Look Papa! I'm on the Loopcast! -- Talking complexity, simulation, black swans, randomness, resilience, and institutional innovation

If you have a spare 1 hr 40 min. *, you might want to listen my interview on the "Loopcast" podcast (below).  The host is Sina Kashefipour (@rejectionking on Twitter).

* Personally, I think I sound better at 1.5X speed, but then again I listen to most podcasts at 1.5X speed.



In this podcast, I reference the following websites and resources:

• Santa Fe Institute -- birthplace of Complexity Science.  SFI on YouTube, and "Complexity" podcast.
• Complexity Explorer -- coursework and resources for the study of complex systems,
• NetLogo -- a free and open source platform for agent-based modeling and dynamical systems.
• Ignorance and Uncertainty  -- book by Michael Smithson, out-of-print but available used
• Uncertainty and Risk: Multidisciplinary Perspectives -- editors Gabriele Bammer and Michael Smithson 

 

S4x20 Video: Lessons Learned from Norsk Hydro on Loss Estimation and Cyber Insurance

I gave a talk at S4X20 in January on the Norsk Hydro ransomware attack.  The full video has now been posted on YouTube:




Like all great presentations, it includes a Seinfeld reference :-)

Presentation: Navigating the Vast Ocean of Browser Fingerprints

Here a PDF version of my BSides San Francisco presentation. (Today, Monday at 4:50pm)

COMING SOON:  GitHub repo with Python and R code, plus sample data.  Watch this space.

B-Sides LV slides

Here are my slides for today's B-Sides Las Vegas talk (5pm Wednesday).  I'll be demoing the B-Sides SF spreadsheet (see previous post).  A video of the talk will be available on Archive.org in a day or so.

B-Sides SF Talk

Here is the demo spreadsheet I'll be using in today's B-Sides SF talk on the Thomas Scoring System (TSS):

• InfoSec Maturity Assessment (TSS) V1.xlsx

Download the spreadsheet and open in Microsoft Excel 2008 or later.  It uses conditional formatting and cell data validation, but no macros or other advanced features.  The sheets are protected to avoid data entry errors, but there is no password.

This is a realistic, fully functional implementation of the TSS applied to a general case: scoring the maturity of a company's information security capability.

Presentation: Topological View on Radical Innovation

I'm presenting today at the 6th Annual Complexity in Business Conference, sponsored by the University of Maryland Center for Complexity in Business.  Here are my slides.  (FYI: no information security content here, unless you are interested in institutional innovation.)

If you are really, really interested in this topic and want all the details and references, here is a paper I just completed for a Directed Reading class (89 pages, PDF).  It's a little rough around the edges due to time constraints.

SIRAcon presentation

I'm presenting at SIRAcon today: "How to aggregate ground-truth metrics & indicators into a performance index".  It will be recorded and will be available to SIRA members on the SIRA web site.  Here are the slides.  Here is the blog post with background and tutorial.

Video interview with BankInfoSecurity, plus "Down the Rabbit Hole" podcast episode

Here's a 12 minute interview of me by Tracy Kitten (@BnkInfoSecurity), filmed at the RSA Conference last week:

(click to open a new page for www.bankinfosecurity.com with video)

Topics discussed:

• The difference between "performance" and "best practices"
• How big data is expected to revolutionize information security (some myth busting)
• Where innovation will be coming from, and where it won't
• Why encouraging security professionals to pursue training in statistics and data visualization is so critical

---

But wait...there's more!  Here's a link to episode 82 of the Down the Rabbit Hole podcast, where I'm a guest along with Bob Blakely and Lisa Leet.  (Here's the podcast itself in mp3 file format -- 43:15 in length.) From Rafal's summary, here's what we talk about:

• Does is make sense, in a mathematical and practical senes, to look for 'probability of exploit'? 
• How does 'game theory' apply here? 
• How do intelligent adversaries figure into these mathematical models? 
• Is probabilistic risk analysis compatible with a game theory approach? 
• Discussing how adaptive adversaries figure into our mathematical models of predictability... How do we use any of this to figure out path priorities in the enterprise space? 
• An interesting analogy to the credit scoring systems we all use today 
• An interesting discussion of 'unknowns' and 'black swans' 
• Fantastic practical advice for getting this data-science-backed analysis to work for YOUR organization

Quick links to "Ten Dimensions" resources for #RSAC folks

This post is aimed at folks attending my RSA Conference talk on Wednesday, but could be useful for anyone who wants to catch up on the topics.

