際際滷

際際滷Share a Scribd company logo

RSA Security Conference 2013: Thin Slicing a Black Swan

Michele Chubirka
Michele Chubirka

As infosec professionals we are swimming in prodigious amounts of data, but it isnt making us better at our jobs, it seems to make us worse. In Verizons 2012 Data Breach Investigations Report, it was found that across organizations, an external party discovers 92% of breaches. We continue to desperately grasp at that straw of, more data, but what if this is simply information gluttony? Incident response's bloated model drives it closer to a form of security archeology rather than its promise of real-time relevance.

1 of 19
THIN SLICING A BLACK SWAN: A SEARCH FOR THE UNKNOWNS Michele Chubirka Transaction Network Services/ Packetpushers.net Session ID: MASH-足F41A Session Classification: Intermediate
Somethings Broken In Verizons 2012 Data Breach Investigations Report, it was found that across organizations, an external party discovers 92% of breaches.
From Compromise To Discovery 財 We believe we can solve the issue of the unknowns, intrusions, with more data. 財 The more information we have, the less we know. 財 This makes us no better than security archeologists.
The Black Swan Event 財 An unknown unknown. 財 Cant be predicted by probability theories. 財 Rationalized after the fact. 財 How often do we try to predict the Black Swan Event in security and fail?
Information Gluttony? Military drone operators amass untold amounts of data that never is fully analyzed because it is simply too much. Michael W. Isherwood, defense analyst and former Air Force fighter pilot.
Digital Kudzu ≒ From beginning of recorded time to 2003 - five exabytes of information. ≒ 2011 - that much created every two days. ≒ 2012 - prediction is every 10 minutes.
Current Solutions 財 SIEMs: never gets fully implemented. 財 Predictions using Logistic Regression/Bayesian Probability. 財 Huge amounts of data, not enough time. 財 Open world problem using closed world assumptions. 財 More staff, more money.
Alternative Model: Thin Slicing the ability of our unconscious to find patterns in situations and behavior based on very narrow slices of experience. Malcolm Gladwell, Blink
Case Study: A Hospital in Trouble 財 Cook County Hospital struggled with identifying patients in danger of an imminent heart attack. 財 Coronary care unit was overwhelmed. 財 Public hospital, limited resources.
Applied Thin-Slicing 財 Lee Goldman, a cardiologist, created a protocol based upon an algorithm developed in partnership with mathematicians. 財 After two years of using a decision tree, hospital staff were 70% more effective at recognizing patients at risk. 財 Less information led to greater success. 財 Technique used by first-responders every day.
Fast and Frugal Trees 320 LUAN, SCHOOLER, AND GIGERENZER a ST segment b change? Did prosecution request conditional bail or oppose bail? No Yes Yes No or N.A. Coronary Punitive Chief complaint of Care Unit chest pain? Did previous court impose conditions or remand in custody? No Yes Yes No or N.A. Regular Punitive Nursing Bed Any other factor? Did police impose conditions or (NTG, MI, ST, ST, T) remand in custody? No Yes No or N.A. Yes Regular Coronary Nursing Bed Care Unit Nonpunitive Punitive Figure 4. Two examples of fast-and-frugal trees (FFTs) applied to large world problems. The left tree (a) is designed to help emergency room doctors decide whether to send a patient with severe chest pain to the Coronary Care Unit (CCU) or a regular nursing bed (Green & Mehr, 1997). The right tree (b) is a model of how British judges decide whether to make a punitive bail decision (Dhami, 2003). (1997) found that, compared with a logistic regression model that Tree models of categorization and decision making have been uses eight cues simultaneously to make a decision, this FFT had a studied in a variety of disciplines, such as medicine, applied higher overall predictive accuracy, in addition to its advantages in statistics, computer science, and psychology (e.g., Breiman, Fried-
