. For me, I'm inspired in my work by grand reading rooms in libraries. I'm lucky to be able to use the Stanford Green Library's Lane Reading Room. It has a nice hallway with vaulted ceilings, which is a good place for monk-like pacing.
A place for pacing
(click for larger image in new window)
As nice as this is, my Dream Work Space might be the Library of Congress Reading Room. I visited there last week to get two hard-to-find books. I only spent a few minutes in the Reading Room itself before going into the copy room. But I took a moment to imaging what it would be like as a daily work space. Yowwza!
Library of Congress Reading Room.
View from above (click for larger image in new window)
View from the floor. I'm sure I could think great thoughts here!
(Click to view larger image in new window)
