"Likelihood Times Impact"

Jessy Lang: Welcome back to Security Dialogues. I'm Jessy, and this is episode two. Last time Marcus wanted to sort vulnerabilities by where the attacker was standing, and it did not go well for him. Today he gets to defend something much more popular — and much harder to defend. The risk matrix. Five by five, likelihood times impact, colour-coded, on every second slide in this industry. This week, an important online meeting took place, and Marcus led a customer straight to the decision to ship a patch immediately — based on a single number sitting next to a finding. No further debate. Just the number.

Tess Calder: And you were on that call, Marcus. You handed them that number and watched them make the decision on it. So before you defend the matrix in the abstract — defend that.

— I. What the Matrix Replaced —

Marcus Hale: Gladly. But I want to start with what it replaced, because nobody remembers that part.

Tess Calder: Go on.

Marcus Hale: Before the matrix, we had four groups of people with four private opinions about what was dangerous, and no way to put those opinions next to each other. Engineering thought the crypto was the problem. Legal thought the data retention was the problem. Sales thought the audit finding was the problem, because it was blocking a deal. Each of them was partly right and none of them could be compared to any of the others, so what actually decided priority was who spoke last and how loudly.

Tess Calder: And now it's decided by a number.

Marcus Hale: Now it's decided by a number that all four of them had to agree on. That is not nothing. That is, in fact, most of what I have.

— II. What Is a Three? —

Tess Calder: Then let me ask about the number. What is a three?

Marcus Hale: On likelihood, moderate. Possible, not expected.

Tess Calder: So it's a word. It is the third word in a list of five words. You have written a numeral next to it, and the numeral has no unit, no zero, and no defined distance to the word above it.

Marcus Hale: It has an order. Three is more than two.

Tess Calder: More by how much?

Marcus Hale: More.

Tess Calder: Then you can sort with it. You cannot multiply with it. Multiplying requires that the step from two to three be the same size as the step from four to five. Yours isn't, and you can't even tell me whether it is, because you never defined what the steps measure. What you have is a ranking, and you are doing arithmetic on a ranking, and the arithmetic is producing a number that looks like it was calculated.

Marcus Hale: It ranks consistently.

Tess Calder: It ranks reproducibly. A broken instrument is reproducible. That is the least interesting property a measurement can have.

— III. Where the Sorting Goes Wrong —

Marcus Hale: Give me the harm. Concretely. Where does the sorting go wrong.

Tess Calder: In your own output. Take two rows that both come out at twelve. One is a four on likelihood and a three on impact — it happens most quarters, it costs a few days, everybody is annoyed. The other is a three and a four — it almost never happens and when it does you are explaining it to a regulator. Your matrix puts both in the same cell and tells the business they warrant the same treatment.

Marcus Hale: They warrant the same attention.

Tess Calder: They warrant nothing of the kind. One is an operating cost. You should budget for it and stop discussing it in this room. The other is a question about whether you survive a bad year, and it belongs in a completely different conversation with completely different people. The only thing that put them in the same cell was a multiplication you were not entitled to perform.

Marcus Hale: …I'll give you that. Not the conclusion, the arithmetic. You're right about the arithmetic and I have known you were right about it for years.

Tess Calder: Then why is it still on your slides?

— IV. The Meeting Still Has to Happen —

Marcus Hale: Because I have never been handed anything that does the other thing it does. The matrix is not a calculation, Tess. It is a table people have to sit at. The number is the excuse for the meeting. Take the number away and the meeting does not happen, and then we are back to whoever speaks loudest.

Tess Calder: So stop reporting the number and keep the meeting.

Marcus Hale: And say what, at the end of it?

Tess Calder: Say what you just said to me. Two sentences. There is a thing that happens most quarters and costs us days, and there is a thing that almost never happens and ends the product line. That carried more information than the twelve did.

Marcus Hale: It did. It also took four times as long, and there were eleven other items on that agenda, and the person I was saying it to had forty minutes for the entire risk portfolio. You have never had to present one.

Tess Calder: No.

Marcus Hale: All right. My turn. Where do the inputs come from?

Tess Calder: Estimates.

Marcus Hale: From whom?

Tess Calder: From us. From you.

Marcus Hale: So you have spent twenty minutes demanding rigour in the arithmetic while accepting a guess as the input. You did not attack the weak part of the matrix. You attacked the one part of it that was honest about being approximate.

Tess Calder: The multiplication is what makes the guess look like it isn't one.

Marcus Hale: Now that is a real objection, and it is a different one from the one you started with. Say more.

Tess Calder: When you multiply two numbers, the product inherits the properties of both. If one factor is measured and the other is guessed, the product looks as confident as the measurement and is as accurate as the guess. Nobody downstream can tell which half was which. By the time it reaches your board it is a twelve, and a twelve does not remember where it came from.

Marcus Hale: Agreed. Entirely. Now let me ask you the question I have been waiting the whole conversation to ask.

Tess Calder: Ask it.

— V. The Cross-Examination —

Marcus Hale: The Kubernetes engagement. The one where you went from a compromised pod to cluster-admin through an over-broad service account. When that landed on my desk, what likelihood should I have written next to it?

Tess Calder: High.

Marcus Hale: Why?

Tess Calder: Because I did it. It's not theoretical. I have the recording.

Marcus Hale: How long did it take you?

Tess Calder: Nine days.