Method: Resource Description Framework (RDF) 財 Semantic Web technology. 財 Queries based on relationships or mental associations. 財 Graphs treat each packet from capture file as a discrete event with properties. 財 TCP header info in a metadata model. 財 Model replicates human cognitive economy.
Thin-Slicing with SPARQL 財 SPARQL query language uses a concise approach for quickly traversing large data sets while capturing similarities between packets as generalizations. 財 RDF statement contains a subject, predicate and an object. 財 Subject defines the event. 財 Predicate defines a characteristic or property. 財 Object contains the value for the predicate.
Example: Building A Query sparql select * { ?s ?p ?o.}; sparql select *{ ?e1 <http://www.rrecktek.com/demo/src> ?ip1.};
Example ≒ All source IPs and their destination IPs. ≒ For each source, count how many times it went to a destination. ≒ Report source destination and count. sparql SELECT ?src ?dst (count (?dst) as ?count) { ?e1 <http://www.rrecktek.com/demo/src> ?src. ?e1 <http://www.rrecktek.com/demo/dst> ?dst. } ORDER BY DESC (?count);
SPARQL web interface
We Cant Fight All Unknowns 財 What we can do 財 Build strong infrastructures minimizing technical debt. 財 Add the equivalent of air bags to the architecture for when intrusions occur. 財 Recognize signature limitations. 財 Investigate the creation of real-time fast and frugal trees. Our patient is dying on the table. Its up to us to change the outcome.
Thanks! 財 Michele Chubirka Twitter @MrsYisWhy networksecurityprincess@gmail.com 財 RDF/SPARQL contribution courtesy of Ronald P. Reck rreck@rrecktek.com
References "Eclectic Tech." Semantic Web Introduction. N.p., n.d. Web. 20 Dec. 2012. Erwin, Sandra I. "Too Much Information, Not Enough Intelligence." National Defense Magazine. N.p., May 2012. Web. <http://www.nationaldefense.org>. Gigerenzer, Gerd. Gut Feelings: The Intelligence of the Unconscious. New York: Viking, 2007. Print. Gladwell, Malcolm. Blink: The Power of Thinking without Thinking. New York: Little, Brown and, 2005. Print. Luan, Shenghua, Lael J. Schooler, and Gerd Gigerenzer. "A Signal-detection Analysis of Fast-and- frugal Trees." Psychological Review 118.2 (2011): 316-38. Print. Marewski, Julian N., PhD, and Gerd Gigerenzer, PhD. "Heuristic Decision Making in Medicine." Dialogues in Clinical Neuroscience 14.1 (2012): 77-89. Print. Messmer, Ellen. "SANS Warns IT Groups Fail to Focus on Logs for Security Clues." TechWorld. IDG, May 2012. Web. "RDF." -Semantic Web Standards. W3C, n.d. Web. 02 Jan. 2013. "Resource Description Framework (RDF)Model and Syntax." RDF Model and Syntax. W3C, n.d. Web. 02 Jan. 2013. Rieland, Randy. "Big Data or Too Much Information?" Innovations. Smithsonian, 7 May 2012. Web. "Semantic Web Standards." W3C. W3C, n.d. Web. 02 Jan. 2013. Taleb, Nassim. The Black Swan: The Impact of the Highly Improbable. New York: Random House, 2007. Print. Turek, Dave. "The Case Against Digital Sprawl." The Management Blog. Bloomberg Businessweek, 2 May 2012. Web. Verizon 2012 Data Breach Investigation Report. Rep. N.p.: Verizon, n.d. Print.

