3 ms·

You are wrong to focus on 300M. That's the cost of dealing with consequences of an attack, not the cost of measures that would have prevented it. So, you're rig

by aj3 6y ago

You are wrong to focus on 300M. That's the cost of dealing with consequences of an attack, not the cost of measures that would have prevented it. So, you're right to say that attacking some businesses leads to >10 ROI for an attacker (actually much higher ROI are quite common although with lower thresholds), but that's only assuming that these businesses do not invest into proper protections ahead of the attack. The whole point of InfoSec is to find the right balance of investment into preventive measures and incident response teams so that the cost/risk/reward ratios of an attack make it non viable for economically motivated attacker.

Veserv 6y ago
I agree with your statement on the point of infosec. I disagree that any particular infosec organization is equipped to deal with problems of this class in any meaningful way. In fact, it is so far off as to be mind-boggling and probably criminally irresponsible. To this end, I will clarify what I meant. I believe that an attack funded on the order of $30M would be able to do $300M in damages to Maersk even if Maersk adopted best-in-class preventative measures and implemented them as a primary focus with support from management at all levels. An attack, able to do $300M in damages that Maersk can not prevent after we have assumed it already did the best it possibly can, should be able to support a $100M extortion payment. This is an ROI of 3 for an attacker with high threshold and an ROI of 3 for Maersk, so I think this is a valid assessment. So, a counterargument/example is an organization where an attack funded on the order of $30M can not impact operations by more than 1%. I chose the number of 1% because Maersk has a revenue of $39B, so a $300M attack is only ~1% reduction in company output. I hope this clarifies my statement. I also stated in a different response that I believe that the number of $30M attacks that could do $300M in damages probably exceeds Maersk's profit if they paid for all of them at $30M, let alone paying extortion at $100M or having the attack follow through at the cost of $300M. Therefore, in the long run the potential market size is enough to destroy Maersk. As a mildly related note, if anybody here is a member of the infosec community I have a question: How much do you think it would cost for a targeted attack to breach and cause significant damage to the best system you have every personally observed? How did you verify that number? Three pentests by three different competent companies paid that amount and that found no vulnerabilities of note would be convincing. I would likely find other things on that general level convincing, but I can not declare them off-hand.
- aj3 6y ago
  > I disagree that any particular infosec organization is equipped to deal with problems of this class in any meaningful way. FAANGs are bigger targets and yet none of them suffered anything remotely similar. > An attack, able to do $300M in damages that Maersk can not prevent after we have assumed it already did the best it possibly can, should be able to support a $100M extortion payment. That's incorrect. I already mentioned it in another reply, but in short it does not matter that attack caused 300M in damages. What matters is how much Maersk could possibly save by paying out ransom. And that's a fraction of those 300M not even including secondary effects such as potential problems with tax office, reputational damage or having to deal with becoming a target #1 for every other ransomware crew out there - as they just proved that they are ok with paying out for such "unsolicited penetration tests". It also misses that even if Maersk payed out 100M, criminals wouldn't have any way to actually benefit from all of that, as laundering such amount of BTC isn't trivial and historically that's exactly the step with highest risk for the criminals. > How much do you think it would cost for a targeted attack to breach and cause significant damage to the best system you have every personally observed? That's a non-answerable question as it does not mention other resources that are available to attacker besides pew-pew internet weapons, restrictions that they potentially face, the risk they are comfortable with, and basically all of these questions applied to the defensive side as well (i.e. on a furthest side of the spectrum there are certain systems, attacking which would put you above ISIS leaders on a to-be-droned-soon list).
  - Veserv 6y ago
    That is not an unanswerable question at all. To clarify, I am literally asking for a simplified threat model. Take an existing threat model, reduce it to cost of doing those actions, done. Order of magnitude is fine. If there are parameters, pick a set of parameters within the non-totally-stupid range and state them. Estimate when reasonable. The question is just me looking for broad strokes anecdotes.
    - aj3 6y ago
      > To clarify, I am literally asking for a simplified threat model. That's a simplification beyond any usefulness. You wouldn't be able to do as much damage with $100k budget in a few months as a well-staffed national agency in a week. > The question is just me looking for broad strokes anecdotes. Even Jeff Bezos wouldn't be able to orchestrate a cyberattack that crashes International Space Station with astronauts aboard.