My talk is at 10:40am - 11:00am in Moscone West, Room: 2020.  Immediately after the talk, I'll be moving to the "Continuing the Conversation" space in the 2nd floor lobby of Moscone West.  I'll be wearing a black EFF hat, in case you want to pick me out of a crowd.

This is 20 minute talk, so it will only be an introduction to the topics.  My main goal is to stimulate your interest to learn more and to dig into these resources:

• RSAC slides: "Ten Dimensions of Security Performance for Agility and Rapid Learning"
• New blog post: "How to aggregate metrics into a performance index or score" (Thomas Scoring System, TSS) -- detailed tutorial
• New demo Excel spreadsheet for TSS, explained in the previous blog post
• Intro page to the Ten Dimensions, with links to all detail pages: "Ten Dimensions of Cyber Security Performance"

Not directly related to the above, but here's the slides for the talk I gave Monday at BSides-SF:

• "Get a Grip on Unintended Consequences" -- best in PPTX so you can read the stories in the speaker notes.  Here's an audio recording, starting at 4:17:24.  (FYI, Adam Shostack gave a nice talk in the hour before me on Threat Modeling.)

If we don't connect at the conference for some reason, feel free to email me at russell ♁ thomas ❂ meritology ♁ com.  (Earth = dot; Sun = at)

And if you've come this far and you aren't following me on twitter -- @MrMeritology -- what's wrong with you?  Follow, already! ☺

#BSidesSF Prezo: Getting a Grip on Unexpected Consequences

Here are the slides I'm presenting today at B-Sides San Francisco (4pm).  I suggest that you download it as PPTX because it is best viewed in PowerPoint so you can read the stories in the speaker notes.

"How Complex Systems Fail" Richard Cook, 30min video

This is a wonderful 30 minute lecture that should be interesting to anyone in information security, risk management, operations, and especially CIOs and CISOs.  He gives very good explanations about why agility and learning are so important to resilience.

Guest on "Data-driven Security Podcast" Ep. 1

I was a guest on the new Data-driven Security Podcast, episode 1.  There's the usual audio and also a video (1 hour 15 minutes).  Along with hosts Bob Rudis and Jay Jacobs, I joined Michael Roytman and  Alex Pinto for a lively conversation about how we all got into the data analysis side of information security and where we see it going.

The podcast and also the web site and blog are associated with a new book with the same title, Data-driven Security, authored by Bob and Jay. I was technical editor, so I can honestly say that I've read the whole book. I heartily recommend it to any information security professional or manager. It is a perfect "on-ramp" into data science and visualization as applied to information security, and it's written in your language.

Several pieces of good news

Sorry I haven't posted in a while.  I've been pretty busy with research work -- writing papers for conferences, mostly.  But I've got some good news to report.

Cash will be flowing as nature intended.

First, I'm starting a full-time job at a Financial Institution* with the title Security Data Analyst/Scientist, which I choose to shorten to Security Data Scientist.  This is a big deal on many levels.  One of  the best things is that their capabilities are comparatively mature and the leadership is both visionary and pragmatic.  This means that I hope to do some fairly compelling analysis drawing on some rich data sources and previous analysis rather than having to start from scratch.

(* My Twitter followers will know.)

I'm continuing my PhD program part-time, with focusing on my dissertation.  I hope to complete that in 2014.

Also, I'll continue blogging here on all the same topics.

Second, I'm very happy to say that I've had a talk accepted at the RSA Conference in February 2014, co-presenting with David Severski:

10 Dimensions of Security Performance for Agility & Rapid Learning
2/26/2014, 10:40 AM - 11:00 AM

Abstract: Information security is an innovation arms race. We need agility and rapid learning to stay ahead of adversaries. In this presentation, you'll learn about a Balanced Scorecard method called the Ten Dimensions of Cyber Security Performance. Case studies will show how this approach can dramatically improve organization learning and agility, and also to get buy-in from managers and executives. 

