Skip to content

Instantly share code, notes, and snippets.

@marcinantkiewicz

marcinantkiewicz/Risk Management reading list.md

Last active September 12, 2018 16:06
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save marcinantkiewicz/fb1706d471729595608acc0e990563c4 to your computer and use it in GitHub Desktop.
Save marcinantkiewicz/fb1706d471729595608acc0e990563c4 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Risk Management reading list.md

Note, a lot of content here is from SIRA lists/posts. If you are interested in the topic, please join SIRA.

TODO

  • Group items in a sane way.
  • The papers probably should be listed in a quotable format of some standard. Same with books?
  • This list grew a bit big, probably should be split into separate lists per category. I started listing by person, but it probably makes no sense.
  • The books and podcasts are the only lists that I think are substantial. The rest is not even stubs.

Books

Some of the books are available used on Ebay, for a fraction of the Amazon price.

Cormac Haley, et all

MS Research. He researches basics - techniques (surveys), analysis tools (ROC curve), etc. Besides, exceptionally interesting work.

  • Why do Nigerian Scammers Say They are from Nigeria?

    False positives cause many promising detection technologies to be unworkable in practice. Attackers, we show, face this problem too. In deciding who to attack true positives are targets successfully attacked, while false positives are those that are attacked but yield nothing. This allows us to view the attacker’s problem as a binary classification. The most profitable strategy requires accurately distinguishing viable from non-viable users, and balancing the relative costs of true and false positives.

  • Sex, Lies and Cyber-crime Surveys

    The importance of input validation has long been recognized in security. Code injection and buffer overflow attacks account for an enormous range of vulnerabilities. “You should never trust user input” says one standard text on writing secure code. It is ironic then that our cyber-crime survey estimates rely almost exclusively on unverified user input. A practice that is regarded as unacceptable in writing code is ubiquitous in forming the estimates that drive policy. A single exaggerated answer adds spurious billions to an estimate, just as a buffer overflow can allow arbitrary code to execute. This isn’t merely a possibility. The surveys that we have exhibit exactly this pattern of enormous, unverified outliers dominating the rest of the data.

  • So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users

    Given a choice between dancing pigs and security, users will pick dancing pigs every time.” While amusing, this is unfair: users are never offered security, either on its own or as an alternative to anything else. They are offered long, complex and growing sets of advice, mandates, policy updates and tips. These sometimes carry vague and tentative suggestions of reduced risk, never security. We have shown that much of this advice does nothing to make users more secure, and some of it is harmful in its own right. Security is not something users are offered and turn down. What they are offered and do turn down is crushingly complex security advice that promises little and delivers less.

  • Where Do All The Attacks Go?

    The threat model we propose goes some way to closing the gap between potential and actual harm. The constraint that attacks must be profitable in expectation removes a great many attacks that otherwise appear economic. It guarantees that the attacker sees a sum-of-effort rather than a weakest-link defense. It’s not enough that something succeed now-and-then, or when the circumstances are right, or when all the ducks are in a row. When attacking users en masse, as Internet attackers do, attacks must be profitable at scale.

  • Where Do Security Policies Come From?

    Our conclusions suggest that, at least in the case of passwords, exactly such an overshoot occurs. Some of the largest and most attacked sites on the web allow 6 character PINS or lowercase passwords. By contrast, government and university sites generally have far stronger (and far less usable) policies. The reason we suggest lies not in greater security requirements, but in greater insulation from the consequences of poor usability.

  • Passwords and the Evolution of Imperfect Authentication

    We identify as outdated two models that still underlie much of the current password literature. First is the model of a random user who draws passwords uniformly and independently from some set of possible passwords. It has resulted in overestimates of security against guessing and encouraged ineffectual policies aimed at strengthening users’ password choices. The second is that of an offline attack against the password file. This model has inflated the importance of unthrottled password guessing relative to other threats (such as client malware, phishing, channel eavesdropping and plaintext leaks from the back-end) that are more difficult to analyze but significantly more important in practice. Together, these models have inspired an awkward jumble of contradictory advice that is impossible for humans to follow.

Mix

Dan Geer

Jennifer Bayuk

Sasha Romanosky

Conference proceedings, etc

MMOCs

[https://www.edx.org/course/ignorance-wu-zhi-anux-igno101x?source=aw&awc=6798_1518220293_a9044d7a4a4f887ce91b9ac350800257] promo video

Podcasts

Methodology or Standards

Reports and whitepapers

Other:

Bureau of labour statistics - Information Security Analysts

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment