Your Breached Controls May Have Been Reasonable After All
summary
A new reasonableness formula adds utility to Learned Hand’s cost‑benefit algebra and turns on measurable facts: whether MFA or another control was available, how a failed soft‑cert reduced protection, how many users abandoned the app, and whether stolen health records appear on the dark web. The panel uses Sedona test plus CIS RAM to score benefits (Google cites ~96% prevention for MFA) against real costs—lost usability, support labor, and deployment limits—to decide if controls are defensible.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:50Who is Jim Trilling
- 4:42Who is Chris Cronin
- 5:55Who is Phyllis Lee
- 9:39The Test
- 10:45The Scenario
- 15:02Multifactor Authentication
- 19:12Risk Assessment Method
- 24:26Does the Sedona Test Help
- 35:23Sedona Test for Reasonableness
- 37:21Discussion
related talks
26mThe Risky Business of Risk Illiteracy (Sean Juroviesky)
51mReasonable Cybersecurity: Oxymoron or Opportunity?
31mThe business case for FIDO token
32mThe One About Controls
47mYour Cybersecurity Budget Is a Horse’s Behind
52mPhilosophizing Security In A "Mobile-First" World
47mTechniques to Evolve Risk Governance and Comply with SEC Cybersecurity Rule
38mAnatomy of the Attack: The Rise and Fall of MFA