Hacker News Reader

Comment by jldugger | Hacker News Reader

There's a huge problem with risk models: probabilities. What's the probability of data disclosure via FREAK, and how does that compare with the potential loss of data via RAID6 failure?

I.e. how much should I and my manager worry about a given vulnerability, and how do I balance addressing vulns with the core business need to serve customers?

View on HN

I agree. As per Taleb (Antifragile) if you adopt conventional perspective of "probability" you will be bitten by the occurrence of the apparently improbable. Downside (here called "impact") is much easier to assess/predict, and compare against "upside", which in the case of taking infosec risks could be e.g. saved implementation cost.

Probability is more of a distraction. Probably.

I haven't read antifragile, and its been a while since he's made the book interview rounds. If I recall his point correctly, it's that antifragile systems need to be able to fail, and grow from them. If we design to minimize the impact of any such failures, the system as a whole is considered reliable.

The problem with applying this to IT security is that I see no way to lower the impact. With hard drives, we use RAID to build a more resilient system from unreliable components. It seems harder to do that with the concept of customer passwords, credit card numbers and SSNs and still have a system the accountants can use to reliably file earnings reports.

Reply on news.ycombinator.com