Cyber vulnerabilities and the threat of attack: Making things better: Michael Siegel James Houghton MIT Sloan School of Management http://ic3.mit.edu

Vulnerabilities and Cybersecurity

Vulnerabilities

Creating a Vulnerability Typology Vulnerability Characteristics Quantity of Vulnerabilities Scarce - Numerous Ease of Vulnerability Discovery Easy - Difficult to Find Likelihood of Vulnerability Rediscovery Low - High Patching Dynamics Technical Difficulty of Remediation Easy - Hard to Fix Logistical Difficulty of Remediation Easy - Hard to Access Average Life of a Vulnerability Short - Long Market Dynamics Third Party Market for Vulnerability Offensive, Defensive, Mixed, Etc. Market Size Small - Large Bug Bounty Program Yes, No Human Dynamics Attackers Criminals, States, Patriots, Etc. Researcher Pool We need to know the characteristics of the software products/environments that we’re dealing with.

System Dynamics Modeling Models Human Systems Simulates Dynamic Behavior Process Improvement Market Crises Government Stability Software Development Hopes Fears Used for over 50 years Eliminate limitations of linear logics and over-simplicity Based on system structure, behavior patterns, interconnections of positive & negative feedback loops SDM helps to uncover ‘hidden’ dynamics in system Helps understand ‘unfolding’ of situations, Helps anticipate & predict new modes Explore range of unintended consequences Time Formalizes connection, causality, and feedback Gives Structure to Data

Undiscovered Vulnerabilities Patching There are only so many ways an attacker can interact with the system, and so there is a large, but finite number of vulnerabilities. As we don’t know exactly what they are, we’ll call them ‘Undiscovered Vulnerabilities’. In system dynamics, when we want to show that we’re tracking a stock of something, we put it in a box. <Advance> Now, software vendors do their best to minimize this stock, and actively search for and patch vulnerabilities both before and after the software is released. Perhaps surprisingly, they are helped by a whole group of white-hat hackers who may have other jobs, but who find vulnerabilities and report them to vendors to be patched. We’ll track the flow of vulnerabilities out of this stock and call it ‘Patching’.

Offensive Stockpile Undiscovered Vulnerabilities Discovery Patching Deployment Other actors are also looking for vulnerabilities. Black-hat hackers find these vulnerabilities and stockpile them for use in zero-day exploits. This stock decreases as vulnerabilities get patched, <Advance> or as they are deployed in attacks. <Advance> This is the stock that has the largest impact on cyber risk - not the total number of vulnerabilities, but the availability of those vulnerabilities for use in exploits by offensive actors. <Add a case study? Something with a human face and a name?>

Black Hat Capability Undiscovered Vulnerabilities Offensive Stockpile Learning, Recruiting Leaving, Erosion Undiscovered Vulnerabilities Offensive Stockpile Lets look at how this discovery takes place. Black hat hackers have some level of capability which depends on their numbers and their average skill. Over time, their capability erodes as technology changes and people leave the group. <Advance> Black hats also have some level of motivation which is dependent on the perceived reward for finding vulnerabilities, in terms of money, reputation, or pride. <Advance> Together, these factors influence the rate at which vulnerabilities are discovered and stockpiled. Discovery Patching Patching Deployment

Black Hat Capability Undiscovered Vulnerabilities Offensive Stockpile Learning, Recruiting Leaving, Erosion Undiscovered Vulnerabilities Offensive Stockpile Remember that army of white hat hackers that we discussed before? Well they behave in similar ways, and respond to similar pressures. Growth in their capacity influences the rate of patching. Now we have a highly simplified model of the human components of the vulnerability system. As fun as this was, we didn’t build it just to look at. We want to know how we can change the behavior of the system. What can we do - what inputs can we change - to make the system behave the way we want? Well, lets think like a hacker. What could we change? <Poll audience> Discovery Patching Patching Deployment White Hat Capability Learning, Recruiting Leaving, Erosion

Lets jump over for a second and look at the data. This chart shows the

Discovery Correlation Undiscovered Vulnerabilities Offensive Stockpile Discovery Patching Patching Deployment White Hat Capability Discovery Correlation

No Correlation White Hat Black Hat

Some Correlation White Hat Black Hat

In Simulation

How does discovery correlation arise? Fixed code base Heterogeneous vulnerabilities Common techniques between research groups

For a young piece of software With our model parameters, 9% overlap

For a hardened piece of software With our model parameters, 0.8% overlap

Dynamics of Threats and Resilience (using System Dynamics modeling) * Verizon Data Breach Report 67% were aided by significant errors (of the victim) How did breaches (threats) occur? * 64% resulted from hacking 38% utilized Malware How are security and threat processes (resilience) managed? * Over 80% of the breaches had patches available for more than 1 year 75% of cases go undiscovered or uncontained for weeks or months

Senior Management (CIO) Making the Case Blue is base case; red case is patching with configuration standards; green is current case 200 150 100 50 10 20 30 40 60 70 80 90 Time (Year) Year 170 140 110 Not Compromised Attack Vectors Infected Technical 10 7.5 5 2.5 20 30 40 50 60 70 80 90 100 Time (Year) 17 14 11 8 “Upstream Costs” “Downstream Costs” Managers 2,000 1,500 1,000 500 10 20 30 40 50 60 70 80 90 100 Time (Year) Total Costs Senior Management (CIO)

Summary Models can explain the dynamics of vulnerabilities and researcher motivation and exploits Understanding the tools and techniques of finding vulnerabilities helps to improve security Models help understand the security issues in patching and software release dynamics Solving security problems “upstream” is more effective than fixing them “downstream.” These analyses and modeling techniques can apply to any type of organization