Marcus Hale: With what?

Tess Calder: With the scope document, the architecture diagrams, a contact who answered my questions, and a written promise that nobody would prosecute me.

Marcus Hale: And how many attempts before it worked?

Tess Calder: …Four. Three dead ends.

Marcus Hale: And if it hadn't worked at all, would you have reported that the cluster was safe?

Tess Calder: No. I'd have reported that I didn't find a path in the time we bought.

Marcus Hale: So your method can produce a proof that something is possible, and it cannot produce a proof that anything is unlikely. It is asymmetric by construction. Which means when you hand me "high", you are not telling me how often this happens in the world. You are telling me that a well-resourced, authorised, motivated professional with nine days and four attempts got there once.

Tess Calder: That is more than nothing.

Marcus Hale: It is far more than nothing. It is the best evidence I get all year. But it is evidence about one axis, and you have been handing it to me labelled as though it were about both.

Tess Calder: …Say the rest of it. You've clearly rehearsed this.

Marcus Hale: Every finding you produce is generated under conditions that are close to the attacker's best case. You choose the target, you choose when to stop, and your success criterion is your own. That is exactly what makes your work valuable — you are showing me the ceiling. But a ceiling is not a frequency. I cannot tell from your report whether that path gets walked twice a decade or twice a week, and neither can you, because you have never once been in a position to observe how often anybody tries.

Tess Calder: No. I see who succeeded, and only when someone paid me to be that person.

Marcus Hale: So the likelihood column stays a guess. Not because we are lazy. Because neither of us is instrumented to know it.

— VI. What Tess Won't Give Up —

Tess Calder: Then here is where I don't concede.

Marcus Hale: Please.

Tess Calder: The impact column isn't a guess. Not for the findings I bring you. When I walk a path, I know exactly what it reaches, because I stood at the other end of it. I know which data was readable, which keys were in that namespace, which service accounts were mounted where. That is not an estimate. That is a fact, and it is the only genuinely known quantity in your entire matrix.

Marcus Hale: It is.

Tess Calder: And you take it, and you compress it to a single digit from one to five, chosen by a committee that never walked the path — and then you multiply my fact by your guess and report the product as one number. You didn't just launder the guess, Marcus. You destroyed the only thing in there that anybody actually knew.

Marcus Hale: …Yes. That is the better version of your objection, and it is worse for me than the one about ordinal scales.

Tess Calder: It's the same objection. I just found the right end of it.

— VII. Marcus Puts It in Order —

Marcus Hale: Let me put it in order, because I think we ended up somewhere neither of us started. The arithmetic is indefensible and I am not going to defend it again. Two rankings multiplied together produce a number with no units, and identical products can describe situations that require entirely different responses from entirely different people. That much is settled. But the objection I thought Tess was making — that the matrix is imprecise — was the weak one, because both of us were about to replace it with something built from the same guesses. The real objection is about what the multiplication does to the inputs. One factor is knowable. One is not. When you multiply them, the product looks as confident as the knowable half and is as accurate as the guessed half, and by the time it reaches the people who allocate money, nobody can tell which was which. Call it borrowed certainty. The guess borrows the confidence of the measurement, and the measurement is destroyed in the transaction. Which tells us what to do differently, and it isn't a better formula. It's refusing to combine the two. Report what is known as known: this path was walked, here is what it reached, here is who confirmed it. Report the frequency separately, as an assumption, in words, with a name attached to it — because someone chose that number and that person should be findable six months later. Two lines instead of one. And the thing I have to give up is the sorted list, which was the only reason I ever wanted the number. Tess, it's yours. You were wrong first tonight.

— VIII. Tess Concludes —

Tess Calder: I was, and I want to say exactly how, because it's not the part that's going to be obvious. I came in with the mathematics and the mathematics was correct. That's what made it comfortable. What I had not looked at was my own contribution to the thing I was attacking. Every report I have ever written says "high" somewhere, and I have never once had the standing to say it. I don't know how often anything happens. I have never watched a system that nobody was paying me to break. I see the attempts that succeeded, performed by the best-resourced attacker that organisation will ever face, who was me, and who was allowed to try four times. That is a proof of possible. I have been handing it over labelled as probable, and then complaining about what got done with it downstream. So I'll take the correction, and I'll take the instruction that comes with it. The likelihood column is not mine and I should stop filling it in. The impact column is mine, entirely, and I have been letting it be compressed into one digit without objecting, which was the more serious failure of the two. And Marcus — you should stop reporting the product. Not because I won the argument about ordinal scales. Because the number you are reporting has my only fact inside it, and nobody can see it in there.

— Outro —

Jessy Lang: Borrowed certainty. That's the one I'm keeping — a guess and a measurement go into the multiplication, and what comes out has the confidence of the one and the accuracy of the other. I'm going to be insufferable about this in the next planning meeting I'm allowed into. Marcus, Tess — thank you. That's twice now that the person who came in correct left with homework. If you've got a risk matrix on a slide somewhere and you're now looking at it differently, tell us. We read everything. Subscribe wherever you're listening to this, and leave us a rating if the argument was worth your commute. Next time we're bringing in someone new, because the topic doesn't work without her. Nora runs a product line that is hardware with software inside, and she is going to explain to both of these two why shipping a fix and having a fix installed are two completely different events — and why one of them sometimes involves a van. Until then.