Opening Keynote: Prove It! Confronting Security With Data.
summary
Argues security should be measured by concrete rates not adjectives, proposing to quantify the rate of new exploitable risks and the time‑to‑live (survival) of vulnerabilities, then correlate those rates with practices. Uses Bayesian methods (beta‑binomial), Monte Carlo and survival analysis implemented in R, applied to bug bounty hits, escape rates by scrum team and P0/P1/P2 SLAs. Gives numeric examples (fortune 500 breach odds ~1–8%, attack surface estimates ~16–25%), shows code and models that update beliefs and drive ROI and insurance decisions.
AI-written summary · about
chapters (15)
- 0:00Intro
- 2:33Measurement Experts
- 5:02The Object of Measurement
- 5:51Natural Sciences Examples
- 8:42Object of Measurement
- 12:51Breach
- 15:47Bayesian Methods
- 17:04Data Science
- 21:55Vulnerability Escape Rates
- 25:42What if you have no data
- 26:06Large enterprise risk
- 27:25How do we get probabilities
- 29:46Be a Bookie
- 37:11Survival Analysis
- 38:31Can This Be Applied Assurance
related talks
59mKeynote: Measure Security Effectively
01h 20mKeynote: BSIMM: A Decade of Software Security
42mKeynote: How much security is too much?
49mKeynote: CISO Perspectives
15mKeynote
23mSecurity Outgunned: Measuring Software Defined Attack Surface
42mReal-World Security Implementations and Key Lessons
39mKeynote - The Infosec Survival Field Guide