Economics of Defense 💰🛡️¶

One of the problems of defense is that cyber warfare is asymmetric. The attacker only needs to find one flaw, but the defender needs to fix all of them.
The goal: The CIA triad: 🔺
- Confidentiality: Information is not disclosed to unauthorized parties.
- Integrity: Information is not altered or destroyed in an unauthorized manner.
- Availability: Information is accessible and usable upon demand by an authorized entity.

Security vs Usability: ⚖️💻¶

The most secure computer is unplugged, buried in concrete, and guarded by sharks.
Problem: it is useless, completely unusable.
The easiest way to make something secure is to make it completely unusable.

Security measures must be psychologically acceptable. If security is too hard, users will bypass it.

Example: You can make your users have a super complicated password that’s really hard to crack, like æjalsASDJFOASDIF439II)/)(#d, but instead of memorizing it the user will probably just write it on a sticky note.

We do not eliminate risk, we manage it. ⚠️

$\text{Risk} = \text{Threat} \times \text{Vulnerability} \times \text{Cost}$.

Threat: Who wants to attack us? What is the threat?
Vulnerability: How easy is it to attack us? How vulnerable are we?
Cost: What is the cost of the attack? What do we lose?
(Threat × Vulnerability = is the likelihood of an attack happening.) With countermeasures, we can address the vulnerability part. But we can also reduce the cost (impact), like having backups and having a plan for how we respond.

Mitigation is not the only option when facing a risk:

Mitigate/reduce: Reduce likelihood or impact to an acceptable level.
Avoid: Discontinue the activity that generates the risk. (E.g., we will not store credit card info, so we avoid the risk of leaking it.)
Accept: The cost of the fix > impact of the risk. (E.g., small website that gets few visitors, so we accept the risk of DDoS.)
Transfer: Move risk to a third party (e.g., insurance).

Do a cost-benefit analysis when deciding on countermeasures.

[!example] You do not buy a $5,000 titanium lock to secure a $50 bike.

Defense cost must not exceed the value of what is being protected.

Defense in Depth: Multiple layers of defense, so if one fails, others are still there.