This is a 20 minute time slot, and there's no way that I can compress my 60 minute or 45 minute versions of "Ten Dimensions" into such a short time.  Therefore, David and I are going to cook up an extended "trailer" that conveys the basic idea of double loop learning in practice (David is doing some neat stuff that we'll try to "fly through").  In parallel, I hope to have some videos, webinar, or other media that people can go to in order to get a proper introduction and survey.

Also, I've proposed a peer-to-peer session at RSA on a related theme: "Building a Quantitative Evidence-based Security & Risk Management Program".  I should hear later in November whether it's been accepted.  It will be an hour long session and I will only be facilitating, but it should be a good time for Q&A, sharing insights, etc.

Finally, I'll be presenting a SIRA webinar "Big 'R' Risk Management - from concept to pilot implementation".  This is basically the same talk I gave at SIRAcon, but some people couldn't attend that session (we had parallel tracks) and many people couldn't attend SIRAcon at all.  I think it'll be in December, but there isn't a date set yet.

I've got some good blog posts in the works, including Game Theory Meets Risk Analysis, several more Shades of Black Swans, a review of RIPE, some philosophy, and others.   Thanks for reading and thanks for your comments, both here and in other media.

--------

One more bit of good news from a completely different domain: the book Chasing Chariots is coming soon!  Includes most of the papers presented at the First International Chariot Conference held in Cairo in December 2012.  The evolution of technology in the Late Bronze Age became an strong interest (a.k.a. compulsion) of mine a couple years ago, with particular focus on the so-called "first revolution in military affairs" -- the war chariot.  Beyond just curiosity, I'd like to do some serious research in this area, but short of getting a second PhD, the only way it's going to happen is if I can find some collaborators (after I graduate!).

Periodically, I'll post some war chariot stuff here.  Bruce S. has his squids;  I have my war chariots.

preso: Big 'R' Risk Management - from concept to pilot implementation

Here's the presentation (pdf) that I'm giving Monday at SIRAcon in Seattle.  This extends the ideas presented in the post "Risk Management: Out with the Old, In with the New!". This presentation presents some specifics on how to get started implementing the Big 'R' approach. It's even got a illustrative case toward the end featuring patch management and exceptions, shown in this figure (click to enlarge)

Example of Causal Dynamic Analysis, in this case Patch Management & Exceptions
(click to enlarge)

Preso: Does DOE Distort CleanTech VC Co-investment Networks? (A: No)

Here's the presentation I gave today at the Atlanta Conference on Science and Innovation Policy:

• Does US Dept of Energy (DOE) Distort CleanTech VC Co-investment Networks? - A Social Network Analysis

Here's a few highlights.

I'm presenting at SIRAcon Oct 21, Seattle WA

SIRAcon - registration
Monday, October 21, 2013

Bell Harbor Conference Center
Pier 66
Seattle, WA 98121

You won't find any conference with a higher concentration of bright, forward-thinking InfoSec risk folks than SIRAcon.

________________

Title: Big ‘R’ Risk Management (the “Modern Approach”) — From Concept to Pilot Implementation

Abstract:
Big ‘R’ Risk Management is also known as the Modern Approach to Operational Risk.  It’s a very different approach to probabilistic risk analysis.  Instead of trying to quantify the risk of individual threat + vulnerability + consequence combinations, the focus is on quantitative estimation of the factors that drive aggregate risk at a business unit or enterprise level.  While it’s been described in concept,  there isn’t much information on implementation.

As introduction, the presentation will start with an overview of the Modern Approach and the generic steps in the analysis and decision-making.  The rest of the presentation will be a walkthrough of one or two illustrative cases to show how it would be implemented in practice, especially in a pilot or a proof-of-concept.

The main takeaway will better understanding of the viability of the Modern Approach and practical guidance on how to get started on it via a pilot implementation.