by aj3 6y ago

Veserv 6y ago

I agree with your statement on the point of infosec. I disagree that any particular infosec organization is equipped to deal with problems of this class in any meaningful way. In fact, it is so far off as to be mind-boggling and probably criminally irresponsible. To this end, I will clarify what I meant. I believe that an attack funded on the order of $30M would be able to do $300M in damages to Maersk even if Maersk adopted best-in-class preventative measures and implemented them as a primary focus with support from management at all levels. An attack, able to do $300M in damages that Maersk can not prevent after we have assumed it already did the best it possibly can, should be able to support a $100M extortion payment. This is an ROI of 3 for an attacker with high threshold and an ROI of 3 for Maersk, so I think this is a valid assessment. So, a counterargument/example is an organization where an attack funded on the order of $30M can not impact operations by more than 1%. I chose the number of 1% because Maersk has a revenue of $39B, so a $300M attack is only ~1% reduction in company output. I hope this clarifies my statement. I also stated in a different response that I believe that the number of $30M attacks that could do $300M in damages probably exceeds Maersk's profit if they paid for all of them at $30M, let alone paying extortion at $100M or having the attack follow through at the cost of $300M. Therefore, in the long run the potential market size is enough to destroy Maersk. As a mildly related note, if anybody here is a member of the infosec community I have a question: How much do you think it would cost for a targeted attack to breach and cause significant damage to the best system you have every personally observed? How did you verify that number? Three pentests by three different competent companies paid that amount and that found no vulnerabilities of note would be convincing. I would likely find other things on that general level convincing, but I can not declare them off-hand.

aj3 6y ago
> I disagree that any particular infosec organization is equipped to deal with problems of this class in any meaningful way. FAANGs are bigger targets and yet none of them suffered anything remotely similar. > An attack, able to do $300M in damages that Maersk can not prevent after we have assumed it already did the best it possibly can, should be able to support a $100M extortion payment. That's incorrect. I already mentioned it in another reply, but in short it does not matter that attack caused 300M in damages. What matters is how much Maersk could possibly save by paying out ransom. And that's a fraction of those 300M not even including secondary effects such as potential problems with tax office, reputational damage or having to deal with becoming a target #1 for every other ransomware crew out there - as they just proved that they are ok with paying out for such "unsolicited penetration tests". It also misses that even if Maersk payed out 100M, criminals wouldn't have any way to actually benefit from all of that, as laundering such amount of BTC isn't trivial and historically that's exactly the step with highest risk for the criminals. > How much do you think it would cost for a targeted attack to breach and cause significant damage to the best system you have every personally observed? That's a non-answerable question as it does not mention other resources that are available to attacker besides pew-pew internet weapons, restrictions that they potentially face, the risk they are comfortable with, and basically all of these questions applied to the defensive side as well (i.e. on a furthest side of the spectrum there are certain systems, attacking which would put you above ISIS leaders on a to-be-droned-soon list).
- Veserv 6y ago
  That is not an unanswerable question at all. To clarify, I am literally asking for a simplified threat model. Take an existing threat model, reduce it to cost of doing those actions, done. Order of magnitude is fine. If there are parameters, pick a set of parameters within the non-totally-stupid range and state them. Estimate when reasonable. The question is just me looking for broad strokes anecdotes.
  - aj3 6y ago
    > To clarify, I am literally asking for a simplified threat model. That's a simplification beyond any usefulness. You wouldn't be able to do as much damage with $100k budget in a few months as a well-staffed national agency in a week. > The question is just me looking for broad strokes anecdotes. Even Jeff Bezos wouldn't be able to orchestrate a cyberattack that crashes International Space Station with astronauts aboard.