About the series
Abstract
In a traditional threat model a user Alice faces an attacker Mallory. Against a sufficiently motivated attacker Alice must neglect nothing. Assuming that Mallory will keep going until he exhausts his attacks (or succeeds) it is both necessary and sufficient to block all possible attacks. Thus, security is only as good as the weakest link, and so on. While simple, and appropriate in high-assurance settings, we show that this model does not scale and is inappropriate to the financially-motivated cybercrime that targets the masses. It is arithmetically impossible that two billion Internet users face the sufficiently motivated attacker who will stop at nothing. The attackers who prey on Internet users are much more constrained. First, their attacks must be profitable on average: expected gain is greater than expected cost. Second, their attacks must either be scalable, or they must be able to locate viable targets with great accuracy (every failed attack reduces return). Third, they collide: independent attackers compete for the same victims, again reducing the return.
Why does any of this matter? We argue that when we ignore attacker constraints, we make things harder than they need be for defenders, and this is a luxury we can no longer afford. Technology makes possible many attacks that economics shows to be infeasible. When we ignore this we waste effort on the wrong things. We illustrate, with examples, that to reduce the harm experienced by Internet users it is more important to understand the economic constraints of attackers than their technical capabilities.
Speaker
Cormac Herley is a Principal Researcher at Microsoft Research, where he's been since 1999. His main current interests are data analysis problems, authentication and the economics of information security. He has published widely in signal and image processing, information theory, multimedia, networking and security. He is the inventor on over 70 US patents, and has shipped technologies used by hundreds of millions of users. He received the PhD degree from Columbia University, the MSEE from Georgia Tech, and the BE(Elect) from the National University of Ireland.
To Join the Webinar:
The Webinar will be held from 12:00-1:00pm EDT on March 21, 2013 in Room 110.
To attend virtually, please register at: http://www.tvworldwide.com/events/nsf/130321/