More Related Content

RSA Security Conference 2013: Thin Slicing a Black Swan

  • 1. THIN SLICING A BLACK SWAN: A SEARCH FOR THE UNKNOWNS Michele Chubirka Transaction Network Services/ Packetpushers.net Session ID: MASH-足F41A Session Classification: Intermediate
  • 2. Somethings Broken In Verizons 2012 Data Breach Investigations Report, it was found that across organizations, an external party discovers 92% of breaches.
  • 3. From Compromise To Discovery 財 We believe we can solve the issue of the unknowns, intrusions, with more data. 財 The more information we have, the less we know. 財 This makes us no better than security archeologists.
  • 4. The Black Swan Event 財 An unknown unknown. 財 Cant be predicted by probability theories. 財 Rationalized after the fact. 財 How often do we try to predict the Black Swan Event in security and fail?
  • 5. Information Gluttony? Military drone operators amass untold amounts of data that never is fully analyzed because it is simply too much. Michael W. Isherwood, defense analyst and former Air Force fighter pilot.
  • 6. Digital Kudzu ≒ From beginning of recorded time to 2003 - five exabytes of information. ≒ 2011 - that much created every two days. ≒ 2012 - prediction is every 10 minutes.
  • 7. Current Solutions 財 SIEMs: never gets fully implemented. 財 Predictions using Logistic Regression/Bayesian Probability. 財 Huge amounts of data, not enough time. 財 Open world problem using closed world assumptions. 財 More staff, more money.
  • 8. Alternative Model: Thin Slicing the ability of our unconscious to find patterns in situations and behavior based on very narrow slices of experience. Malcolm Gladwell, Blink
  • 9. Case Study: A Hospital in Trouble 財 Cook County Hospital struggled with identifying patients in danger of an imminent heart attack. 財 Coronary care unit was overwhelmed. 財 Public hospital, limited resources.
  • 10. Applied Thin-Slicing 財 Lee Goldman, a cardiologist, created a protocol based upon an algorithm developed in partnership with mathematicians. 財 After two years of using a decision tree, hospital staff were 70% more effective at recognizing patients at risk. 財 Less information led to greater success. 財 Technique used by first-responders every day.
  • 11. Fast and Frugal Trees 320 LUAN, SCHOOLER, AND GIGERENZER a ST segment b change? Did prosecution request conditional bail or oppose bail? No Yes Yes No or N.A. Coronary Punitive Chief complaint of Care Unit chest pain? Did previous court impose conditions or remand in custody? No Yes Yes No or N.A. Regular Punitive Nursing Bed Any other factor? Did police impose conditions or (NTG, MI, ST, ST, T) remand in custody? No Yes No or N.A. Yes Regular Coronary Nursing Bed Care Unit Nonpunitive Punitive Figure 4. Two examples of fast-and-frugal trees (FFTs) applied to large world problems. The left tree (a) is designed to help emergency room doctors decide whether to send a patient with severe chest pain to the Coronary Care Unit (CCU) or a regular nursing bed (Green & Mehr, 1997). The right tree (b) is a model of how British judges decide whether to make a punitive bail decision (Dhami, 2003). (1997) found that, compared with a logistic regression model that Tree models of categorization and decision making have been uses eight cues simultaneously to make a decision, this FFT had a studied in a variety of disciplines, such as medicine, applied higher overall predictive accuracy, in addition to its advantages in statistics, computer science, and psychology (e.g., Breiman, Fried-
  • 12. Method: Resource Description Framework (RDF) 財 Semantic Web technology. 財 Queries based on relationships or mental associations. 財 Graphs treat each packet from capture file as a discrete event with properties. 財 TCP header info in a metadata model. 財 Model replicates human cognitive economy.
  • 13. Thin-Slicing with SPARQL 財 SPARQL query language uses a concise approach for quickly traversing large data sets while capturing similarities between packets as generalizations. 財 RDF statement contains a subject, predicate and an object. 財 Subject defines the event. 財 Predicate defines a characteristic or property. 財 Object contains the value for the predicate.
  • 14. Example: Building A Query sparql select * { ?s ?p ?o.}; sparql select *{ ?e1 <http://www.rrecktek.com/demo/src> ?ip1.};
  • 15. Example ≒ All source IPs and their destination IPs. ≒ For each source, count how many times it went to a destination. ≒ Report source destination and count. sparql SELECT ?src ?dst (count (?dst) as ?count) { ?e1 <http://www.rrecktek.com/demo/src> ?src. ?e1 <http://www.rrecktek.com/demo/dst> ?dst. } ORDER BY DESC (?count);
  • 17. We Cant Fight All Unknowns 財 What we can do 財 Build strong infrastructures minimizing technical debt. 財 Add the equivalent of air bags to the architecture for when intrusions occur. 財 Recognize signature limitations. 財 Investigate the creation of real-time fast and frugal trees. Our patient is dying on the table. Its up to us to change the outcome.
  • 18. Thanks! 財 Michele Chubirka Twitter @MrsYisWhy networksecurityprincess@gmail.com 財 RDF/SPARQL contribution courtesy of Ronald P. Reck rreck@rrecktek.com
  • 19. References "Eclectic Tech." Semantic Web Introduction. N.p., n.d. Web. 20 Dec. 2012. Erwin, Sandra I. "Too Much Information, Not Enough Intelligence." National Defense Magazine. N.p., May 2012. Web. <http://www.nationaldefense.org>. Gigerenzer, Gerd. Gut Feelings: The Intelligence of the Unconscious. New York: Viking, 2007. Print. Gladwell, Malcolm. Blink: The Power of Thinking without Thinking. New York: Little, Brown and, 2005. Print. Luan, Shenghua, Lael J. Schooler, and Gerd Gigerenzer. "A Signal-detection Analysis of Fast-and- frugal Trees." Psychological Review 118.2 (2011): 316-38. Print. Marewski, Julian N., PhD, and Gerd Gigerenzer, PhD. "Heuristic Decision Making in Medicine." Dialogues in Clinical Neuroscience 14.1 (2012): 77-89. Print. Messmer, Ellen. "SANS Warns IT Groups Fail to Focus on Logs for Security Clues." TechWorld. IDG, May 2012. Web. "RDF." -Semantic Web Standards. W3C, n.d. Web. 02 Jan. 2013. "Resource Description Framework (RDF)Model and Syntax." RDF Model and Syntax. W3C, n.d. Web. 02 Jan. 2013. Rieland, Randy. "Big Data or Too Much Information?" Innovations. Smithsonian, 7 May 2012. Web. "Semantic Web Standards." W3C. W3C, n.d. Web. 02 Jan. 2013. Taleb, Nassim. The Black Swan: The Impact of the Highly Improbable. New York: Random House, 2007. Print. Turek, Dave. "The Case Against Digital Sprawl." The Management Blog. Bloomberg Businessweek, 2 May 2012. Web. Verizon 2012 Data Breach Investigation Report. Rep. N.p.: Verizon, n.d. Print.