Movie plot: 2017 Texas Heat Wave (EnergySec Summit presentation)

I'm presenting tomorrow at the EnergySec Summit in Denver, 2:15 to 2:50pm.  If you are attending, come and say "hi". Since it's such a tight time slot, the pace of presentation will be pretty fast.  Therefore you might want to preview my presentation in advance or have it open while I'm presenting:

• presentation: How to Build Your Own Cyber Security Framework using a Balanced Scorecard (pdf)

This is the Ten Dimensions of Cyber Security Performance but I'm using a different presentation approach than in the blog posts or my Bsides-LA presentation. As a dramatic device, I'm using a "movie plot" to help the audience imagine how the Ten Dimensions would make a difference once they are implemented.

As you might already know, I won Bruce Schneier's Sixth Annual Movie Plot Threat contest. This movie plot was constructed using a similar approach and methods. My main goal was to stretch the imagination of the audience by emphasizing a threat and attack scenario that isn't often considered, but yet is very plausible -- namely business partners as threat agents. I also wanted a scenario that was not a typical attack with typical consequences, but yet was serious at a system level.

[Edit: shout out to Andy Bochman who just wrote this post on the value of a compelling story to boost awareness and understanding. Great minds think alike!]

As the 2017 heat wave extended into it’s third week, "Monkey’s Uncle" had netted
Gold Man Hacks almost $300 million in bonus payments, with no end in sight.

If any of the microgrid operators had noticed their anomalous wholesale transactions
and was sufficiently capable to do a proper investigation…

First Presentation of "Ten Dimensions..." at BSides-LA

I had fun on Friday presenting the "Ten Dimensions of Cyber Security Performance" at BSides-LA.  This is the first time I presented it in a general forum, so I was looking forward to see how it would "fly" and to see what reactions it would get.

On the plus side, several people were pretty excited and I had some great discussions afterward.  Also, I got most of the presentation done in the available time, but I still have more tuning to do.

On the down side, there weren't as many people in my session as I had hoped.  It was one of the last sessions on the last day, so that probably had an impact.  Or maybe the headline or topic wasn't widely interesting.  But the people who were there were interested and engaged, which is what matters most.

But for a first presentation, I felt it was successful.

Here are the slides.  View in full screen mode to enjoy the animations.

Guest on the Risk Science Podcast

On Episode 3 of the Risk Science Podcast, I had a nice conversation with my friends Jay Jacobs and Ally Miller.  The topics included on the balance in simplifying complexity, the need to get more industry people involved in the WEIS conference (as participants and presenters), writing winning movie plots about cyber war, and the learning curve for R.

In case you don't recognize it, the Risk Science Podcast (@Risksci on twitter) is new and improved.  Previous iterations were the Risk Hose Podcast, and before that, the SIRA Podcast.

I'm presenting at EnergySec Summit Sept. 17-19 in Denver, CO

I just received acceptance notice to present at the EnergySec Summit Sept. 17-19 in Denver, CO.  Here's the title and abstract:

How to Build Your Own Cyber Security Framework using a Balanced Scorecard

Two aspects of cyber security that everyone struggles with are metrics and business impact – How do we measure it to improve? and How do we make it meaningful to business decision makers? This gap appeared again recently in the NIST Cyber Security Framework (CSF) process RFI responses.  But there is no need to wait for NIST CSF or anything else because there is a viable method available now that you can use to build your own CSF – namely the “Balanced Scorecard” method.   

The key idea is to focus on performance against measurable objectives in all critical dimensions that, taken together, will lead to better security, privacy, and resiliency outcomes, even in a dynamic and highly uncertain threat environment. 

In this presentation, I’ll explain the ten critical dimensions of cyber security performance, explain how they are interrelated and feed off each other, show how to create a performance index in each dimension, and describe how the balanced scorecard can be used to drive executive decisions.  This presentation should be valuable to managers and executives in every type of organization in the energy sector, including the supply/service chain.  Consultants, regulators, and academics should also find it interesting and useful.

I'll be blogging about this topic in the coming days and weeks.